# Configure Authorization for Confluent Manager for Apache Flink Flink applications are deployed in Confluent Platform with Confluent Manager for Apache Flink® (CMF), a central management component that enables users to securely manage a fleet of Flink jobs across multiple environments. Role-based access control (RBAC) for CMF provides fine-grained, least-privilege access by assigning roles to users and service principals to control permissions for Flink resources and management operations. CMF supports all available RBAC [Authentication Options](/platform/current/security/authorization/rbac/overview.html). CMF supports two authorization modes: * **Broker-hosted MDS** (`cp-mds`): CMF communicates with an external Metadata Service (MDS) running alongside Kafka to validate whether the principal of the incoming request is allowed to perform a specific action. This is the mode described on this page. * **Embedded MDS** (`cmf`): CMF runs its own MDS in-process and stores role bindings in its database. This mode does not require an external Kafka cluster for authorization. For details, see [Configure Embedded MDS for Confluent Manager for Apache Flink](embedded-mds.md#cmf-embedded-mds).  Note that authorization for CMF with RBAC through the Confluent Metadata Service (MDS) assumes authentication is already enabled. ## CMF service principal CMF requires its own service principal to authorize user principals. The three following roles have sufficient privileges for the CMF service principal, however, you should choose the role with the least privileges to meet your needs, to interact with CMF. For a full list of RBAC roles, see [RBAC Predefined Roles](/platform/current/security/authorization/rbac/rbac-predefined-roles.html). - SystemAdmin - UserAdmin - SecurityAdmin Before enabling the authorization feature for CMF you must assign the cluster identifiers for CMF. For more information on the cluster identifiers, see [Cluster identifiers](../configure/access-control.md#af-ac-cluster-id). ```none # UserAdmin is an example role confluent iam rbac role-binding create \ --principal User: \ --role UserAdmin \ --cmf CMF-id ``` ## Role binding You also need to create a role binding for every environment you create, including the name of the environment. The following example code shows how you might do that. ```none # UserAdmin is an example role confluent iam rbac role-binding create \ --principal User: \ --role UserAdmin \ --cmf CMF-id \ --flink-environment ``` ## Configure RBAC for CMF Confluent Manager for Apache Flink supports all available RBAC authentication options to authenticate with the Confluent Platform metadata service. The following examples cover some authentication methods for the metadata service. ### OAuth example The following YAML file shows how you might configure mTLS authentication for CMF with Oauth authentication with MDS. ```yaml # authorization-values.yaml cmf: authorization: mdsRestConfig: endpoint: #Mandatory: replace with the endpoint for the Metadata Service authentication: type: oauth config: confluent.metadata.http.auth.credentials.provider: OAUTHBEARER confluent.metadata.oauthbearer.token.endpoint.url: #URL of your configured IDP used to store the users confluent.metadata.oauthbearer.login.client.id: #Client id for the user talking to MDS, needs to be a user that can request permissions for all users confluent.metadata.oauthbearer.login.client.secret: #Client secret for the user talking to MDS # Required when MDS uses HTTPS: truststore to trust the MDS server certificate. confluent.metadata.ssl.truststore.location: #truststore path to trust the MDS server certificate confluent.metadata.ssl.truststore.password: #optional password if the truststore is password protected # Mandatory with OAuth: comma-separated list of the OAuth URLs that CMF # is allowed to call, such as the IDP token endpoint URL. kafka: oauthbearerAllowedUrls: "" ``` When you make the `helm install` call, use the `-f` flag to pass the YAML file with the security information like the following: ```none helm upgrade --install cmf confluent/confluent-manager-for-apache-flink \ -f mtls-values.yaml \ -f authorization-values.yaml ``` #### NOTE When the MDS endpoint uses HTTPS, you must include `confluent.metadata.ssl.truststore.location` in the authentication configuration so that CMF can trust the MDS server certificate. You only need to include `confluent.metadata.ssl.truststore.password` if the truststore is password-protected. These settings are specific to the CMF-to-MDS connection and are separate from any server SSL configuration on CMF itself. ### mTLS example The following example shows how you configure mTLS authentication for CMF with mTLS authentication with MDS. ```yaml # authorization-values.yaml cmf: authorization: mdsRestConfig: endpoint: #Mandatory: replace with the endpoint for the Metadata Service authentication: type: mtls config: confluent.metadata.ssl.truststore.location: #truststore path containing certificates needed to talk to metadata service confluent.metadata.ssl.truststore.password: #optional password if truststore is encrypted confluent.metadata.ssl.keystore.location: #keystore path containing keys/certificates needed to talk to metadata service confluent.metadata.ssl.keystore.password: #optional password if keystore is encrypted confluent.metadata.ssl.key.password: ``` When you make the `helm install` call, use the `-f` flag to pass the YAML file with the security information like the following: ```none helm upgrade --install cmf confluent/confluent-manager-for-apache-flink \ -f mtls-values.yaml \ -f authorization-values.yaml ``` ## Authentication without RBAC enforcement (broker-hosted MDS) With an Kafka broker-hosted MDS, the login reverse-proxy (`/security/*`) and RBAC enforcement are both driven by `mdsRestConfig`. If you want the login proxy for SSO or Basic login against the broker MDS, but do not want to enforce RBAC, set `cmf.authorization.enforce` to `false`: ```yaml cmf: authorization: enforce: false mdsRestConfig: endpoint: authentication: # ... your existing broker-MDS auth config ``` In this mode, CMF authenticates every request with the `cmf.authentication` settings but authorizes all authenticated users for all operations. If you do not need the broker MDS login proxy at all, omit the entire `cmf.authorization` block instead. Authentication through `cmf.authentication` still works without it. ## Related content - [How to Secure a Flink Job with Confluent Manager for Apache Flink](../jobs/configure/security.md#cpf-security)