Questions on AKHQ UI Security

[ritambanik]

I'm trying to configure AKHQ Security so that I can provide access to topics, consumer groups, topic data and schemas based on teams. We have teams with IDs like - 25900, 25920 etc. And hence, topics/groups/schema will have the corresponding team ID.

Please find the security setup in the attached docker compose file.

Expected Behavior

1. User 'dt233894' should be able to only see and read topics/topics data having '25900' in their names across all clusters.
2. User 'dt233894' should be able to only see and read consumer groups having '25900' in their names across all clusters.
3. User 'dt233894' should have all permissions on schemas prefixed with 'project' across all clusters with prefix 'prod'.

Actual Behavior

1. User 'dt233894' is able to view and read all topics and topic data.
2. User 'dt233894' is able to view and read all consumer groups.
3. User 'dt233894' is able to perform operations on all schemas.

docker-compose-dev-rbac-image.yml.txt

Questions

1. Does AKHQ support UI security as I've mentioned above?
2. Will it be able to filter out resources based on regex 'patterns'?

[AlexisSouquiere]

1. Yes
2. Yes

Try to remove akhq.security.ldap.default-group: topic-reader because this group adds permission to view all the topics without restrictions

[ritambanik]

Thanks for your reply. It's working now. Really it's a nice feature and provides UI RBAC controls.
I was reading the documentation about the Rest API here related to UI security - https://akhq.io/docs/configuration/authentifications/external.html. Can you please explain the below?

akhq: security: default-group: no-roles rest: enabled: true url: https://external.service/get-roles-and-attributes groups: # anything set here will not be used
What is meant by the 'url'? Does this mean I can maintain the security mapping in an external location? If yes, can it be my GitHub repo and what should be the format of this file storing the mapping?

Thanks!

[AlexisSouquiere]

This feature allows you to use an in-house service that will handle the user/groups mapping and return a payload expected by AKHQ. It can be whatever you want if you expose a service with an HTTP endpoint that AKHQ can call to get the permissions for a user. So it can't be a single file only; but a REST API that process a file, database, etc. to send the groups for a user yes.

At Michelin for instance, we developed the ns4kafka tool to bring the K8S namespace feature as well as resource management in Kafka (to have a better isolation between projects' resources). In this ns4kafka tool, we expose an endpoint to be able to get the groups for a user, matching its ns4kafka permissions.

[ritambanik]

Thanks for sharing the info on ns4kafka. Does this mean that one can setup team specific namespaces to hold the teams' resources like topics (all part of the same Kafka cluster)? Also how can one isolate connectors and schemas as all connectors/schemas are stored in __schemas and connect-configs topics respectively in a single Kafka cluster?

[AlexisSouquiere]

Yes that's the purpose of ns4kafka. A namespace contains all the resources for a team/project. Resources will have a prefix identifying the namespace. All the kafka resources (topics, connectors, schema, consumer groups, acls) can be managed