User Authorization

Overview

Kpow supports two methods of controlling user access to User Actions.

User Actions

Note: User Actions apply to specific Domains. This is important when configuring Role Based Access Control.

The following actions are supported by both methods of access control.

DomainActionControl (when TRUE)
CLUSTERTOPIC_INSPECTAllow users to read topic key and value data
TOPIC_PRODUCEAllow users to write new messages to topics
TOPIC_CREATEAllow users to create new topics
TOPIC_EDITAllow users to edit topic configuration
TOPIC_DELETEAllow users to delete topics
TOPIC_TRUNCATEAllow users to truncate topics
TOPIC_ELECT_LEADERAllow users to elect the leader replica of a topic partition
TOPIC_ALTER_REPLICASAllow users to edit the reassignments of a topic partition
GROUP_EDITAllow users edit consumer groups and reset consumer offsets
GROUP_DELETEAllow users to delete consumer groups and remove group members
BROKER_EDITAllow users to edit broker configuration
BROKER_UNREGISTERAllow users to unregister brokers for clusters using Raft
ACL_EDITAllow users to create and delete Kafka ACLs
PRODUCER_EDITAllow users to abort transactions and fence Kafka Producers
QUOTA_EDITAllow users to create, edit and delete Kafka Quotas
SCHEMASCHEMA_CREATEAllow users to create new schemas and subjects
SCHEMA_EDITAllow users to edit schemas and subjects
CONNECTCONNECT_CREATEAllow users to create new connectors
CONNECT_EDITAllow users to edit, pause, stop, and restart connectors and tasks
KSQLDBKSQLDB_QUERYAllow users to execute ksqlDB SQL queries (push or pull)
KSQLDB_EXECUTEAllow users to execute ksqlDB SQL statements (eg, CREATE_TABLE)
KSQLDB_TERMINATE_QUERYAllow users to terminate ksqlDB streaming push queries
KSQLDB_INSERTAllow users to insert ksqlDB rows into source tables or streams
KPOWADMINAllow users to be a Kpow admin (view audit log, staged mutations)
BULK_ACTIONAllow users to perform bulk actions.

User Permissions

Users are denied permissions on all actions by default.

To give permission to a specific action you must configure it true.

In most cases where the user is denied permission to an particular action the UI will show that denial directly to the user. In some cases the permission is determined on the back end and the user is informed after the fact that they do not have the ability to take the requested action.