Important

You are viewing documentation for an older version of Confluent Platform. For the latest, click here.

Configuring the LDAP Authorizer

Configuration Overview

The broker configuration (e.g. in server.properties file) must set authorizer.class.name to io.confluent.kafka.security.ldap.authorizer.LdapAuthorizer to enable LDAP group-based authorization.

authorizer.class.name=io.confluent.kafka.security.ldap.authorizer.LdapAuthorizer
authorizer.class.name

Fully qualified class name of the Kafka broker authorizer implementation class that implements the kafka.security.auth.Authorizer interface.

  • Type: class
  • Default: “”
  • Importance: low

The following configuration options of SimpleAclAuthorizer are also processed by the LDAP authorizer.

super.users

Semicolon-separated list of principals of super users or super groups who are allowed access to all of the resources for all of the actions for all of the hosts. If a resource has no ACLs associated with it, then only super users can access the resource. For an example of how to set this, see Configure Brokers.

  • Type: string
  • Default: “”
  • Importance: medium
allow.everyone.if.no.acl.found

Boolean flag that indicates if everyone is allowed access to a resource if no ACL is found for the user principal or any of the groups that the user belongs to.

  • Type: boolean
  • Default: false
  • Importance: medium

Additional configuration options for the LDAP authorizer described below are prefixed with ldap.authorizer.. These options should be configured to match the settings on your LDAP server to enable the LDAP authorizer to obtain the mapping of user principals to groups from your LDAP server.

Configuring LDAP Context

All broker configuration options starting with ldap.authorizer.java.naming. and ldap.authorizer.com.sun.jndi. will be stripped of the ldap.authorizer. prefix and used in the creation of the LDAP context used to make connections to the LDAP server. ldap.authorizer.java.naming.provider.url must be configured with the URL of your LDAP server. For example:

ldap.authorizer.java.naming.provider.url=ldap://somehost:389

Configuring GSSAPI for LDAP

GSSAPI may be used to authenticate the LDAP authorizer with your LDAP server if Kerberos is enabled on your LDAP server. The JAAS configuration for GSSAPI may be configured using the config option ldap.authorizer.sasl.jaas.config. For example:

ldap.authorizer.sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \
  keyTab="/tmp/keytabs/ldap.keytab" \
  principal="ldap@EXAMPLE.COM" \
  storeKey="true" \
  useKeyTab="true";

If ldap.authorizer.sasl.jaas.config is not configured, the default JAAS configuration of the broker will be used. The default JAAS configuration (e.g configured using the system property java.security.auth.login.config) is loaded from the login context KafkaServer that is used as broker’s login context using a single shared login. This should be used for LDAP only if the principal in this context can be used to search LDAP.

Configuring SSL for LDAP

You can enable SSL for the connections from the LDAP authorizer to your LDAP server by setting ldap.authorizer.java.naming.security.protocol=SSL. All the SSL configuration options of Kafka clients are supported and must be prefixed with ldap.authorizer.. For example:

ldap.authorizer.java.naming.security.protocol=SSL
ldap.authorizer.ssl.truststore.location=/path/to/truststore.jks
ldap.authorizer.ssl.truststore.password=truststore-secret

LDAP Authorizer Configuration Options

Confluent License

ldap.authorizer.license

Confluent issues a license key to each subscriber. The license key is a short snippet of text that you can copy and paste. Without the license key, you can use Confluent security plugins for a 30-day trial period. If you are a subscriber and don’t have a license key, please contact Confluent Support at support@confluent.io.

  • Type: string
  • Default: “”
  • Importance: high

LDAP Search Configuration

ldap.authorizer.refresh.interval.ms

LDAP group cache refresh interval in milliseconds. If set to zero, persistent LDAP search is used.

  • Type: int
  • Default: 60000
  • Importance: medium
ldap.authorizer.search.page.size

Page size for LDAP search if persistent search is disabled (refresh interval is greater than zero). Paging is disabled by default.

  • Type: int
  • Default: 0
  • Importance: medium
ldap.authorizer.search.mode

LDAP search mode that indicates if user to group mapping is retrieved by searching for group or user entries. Valid values are USERS and GROUPS.

  • Type: string
  • Default: GROUPS
  • Valid Values: [GROUPS, USERS]
  • Importance: medium

LDAP search by groups

ldap.authorizer.group.search.base

LDAP search base for group-based search.

  • Type: string
  • Default: ou=groups
  • Importance: high
ldap.authorizer.group.search.filter

LDAP search filter for group-based search.

  • Type: string
  • Default: “”
  • Importance: medium
ldap.authorizer.group.search.scope

LDAP search scope for group-based search. Valid values are 0 (OBJECT), 1 (ONELEVEL) and 2 (SUBTREE).

