Important

You are viewing documentation for an older version of Confluent Platform. For the latest, click here.

Configuring Control Center to work with Kafka ACLs

Important

Before attempting to create and use ACLs, you should familiarize yourself with ACL concepts. Doing so can help you avoid common pitfalls that can occur when creating and using ACLs to manage access to components and cluster data.

Standard Apache Kafka® authorization and encryption options are available for control center and interceptors.

Note

Only export PRINCIPAL if you have already defined the JAAS properties or user certificates. Also, you must create the Kafka ACLs before starting Control Center. You must then configure Control Center to authenticate to Kafka as the principal that is specified for the ACL.

You can use this script to create the ACLs that are required by Control Center to operate on an authorized cluster. You must run this script before you start Control Center:

export PRINCIPAL=User:username
export CONTROL_CENTER_OPTS="-Djava.security.auth.login.config=<path-to-kafka-jaas.conf>"
bin/control-center-set-acls config/control-center.properties

Important

The principal specified here is the Kafka user, the same as specified in Kafka Broker.

For each Kafka topic that Confluent Control Center creates, ACLs are created to grant the specified principal the following privileges:

  • CREATE
  • WRITE
  • DESCRIBE
  • DESCRIBE_CONFIGS
  • READ

The following ACLs are created to grant the specified principal privileges for the consumer group related to the Confluent Control Center Streams application:

  • READ

ACLs granting the following privileges are also created for the cluster:

  • DESCRIBE
  • DESCRIBE_CONFIGS

You must export a Control Center JAAS config before starting Control Center.

export CONTROL_CENTER_OPTS='-Djava.security.auth.login.config=<path-to-c3-jaas.conf>'
bin/control-center-start config/control-center.properties