Skip to content

Commit

Permalink
Fix lint error
Browse files Browse the repository at this point in the history
  • Loading branch information
Joe Schmetzer committed Aug 18, 2020
1 parent b2f489e commit 63864fa
Show file tree
Hide file tree
Showing 4 changed files with 30 additions and 38 deletions.
45 changes: 18 additions & 27 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
# kafka-plain-saslserver-2-ad

[![Build Status](https://travis-ci.org/navikt/kafka-plain-saslserver-2-ad.svg?branch=master)](https://travis-ci.org/navikt/kafka-plain-saslserver-2-ad/builds/)
[![Docker Build Status](https://img.shields.io/docker/build/navikt/kafka-plain-saslserver-2-ad.svg)](https://hub.docker.com/r/navikt/kafka-plain-saslserver-2-ad/builds/)
[![Docker Automated build](https://img.shields.io/docker/automated/navikt/kafka-plain-saslserver-2-ad.svg)](https://hub.docker.com/r/navikt/kafka-plain-saslserver-2-ad/)
# kafka-ldap-integration

Enhancing kafka 2.x with
- customized SimpleLDAPAuthentication using LDAPS simple bind for authentication
Expand All @@ -25,19 +21,19 @@ giving minor performance penalty and reduced LDAPS traffic.

1. Unboundid LDAP SDK for LDAPS interaction
2. Caffeine Cache
3. YAML Configuration for LDAP baseDN for users, groups and more. See src/test/resources/ldapconfig.yaml for details
3. YAML Configuration for LDAP baseDN for users, groups and more. See `src/test/resources/ldapconfig.yaml` for details

**Observe** that the directory hosting yaml configuration file must be in CLASSPATH.
**N.B.** that the directory hosting yaml configuration file must be in CLASSPATH.

## Kafka configuration examples

JAAS context file on Kafka broker use the standard class for plain login module during authentication

```
KafkaServer{
org.apache.kafka.common.security.plain.PlainLoginModule required
username="x"
password="y";
org.apache.kafka.common.security.plain.PlainLoginModule required
username="x"
password="y";
};
```

Expand All @@ -50,43 +46,38 @@ listeners=SASL_PLAINTEXT://localhost:9092
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.enabled.mechanisms=PLAIN
listener.name.sasl_plaintext.plain.sasl.server.callback.handler.class=no.nav.common.security.authentication.SimpleLDAPAuthentication
authorizer.class.name=no.nav.common.security.authorization.SimpleLDAPAuthorizer
...
listener.name.sasl_plaintext.plain.sasl.server.callback.handler.class=com.instaclustr.kafka.ldap.authentication.SimpleLDAPAuthentication
authorizer.class.name=com.instaclustr.kafka.ldap.authorization.SimpleLDAPAuthorizer
...
```

## Using the docker image
The docker image can't currently be used standalone, the Dockerfile is supposed to be extended by adding the config file
`/etc/kafka/ldapconfig.yaml` and the jaas configuration `/etc/kafka/kafka_server_jaas.conf`, examples of these
config files can be found in [NAVs kafka docker compose project](https://github.com/navikt/navkafka-docker-compose)

## Testing

Use of Unboundid in-memory LDAP server for all test cases.

Tested on confluent.io version 5.x (related to apache kafka 2.x)

See [Confluent Open Source distribution](https://www.confluent.io/product/confluent-open-source/) in order to test locally.
Tested on Kafka version 2.x

The related [Wiki](https://github.com/navikt/KafkaPlainSaslServer2AD/wiki) has a detailed guide for local testing.
See [Apache Kafka](https://kafka.apache.org/) in order to test locally.

## Build

```
./gradlew clean build
./gradlew shadowJar
The result is kafka-plain-salserver-2-ad-2.0_<version>.jar hosting authentication and authorization classes.
```
**Observe** that the directory hosting the given JAR file must be in CLASSPATH.

The result is `kafka-ldap-integration-2.4_<version>.jar` hosting authentication and authorization classes.

**N.B.** that the directory hosting the given JAR file must be in CLASSPATH.

### Contact us
#### Code/project related questions can be sent to
* Joe Schmetzer, `[email protected] `
* Zeke Dean, `[email protected]`

#### Credit to original authors

Maintainers of the GitHub project [kafka-plain-saslserver-2-ad](https://github.com/navikt/kafka-plain-saslserver-2-ad):
* Torstein Nesby, `[email protected]`
* Trong Huu Nguyen, `[email protected]`


9 changes: 5 additions & 4 deletions build.gradle
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
buildscript {
ext.kafka_version = '2.4.1'
ext.scala_version = '2.12'
ext.kotlin_version = '1.3.11'
ext.kafka_version = '2.0.0'
ext.unboundid_version = '4.0.9'
ext.caffeine_version = '2.6.2'
ext.jackson_version = '2.9.7'
Expand All @@ -17,11 +18,11 @@ plugins{
id 'com.github.ben-manes.versions' version '0.20.0'
}

group 'no.nav.common.security'
group 'com.instaclustr.kafka.ldap'

// see https://docs.confluent.io/current/installation/versions-interoperability.html#interoperability-versions
// '<kafka version>_<this plugin version>'
version '2.0_0.58'
version '2.4_0.58'

sourceCompatibility = 1.8

Expand All @@ -42,7 +43,7 @@ dependencies {
implementation "com.fasterxml.jackson.module:jackson-module-kotlin:$jackson_version"
implementation "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:$jackson_version"

implementation "org.apache.kafka:kafka_2.12:$kafka_version"
implementation "org.apache.kafka:kafka_$scala_version:$kafka_version"
implementation "com.github.ben-manes.caffeine:caffeine:$caffeine_version"

testImplementation "org.amshove.kluent:kluent:$kluent_version"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
package com.instaclustr.kafka.ldap.authorization

import com.instaclustr.kafka.ldap.common.InMemoryLDAPServer
import com.instaclustr.kafka.ldap.common.JAASContext
import kafka.security.auth.Acl
import kafka.security.auth.Operation
import kafka.security.auth.PermissionType
import org.amshove.kluent.shouldEqualTo
import org.apache.kafka.common.acl.AclOperation
import org.apache.kafka.common.security.auth.KafkaPrincipal
import com.instaclustr.kafka.ldap.common.InMemoryLDAPServer
import com.instaclustr.kafka.ldap.common.JAASContext
import org.amshove.kluent.shouldEqualTo
import org.spekframework.spek2.Spek
import org.spekframework.spek2.style.specification.describe
import java.util.*
import java.util.UUID

object GroupAuthorizerSpec : Spek({

Expand Down
6 changes: 3 additions & 3 deletions src/test/resources/log4j.properties
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,6 @@ log4j.additivity.state.change.logger=false
log4j.logger.kafka.authorizer.logger=WARN, authorizerAppender
log4j.additivity.kafka.authorizer.logger=false

# TTN no.nav.security component
log4j.logger.no.nav.common.security=DEBUG, kafkaAppender
log4j.additivity.no.nav.common.security=false
# TTN com.instaclustr.kafka.ldap component
log4j.logger.com.instaclustr.kafka.ldap=DEBUG, kafkaAppender
log4j.additivity.com.instaclustr.kafka.ldap=false

0 comments on commit 63864fa

Please sign in to comment.