Module authz 

Kafka ACL precedence and SASL session/request admission.

Structs

AclFacts

What the precedence loop observed for one request.

AclResourceFacts

How a stored ACL’s resource name relates to the requested resource name.

Enums

AclDecision

Why ACL evaluation allowed or denied a request.

AclDefault

The outcome when no ACL matched the request.

AclOperationKind

ACL operation class used by the verified implication table.

AclPatternKind

Resource-pattern class used by the verified ACL applicability adapter.

AclResourceTypeMatch

Whether a stored ACL names the requested resource type.

RequestAuthState

Authentication phase used to admit a Kafka request, after Kafka’s SaslServerAuthenticator states.

Constants

MIN_REAUTH_INTERVAL_MS

Kafka’s KafkaChannel.MIN_REAUTH_INTERVAL_ONE_SECOND_NANOS, in ms: a connection may not start a re-authentication more than once a second.

Functions

acl_decision

Decide a request from whether any matching ACL allowed or denied it.

acl_identity_match

Match a principal or host by exact equality or its axis-specific wildcard.

acl_operation_match

Match exact operations, All, and Kafka’s one-way implication arrows.

acl_resource_match

Match an ACL resource type and literal or prefixed name pattern.

controller_request_admission

Controller connections currently require reconnecting to reauthenticate.

reauthentication_begins

Whether a SaslHandshake on a session that expires at expiry_ms begins a KIP-368 re-authentication.

request_auth_admission

Decide whether an API key may run in the current authentication phase.

sasl_session_expiry

Bind a SASL session to the earlier credential or positive listener cap. A sum beyond the clock range stays finite at i64::MAX.

session_expired_for_request

Whether a request must close the connection because its KIP-368 session has expired, as Kafka’s Processor.processCompletedReceives decides.