# Configure HTTP Basic Authentication with Control Center on Confluent Platform HTTP Basic authentication is a simple way to implement access control. You can configure Confluent Control Center UI access control using HTTP Basic authentication. This authenticates users’ access to Control Center. You can also [configure Control Center client authentication](#control-center-client-basic-auth) to other Confluent Platform components with HTTP Basic authentication enabled. #### NOTE For more sophisticated access control, [Configure Role-based Access Control for Control Center](c3-rbac.md#controlcenter-security-rbac). ## Enable HTTP Basic authentication for Control Center You can require a user to log in to Control Center by configuring HTTP Basic authentication using Java Authentication and Authorization Service (JAAS). JAAS provides a pluggable model, with details specified at runtime. For details on all configuration options, see [Configure HTTP Basic Authentication with Control Center on Confluent Platform](#ui-authentication). To configure Control Center authentication: 1. Specify the following options in the appropriate [Control Center property file](../installation/properties.md#c3-properties-files). Use the `confluent.controlcenter.rest.authentication.roles` and `confluent.controlcenter.auth.restricted.roles` to create groups of users; either administrators, which have full read and write access, or restricted users that have only read access. Restricted users cannot add or delete topics. - Specify values for `confluent.controlcenter.rest.authentication.roles` in the following format: `,` - The restricted value is the name of your restricted group: `confluent.controlcenter.auth.restricted.roles` is ``. ```bash confluent.controlcenter.rest.authentication.method=BASIC confluent.controlcenter.rest.authentication.realm=c3 confluent.controlcenter.rest.authentication.roles=Administrators,Restricted confluent.controlcenter.auth.restricted.roles=Restricted confluent.controlcenter.auth.session.expiration.ms=600000 ``` 2. Create a JAAS file (`propertyfile.jaas`) similar to the following. In the file, you specify the authentication realm as Control Center (`c3`), and provide the name of password file that will contain the Control Center users and passwords. ```bash c3 { org.eclipse.jetty.security.jaas.spi.PropertyFileLoginModule required file="/path/to/password.properties"; }; ``` Your password file in `password.properties` should look similar to the following, specifying a username followed by a password and that user’s group, either the administrative group or the restricted group. #### NOTE A user with membership in multiple groups is granted only the most restrictive permissions. For example, if a user is a member of two groups, `admin` and `readonly`, and `readonly` is a restricted role, then the user is granted only the rights for the `readonly` group. ```bash admin: , bob: , alice: , ``` 3. Start Control Center passing in an argument to use the JAAS configuration, and specify the properties file that contains the HTTP Basic authentication settings: ```bash CONTROL_CENTER_OPTS="-Djava.security.auth.login.config=/path/to/propertyfile.jaas" \ control-center-start ./etc/confluent-control-center/control-center.properties ``` When a user accesses Control Center, they are shown a dialog similar to the one that follows, which prompts them for sign-in credentials.  For this example, logging in as `bob:` provides read and write access. Logging in as `alice:` provides read-only access. ### Restricted users For users with restricted (read-only) roles, the following user interface (UI) features and options are unavailable/hidden: * Upload [Connect](../connect.md#controlcenter-userguide-connect) configs * Browse connectors * Add, delete, pause, or resume connectors * View connectors settings * Create, delete, or edit [alerts (triggers or actions)](../alerts/index.md#controlcenter-userguide-alerts) * Edit licenses * Edit [brokers](../brokers.md#controlcenter-userguide-brokers) * Press submit on [cluster forms](../clusters.md#controlcenter-userguide-cluster-settings) * Edit, create, or delete schemas * [Inspect topics](../topics/messages.md#c3-topic-message-browser) * [Run or stop ksqlDB queries](../ksql.md#controlcenter-userguide-ksql) * Type in the ksqlDB editor * Add ksqlDB streams or tables ### How read-only roles are enforced When HTTP Basic authentication is enabled and one or more roles are listed in `confluent.controlcenter.auth.restricted.roles`, Control Center