ksqlDB Cluster Authentication and Authorization Auditable Event Methods on Confluent Cloud

Confluent Cloud audit logs contain records of auditable events for authentication and authorization actions on ksqlDB clusters. When an auditable event occurs, a message is sent to the audit log and is stored as an audit log record.

Note

When group mapping is enabled, additional properties are included in authenticationInfo (identity) and in authorizationInfo (assignedPrincipals and actingPrincipal).

ksqlDB cluster authentication events

The following actions or operations for authentication to a ksqlDB cluster resource generate auditable event messages for the io.confluent.ksql.server/authentication event type.

Method name	Action triggering an auditable event message
ksql.Authenticate	A request for authentication to a ksqlDB cluster.

ksql.Authenticate

The ksql.Authenticate event is generated by a request for authentication to a ksqlDB cluster.

To view an example event message, expand the following dropdown:

ksqlDB cluster authorization events

The following actions or operations on authorization of a ksqlDB cluster resource generate auditable event messages for the io.confluent.ksql.server/authorization event type.

Method name	Action triggering an auditable event message
ksql.Authorize	A request for authorization on a ksqlDB cluster.

ksql.Authorize

The ksql.Authorize event is generated by a request for authorization on a ksqlDB cluster.

To view example event messages, expand the following dropdowns:

The following example includes identity, assignedPrincipals, and actingPrincipal, which appear only when group mapping is enabled.

Success: Group mapping enabled

{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/",
      "methodName":"ksql.Authorize",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"3f4146f5-7635-4cd7-8c4c-87f5b9cb9e09"
                  },
                  {
                     "type":"ENVIRONMENT",
                     "resourceId":"env-kk1ndv"
                  },
                  {
                     "type":"CLOUD_CLUSTER",
                     "resourceId":"lkc-9g7o8y"
                  }
               ]
            },
            "resource":{
               "type":"KSQL",
               "resourceId":"ksqlDB_cluster_0"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-8k9y9q"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=3f4146f5-7635-4cd7-8c4c-87f5b9cb9e09/sso-connection=aupm-connection/identity=user@confluent.io"
      },
      "authorizationInfo":{
         "result":"ALLOW",
         "operation":"Contribute",
         "rbacAuthorization":{
            "role":"OrganizationAdmin",
            "cloudScope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"3f4146f5-7635-4cd7-8c4c-87f5b9cb9e09"
                  }
               ]
            },
            "resourceType":"KsqlCluster",
            "patternType":"LITERAL",
            "patternName":"*",
            "operation":"All",
            "actingPrincipal":"User:u-123"
         },
         "resourceName":"ksqlDB_cluster_0",
         "resourceType":"KsqlCluster",
         "assignedPrincipals":[
            "u-123",
            "group-123"
         ]
      },
      "requestMetadata":{
         "requestId":[
            "94554576-9326-11ed-b79b-8de1d6035cf7"
         ]
      },
      "request":{
         "accessType":"READ_ONLY"
      },
      "resourceName":"crn://confluent.cloud/organization=3f4146f5-7635-4cd7-8c4c-87f5b9cb9e09/environment=env-kk1ndv/cloud-cluster=lkc-9g7o8y/ksql=ksqlDB_cluster_0"
   },
   "subject":"crn://confluent.cloud/organization=3f4146f5-7635-4cd7-8c4c-87f5b9cb9e09/environment=env-kk1ndv/cloud-cluster=lkc-9g7o8y/ksql=ksqlDB_cluster_0",
   "specversion":"1.0",
   "id":"218a08c0-267e-46b4-84ed-344071bcd12e",
   "source":"crn://confluent.cloud/",
   "time":"2023-01-13T09:42:22.515Z",
   "type":"io.confluent.ksql.server/authorization"
}