avoid mixing roles and attributes

[leonardotorresaltez]

Hello .

i have the rolbindings.yaml file for akhq , and i want to know how to prevent the following behavior.

I have two roles:

• ROLE 1 : a role to update offset in apple.* topics
• ROLE 2: a role to read pears.* topics

When a user has asigned these two roles, then the user can update the offset in apple.* (expected) and pears.* (not expected) topics.

How can i prevent the user update offsets in pears .* topics ?
Are there extension points in AKHQ then could i change the default behavior ?

ROLE 1

        apple-reader:
          name: apple-reader
          roles: 
            - topic/data/read
            - group/offsets/update
          attributes:
            topics-filter-regexp:
              - "apple.*"
            consumer-groups-filter-regexp
              - "apple.*"

ROLE 2

        pears-reader:
          name: pears-reader
          roles: 
            - topic/data/read
            - group/offsets/update
          attributes:
            topics-filter-regexp:
              - "pears.*"
            consumer-groups-filter-regexp:
              - "pears.*"

regards,
Leonardo

[AlexisSouquiere]

You seem to be using an outdated version of AKHQ. Can you consider moving to the 0.25.1 ?
RBAC was rewrote and corresponds to the current doc https://akhq.io/docs/configuration/authentifications/groups.html

[leonardotorresaltez]

Hi Alexis, thanks for your response.

then it means the new behavior in 0.25.1 does not mix the patterns (regexp expressions) ?

i was looking for the changes explanation, but it tells about only to change some cookie in micronaut
#1472

regards,
Leonardo

[AlexisSouquiere]

Yes, the new version will solve this kind of issue. You can check the application.example.yml file to see how to use the new RBAC