Required ACL permission

[senthil13]

Hi Team - I didn't find anywhere in the document what ACL permission is needed for a secure cluster to connect. My Kafka cluster is running with SASL_PLAINTEXT, which works fine with an "admin" user. But we can't have the admin password in Kafka-ui. So we have to create a separate user for this purpose. I tried to use my below user but it always throws unable to create the client.

The error which I am getting --

kafka-ui    | 2023-01-04 21:40:11,238 INFO  [parallel-2] o.a.k.c.u.AppInfoParser: Kafka startTimeMs: 1672868411237
kafka-ui    | 2023-01-04 21:40:11,339 ERROR [parallel-4] o.s.b.a.w.r.e.AbstractErrorWebExceptionHandler: [5c943ffe-14]  500 Server Error for HTTP GET "/api/clusters/secure_dev/topics?page=1&perPage=25&showInternal=true"
kafka-ui    | java.lang.IllegalStateException: Error while creating AdminClient for Cluster secure_dev
kafka-ui    |   at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$3(AdminClientServiceImpl.java:44)
kafka-ui    |   Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
kafka-ui    | Error has been observed at the following site(s):
kafka-ui    |   *__checkpoint ⇢ Handler com.provectus.kafka.ui.controller.TopicsController#getTopics(String, Integer, Integer, Boolean, String, TopicColumnsToSortDTO, SortOrderDTO, ServerWebExchange) [DispatcherHandler]
kafka-ui    |   *__checkpoint ⇢ com.provectus.kafka.ui.config.CustomWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ com.provectus.kafka.ui.config.ReadOnlyModeFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.authorization.AuthorizationWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.authorization.ExceptionTranslationWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.authentication.logout.LogoutWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.savedrequest.ServerRequestCacheWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.context.SecurityContextServerWebExchangeWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.context.ReactorContextWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.header.HttpHeaderWriterWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.config.web.server.ServerHttpSecurity$ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.security.web.server.WebFilterChainProxy [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ org.springframework.boot.actuate.metrics.web.reactive.server.MetricsWebFilter [DefaultWebFilterChain]
kafka-ui    |   *__checkpoint ⇢ HTTP GET "/api/clusters/secure_dev/topics?page=1&perPage=25&showInternal=true" [ExceptionHandlingWebHandler]
kafka-ui    | Original Stack Trace:
kafka-ui    |           at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$3(AdminClientServiceImpl.java:44)
kafka-ui    |           at reactor.core.publisher.Mono.lambda$onErrorMap$31(Mono.java:3733)
kafka-ui    |           at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:94)
kafka-ui    |           at reactor.core.publisher.FluxMapFuseable$MapFuseableSubscriber.onError(FluxMapFuseable.java:142)
kafka-ui    |           at reactor.core.publisher.FluxMapFuseable$MapFuseableSubscriber.onError(FluxMapFuseable.java:142)
kafka-ui    |           at reactor.core.publisher.MonoFlatMap$FlatMapMain.secondError(MonoFlatMap.java:192)
kafka-ui    |           at reactor.core.publisher.MonoFlatMap$FlatMapInner.onError(MonoFlatMap.java:259)
kafka-ui    |           at reactor.core.publisher.FluxMap$MapSubscriber.onError(FluxMap.java:134)
kafka-ui    |           at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:106)
kafka-ui    |           at reactor.core.publisher.Operators.error(Operators.java:198)
kafka-ui    |           at reactor.core.publisher.MonoError.subscribe(MonoError.java:53)
kafka-ui    |           at reactor.core.publisher.Mono.subscribe(Mono.java:4400)
kafka-ui    |           at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:103)
kafka-ui    |           at reactor.core.publisher.MonoPeekTerminal$MonoTerminalPeekSubscriber.onError(MonoPeekTerminal.java:258)
kafka-ui    |           at reactor.core.publisher.MonoPublishOn$PublishOnSubscriber.run(MonoPublishOn.java:187)
kafka-ui    |           at reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:68)
kafka-ui    |           at reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:28)
kafka-ui    |           at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
kafka-ui    |           at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
kafka-ui    |           at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
kafka-ui    |           at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
kafka-ui    |           at java.base/java.lang.Thread.run(Thread.java:830)
kafka-ui    | Caused by: org.apache.kafka.common.errors.ClusterAuthorizationException: Cluster authorization failed.

currently, I gave the below permission to the user - monitoruser

Current ACLs for resource `ResourcePattern(resourceType=TOPIC, name=*, patternType=LITERAL)`:
        (principal=User:monitoruser, host=*, operation=DESCRIBE, permissionType=ALLOW)
        (principal=User:monitoruser, host=*, operation=READ, permissionType=ALLOW)
        (principal=User:monitoruser, host=*, operation=DESCRIBE_CONFIGS, permissionType=ALLOW)

Current ACLs for resource `ResourcePattern(resourceType=GROUP, name=*, patternType=LITERAL)`:
        (principal=User:monitoruser, host=*, operation=READ, permissionType=ALLOW)

[senthil13]

Can someone respond to my query please?

[Haarolean]

We have a lot of going on and your issue is not the only one on the table :)

[Haarolean]

The exception you encounter says "Cluster authorization failed.", so the provided ACLs for topics are irrelevant.
Please ensure that you have describe and describe_configs available for clusters.
Let me know how it goes.

[senthil13]

That's works fine. thanks.

Doc purpose
If anyone having the same issue, please have the below permission ( for read-only) , This works fine.

Permission to have

Current ACLs for resource `ResourcePattern(resourceType=GROUP, name=*, patternType=LITERAL)`:
        (principal=User:monitoruser, host=*, operation=READ, permissionType=ALLOW)

Current ACLs for resource `ResourcePattern(resourceType=TOPIC, name=*, patternType=LITERAL)`:
        (principal=User:monitoruser, host=*, operation=DESCRIBE, permissionType=ALLOW)
        (principal=User:monitoruser, host=*, operation=READ, permissionType=ALLOW)
        (principal=User:monitoruser, host=*, operation=DESCRIBE_CONFIGS, permissionType=ALLOW)

Current ACLs for resource `ResourcePattern(resourceType=CLUSTER, name=kafka-cluster, patternType=LITERAL)`:
        (principal=User:monitoruser, host=*, operation=DESCRIBE, permissionType=ALLOW)
        (principal=User:monitoruser, host=*, operation=DESCRIBE_CONFIGS, permissionType=ALLOW)

Command to run

kafka-acls --bootstrap-server <bootstrap-server> --command-config <admin-user-properties-file> --allow-principal User:monitoruser --consumer --group '*' --topic '*' --add
kafka-acls --bootstrap-server <bootstrap-server> --command-config <admin-user-properties-file> --allow-principal User:monitoruser --operation Read --operation Describe --operation DescribeConfigs --topic '*' --add
kafka-acls --bootstrap-server <bootstrap-server> --command-config <admin-user-properties-file> --allow-principal User:monitoruser --operation Describe --operation DescribeConfigs --cluster --add