  • Type: int
  • Default: 1
  • Importance: medium
ldap.authorizer.group.object.class

LDAP object class for groups.

  • Type: string
  • Default: groupOfNames
  • Importance: medium
ldap.authorizer.group.name.attribute

Name of attribute that contains the name of the group in a group entry obtained using an LDAP search. A regex pattern may be specified to extract the group name used in ACLs from this attribute by configuring ldap.authorizer.group.name.attribute.pattern.

  • Type: string
  • Default: cn
  • Importance: high
ldap.authorizer.group.name.attribute.pattern

Java regular expression pattern used to extract the group name used in ACLs from the name of the group obtained from the LDAP attribute specified using ‘ldap.authorizer.group.name.attribute`. By default the full value of the attribute is used.

  • Type: string
  • Default: “”
  • Importance: low
ldap.authorizer.group.member.attribute

Name of attribute that contains the members of the group in a group entry obtained using an LDAP search. A regex pattern may be specified to extract the user principals from this attribute by configuring ldap.authorizer.group.member.attribute.pattern.

  • Type: string
  • Default: member
  • Importance: high
ldap.authorizer.group.member.attribute.pattern

Java regular expression pattern used to extract the user principals of group members from group member entries obtained from the LDAP attribute specified using ldap.authorizer.group.member.attribute. By default the full value of the attribute is used.

  • Type: string
  • Default: “”
  • Importance: medium
ldap.authorizer.user.dn.name.pattern

Java regular expression pattern used to extract user name from the distinguished name of the user when user is renamed. This is used only when persistent search is enabled. By default ldap.authorizer.user.name.attribute is extracted from the DN.

  • Type: string
  • Default: “”
  • Importance: low

LDAP search by users

ldap.authorizer.user.search.base

LDAP search base for user-based search.

  • Type: string
  • Default: ou=users
  • Importance: medium
ldap.authorizer.user.search.filter

LDAP search filter for user-based search.

  • Type: string
  • Default: “”
  • Importance: medium
ldap.authorizer.user.search.scope

LDAP search scope for user-based search. Valid values are 0 (OBJECT), 1 (ONELEVEL) and 2 (SUBTREE).

  • Type: int
  • Default: 1
  • Importance: medium
ldap.authorizer.user.object.class

LDAP object class for users.

  • Type: string
  • Default: person
  • Importance: medium
ldap.authorizer.user.name.attribute

Name of attribute that contains the user principal in a user entry obtained using an LDAP search. A regex pattern may be specified to extract the user principal from this attribute by configuring ‘ldap.authorizer.user.name.attribute.pattern’.

  • Type: string
  • Default: uid
  • Importance: medium
ldap.authorizer.user.name.attribute.pattern

Java regular expression pattern used to extract the user principal from the name of the user obtained from the LDAP attribute specified using ‘ldap.authorizer.user.name.attribute`. By default the full value of the attribute is used.

  • Type: string
  • Default: “”
  • Importance: medium
ldap.authorizer.user.memberof.attribute

Name of attribute that contains the groups in a user entry obtained using an LDAP search. A regex pattern may be specified to extract the group names used in ACLs from this attribute by configuring ldap.authorizer.user.memberof.attribute.pattern.

  • Type: string
  • Default: memberof
  • Importance: medium
ldap.authorizer.user.memberof.attribute.pattern

Java regular expression pattern used to extract the names of groups from user entries obtained from the LDAP attribute specified using ldap.authorizer.user.memberof.attribute. By default the full value of the attribute is used.

  • Type: string
  • Default: “”
  • Importance: medium

Error Handling Configuration

ldap.authorizer.retry.backoff.ms

Initial retry backoff in milliseconds. Exponential backoff is used if ldap.authorizer.retry.backoff.max.ms is set to a higher value.

  • Type: int
  • Default: 100
  • Importance: medium
ldap.authorizer.retry.backoff.max.ms

Maximum retry backoff in milliseconds. Exponential backoff is used if ldap.authorizer.retry.backoff.ms is set to a lower value.

  • Type: int
  • Default: 1000
  • Importance: medium
ldap.authorizer.retry.timeout.ms

Timeout for LDAP search retries after which the LDAP authorizer is marked as failed. All requests are denied access if a successful cache refresh cannot be performed within this time.

  • Type: long
  • Default: 3600000
  • Importance: medium

SSL Configuration for LDAP connection

ldap.authorizer.ssl.protocol

The SSL protocol used to generate the SSLContext. Default setting is TLS, which is fine for most cases. Allowed values in recent JVMs are TLS, TLSv1.1 and TLSv1.2. SSL, SSLv2 and SSLv3 may be supported in older JVMs, but their usage is discouraged due to known security vulnerabilities.