decides whether to allow or deny each request from a restricted-role user based on the HTTP method of the request, not on the semantic operation that the request performs. | HTTP method | Treated as | Result for restricted roles | |----------------------------------|--------------|-------------------------------| | `GET`, `HEAD`, `OPTIONS` | Read | Allowed | | `POST`, `PUT`, `PATCH`, `DELETE` | Write | `403 Forbidden` | Although enforcement is based on the HTTP method, a few endpoints behave differently from what the action name might suggest: * Message consumption is denied even though it uses GET. Reading messages from a topic (`GET /kafka/v3/clusters/{cluster}/internal/topics/{topic}/partitions/{partition}/records`) is classified as a privileged operation and is explicitly denied for restricted roles. This is why restricted users cannot [inspect topics](../topics/messages.md#c3-topic-message-browser). * A few read-style POST requests are denied. Some endpoints use `POST` even though they only read data. For example, searching ACLs (`POST .../acls:search`) and validating a webhook configuration (`POST .../verify`) do not change any state, but because they use a write method, they are blocked for restricted roles. #### NOTE To troubleshoot why a restricted-role user can or cannot perform a given action, check the HTTP method that the UI or API call uses rather than whether the action seems like a read or a write. ## Control Center and other components When HTTP Basic authentication is enabled on other Confluent Platform components, you must configure Control Center with a valid username and password for that component. ### HTTP Basic authentication enabled for Schema Registry Whenever you have HTTP Basic authentication configured for Schema Registry, you must provide a username and password for Control Center to communicate correctly with Schema Registry. For a single cluster or the first cluster in a multi-cluster deployment, set the following properties, where the `user.info` contains a `:` that you have configured for Schema Registry. ```bash confluent.controlcenter.schema.registry.basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry.basic.auth.user.info=: ``` For multi-cluster deployment, to set the remaining clusters, use: ```bash confluent.controlcenter.schema.registry..basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry..basic.auth.user.info=: ``` A multi-cluster deployment Schema Registry might look like the following: ```bash // first Schema Registry cluster confluent.controlcenter.schema.registry.url= confluent.controlcenter.schema.registry.basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry.basic.auth.user.info=: // additional Schema Registry clusters confluent.controlcenter.schema.registry..url= confluent.controlcenter.schema.registry..basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry..basic.auth.user.info=: ``` See [Schema Registry](/platform/current/security/authentication/http-basic-auth/overview.html#basic-auth-sr) for steps to configure HTTP Basic authentication for Schema Registry. ### HTTP Basic authentication for REST Proxy To learn about using HTTP Basic authentication with REST Proxy, see [HTTP Basic Authentication](/platform/current/kafka-rest/production-deployment/rest-proxy/security.html#kafka-rest-security-http-auth-basic). ### HTTP Basic authentication enabled for Connect Whenever you have HTTP Basic authentication configured for Connect, you must provide a username and password for Control Center to communicate correctly with Connect. Set the `confluent.controlcenter.connect..basic.auth.user.info` property to a value that contains `:` that you have configured for Connect. ```bash confluent.controlcenter.connect..basic.auth.user.info=: ``` See [Connect REST API](/platform/current/security/authentication/http-basic-auth/overview.html#basic-auth-kconnect) for steps to configure HTTP Basic authentication for Connect. ### HTTP Basic authentication enabled for ksqlDB Whenever you have HTTP Basic authentication configured for ksqlDB, you must provide a username and password for Control Center to communicate correctly with ksqlDB. Set the `confluent.controlcenter.ksql..basic.auth.user.info` property to a value that contains `:` that you have configured for ksqlDB. ```bash confluent.controlcenter.ksql.ksql-cluster-name.basic.auth.user.info=: ``` See [ksqlDB](/platform/current/security/authentication/http-basic-auth/overview.html#basic-auth-ksql) for steps to configure HTTP Basic authentication for ksqlDB.