Kafka Pluggable Authorization for Enterprise Security (Anna Kepler, Viasat) Kafka Summit NYC 2019
0 likes1,280 views
The document discusses a Kafka pluggable authorizer developed by Anna Kepler, focusing on enterprise security and data governance in a streaming platform. It outlines the transition from simple authorization to a more complex role-based management system, highlighting functionalities like permissions management and administration delegation. It emphasizes the importance of data security and accountability as teams and streams grow within the organization.
![Working with Role Manager
{
"id": "tenancy:team-awesome",
"groups": [
{
"stripe": ”team-awesome",
"group": ”team-awesome-admins",
"capabilities":
[ "read", "write", "describe", "modify", "delete" ]
}
]
}](https://image.slidesharecdn.com/annakeplerviasatkafkapluggableauthorizerforenterprisesecurityfinal4-190405170935/85/Kafka-Pluggable-Authorization-for-Enterprise-Security-Anna-Kepler-Viasat-Kafka-Summit-NYC-2019-12-320.jpg)
![Working with Role Manager
{
"id": "tenancy:team-awesome",
"groups": [
{
"stripe": "team-awesome",
"group": "team-awesome-readers",
"capabilities": [ ”read", "describe" ]
}
]
}](https://image.slidesharecdn.com/annakeplerviasatkafkapluggableauthorizerforenterprisesecurityfinal4-190405170935/85/Kafka-Pluggable-Authorization-for-Enterprise-Security-Anna-Kepler-Viasat-Kafka-Summit-NYC-2019-13-320.jpg)
Kafka Pluggable Authorization for Enterprise Security (Anna Kepler, Viasat) Kafka Summit NYC 2019
- 1. Kafka Pluggable Authorizer for Enterprise Security Anna Kepler Data Engineer
- 4. Data Security at Scale is Hard
- 6. Shifting Objective Over Time Data Democratization Fast Customer Onboarding Self-Service High Volume Stream Processing 2014 4 teams 60 streams
- 7. Shifting Objective Over Time Data Security Data Governance Accountability2019 50+ teams 1,000+ streams
- 8. Default Kafka® Authorization authorizer.class.name = kafka.security.auth.SimpleAclAuthorizer allow.everyone.if.no.acl.found=true super.users=User:Bob;User:Alice bin/kafka-acls --add --allow-principal User:Bob --producer --topic test-topic
- 9. Databus Kafka Authorization authorizer.class.name = com.viasat.databus.DatabusKafkaAuthorizer role.manager.url = https://roles.visat.io permissions.expiration.sec = 60
- 11. Role Manager cli COMMANDS: version Get version information token Get a JWT for authentication tenancy Interact with tenancies resource Interact with resources capability Interact with capabilities subject Interact with subjects help, h Shows a list of commands role capability list –r stream:my-stream
- 12. Working with Role Manager { "id": "tenancy:team-awesome", "groups": [ { "stripe": ”team-awesome", "group": ”team-awesome-admins", "capabilities": [ "read", "write", "describe", "modify", "delete" ] } ] }
- 13. Working with Role Manager { "id": "tenancy:team-awesome", "groups": [ { "stripe": "team-awesome", "group": "team-awesome-readers", "capabilities": [ ”read", "describe" ] } ] }
- 14. Granular Permissions { "fromSubjectId": "Bob”, "toResourceId": "stream:shared-stream", "action": "read" } # With the cli role capability create capability.json
- 15. Why do it Integration into Central Authentication System Delegation of controls to team admins REST API used by various components in the platform In-depth monitoring
- 16. Thank you Anna Kepler Data Engineer, Viasat https://www.linkedin.com/in/akepler https://github.com/Viasat https://careers.viasat.com/