  • Type: string
  • Default: TLS
  • Importance: medium
ldap.authorizer.ssl.provider

The name of the security provider used for SSL connections. Default value is the default security provider of the JVM.

  • Type: string
  • Default: null
  • Importance: medium
ldap.authorizer.ssl.enabled.protocols

The list of protocols enabled for SSL connections.

  • Type: list
  • Default: TLSv1.2,TLSv1.1,TLSv1
  • Importance: medium
ldap.authorizer.ssl.keystore.type

The file format of the key store file. This is optional for client.

  • Type: string
  • Default: JKS
  • Importance: medium
ldap.authorizer.ssl.truststore.type

The file format of the trust store file.

  • Type: string
  • Default: JKS
  • Importance: medium
ldap.authorizer.ssl.key.password

The password of the private key in the key store file. This is optional for client.

  • Type: password
  • Default: null
  • Importance: high
ldap.authorizer.ssl.keystore.location

The location of the key store file. This is optional for client and can be used for two-way authentication for client.

  • Type: string
  • Default: null
  • Importance: high
ldap.authorizer.ssl.keystore.password

The store password for the key store file. This is optional for client and only needed if ssl.keystore.location is configured.

  • Type: password
  • Default: null
  • Importance: high
ldap.authorizer.ssl.truststore.location

The location of the trust store file.

  • Type: string
  • Default: null
  • Importance: high
ldap.authorizer.ssl.truststore.password

The password for the trust store file. If a password is not set access to the truststore is still available, but integrity checking is disabled.

  • Type: password
  • Default: null
  • Importance: high
ldap.authorizer.ssl.cipher.suites

A list of cipher suites. This is a named combination of authentication, encryption, MAC and key exchange algorithm used to negotiate the security settings for a network connection using TLS or SSL network protocol. By default all the available cipher suites are supported.

  • Type: list
  • Default: null
  • Importance: low
ldap.authorizer.ssl.endpoint.identification.algorithm

The endpoint identification algorithm to validate server hostname using server certificate.

  • Type: string
  • Default: https
  • Importance: low
ldap.authorizer.ssl.keymanager.algorithm

The algorithm used by key manager factory for SSL connections. Default value is the key manager factory algorithm configured for the Java Virtual Machine.

  • Type: string
  • Default: SunX509
  • Importance: low
ldap.authorizer.ssl.secure.random.implementation

The SecureRandom PRNG implementation to use for SSL cryptography operations.

  • Type: string
  • Default: null
  • Importance: low
ldap.authorizer.ssl.trustmanager.algorithm

The algorithm used by trust manager factory for SSL connections. Default value is the trust manager factory algorithm configured for the Java Virtual Machine.

  • Type: string
  • Default: PKIX
  • Importance: low

SASL Configuration for LDAP connection

ldap.authorizer.sasl.jaas.config

JAAS login context parameters for SASL connections in the format used by JAAS configuration files. JAAS configuration file format is described in http://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html. The format for the value is: loginModuleClass controlFlag (optionName=optionValue)*;.

  • Type: password
  • Default: null
  • Importance: medium
ldap.authorizer.sasl.kerberos.service.name

The Kerberos principal name that LDAP service runs as. The value is ldap in all standard LDAP deployments.

  • Type: string
  • Default: null
  • Importance: medium
ldap.authorizer.sasl.login.callback.handler.class

The fully qualified name of a SASL login callback handler class that implements the AuthenticateCallbackHandler interface.

  • Type: class
  • Default: null
  • Importance: medium
ldap.authorizer.sasl.login.class

The fully qualified name of a class that implements the Login interface.

  • Type: class
  • Default: null
  • Importance: medium
ldap.authorizer.sasl.kerberos.kinit.cmd

Kerberos kinit command path.

  • Type: string
  • Default: /usr/bin/kinit
  • Importance: low
ldap.authorizer.sasl.kerberos.min.time.before.relogin

Login thread sleep time between refresh attempts.

  • Type: long
  • Default: 60000
  • Importance: low
ldap.authorizer.sasl.kerberos.ticket.renew.jitter

Percentage of random jitter added to the renewal time.

  • Type: double
  • Default: 0.05
  • Importance: low
ldap.authorizer.sasl.kerberos.ticket.renew.window.factor

Login thread will sleep until the specified window factor of time from last refresh to ticket’s expiry has been reached, at which time it will try to renew the ticket.

  • Type: double
  • Default: 0.8
  • Importance: low