Crate krabka_authz 

Shared Kafka-ACL authorization evaluator (broker + gateway).

This crate holds the Authorizer trait, the ACL evaluator (SimpleAclAuthorizer and AllowAllAuthorizer), and an AclSource abstraction. One evaluator therefore serves both the broker and the gateway. The broker passes a MetadataImage snapshot. The gateway passes an AclCache over a Vec<AclEntry> that it fetched with DescribeAcls.

The decision logic lives here once, so the two callers can never drift. That logic covers the super-user bypass, deny-wins, and operation implication.

Authorizing a request

use {
    krabka_authz::{AllowAllAuthorizer, AuthorizationRequest, AuthorizationResult, Authorizer},
    krabka_metadata::{AclOperation, MetadataImage, ResourceType},
    krabka_security::{AuthMethod, Principal},
    std::net::SocketAddr,
    uuid::Uuid,
};

let image = MetadataImage::new(Uuid::nil());
let principal = Principal {
    name: "alice".into(),
    auth_method: AuthMethod::SaslPlain,
    groups: vec![],
};
let host: SocketAddr = "127.0.0.1:9092".parse().unwrap();
let req = AuthorizationRequest {
    principal: &principal,
    host: &host,
    resource_type: ResourceType::Topic,
    resource_name: "orders",
    operation: AclOperation::Read,
};

assert2::assert!(AllowAllAuthorizer.authorize(&image, &req) == AuthorizationResult::Allow);

Re-exports

pub use cache::AclCache;

Modules

cache

Gateway-side ACL snapshot: a flat Vec<AclEntry> from describe_acls.

cidr

CIDR-based ACL host patterns (KIP-1276).

Structs

AllowAllAuthorizer

Authorizer that always returns AuthorizationResult::Allow.

AuthorizationRequest

What the caller asks authorize: which principal wants to do which operation on which resource, and from which host.

SimpleAclAuthorizer

Authorizer that consults the cluster’s persisted ACLs.

Enums

AuthorizationResult

Binary outcome: Kafka’s ACL surface is allow or deny.

Traits

AclSource

A source of ACL entries the authorizer can match against.

Authorizer

Pluggable per-broker or per-gateway authorization decision point.

Functions

authorize_topics

Batch-authorize a set of topic names against the same principal, host, and operation.

authorize_topics_logged

authorize_topics with Kafka’s logIfDenied flag. With log_denied off each name goes through Authorizer::authorize_quiet, and a Deny leaves no audit record and no counter behind.

jdk_host_address

Formats ip the way InetAddress.getHostAddress() would, so it can be compared against an ACL host string written by Kafka tooling.

Type Aliases

AclEntries

Borrowed ACL entries returned by a metadata image or gateway snapshot.