[jira] [Comment Edited] (KAFKA-6972) Kafka ACL does not work expected with wildcard

["Sönke Liebau (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-6972?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16496328#comment-16496328 ] 

Sönke Liebau edited comment on KAFKA-6972 at 5/31/18 9:53 AM:
--------------------------------------------------------------

Hi [~Soyee]: can you try adding quotation marks around the wildcards in your command please? Otherwise your shell will probably expand those to filenames as seen here.

 
{code:java}
kafka-acls --authorizer-properties zookeeper.connect=data-pipeline-1.orion.com:2181 --add --allow-principal User:connect-consumer --consumer --topic "*" --group "*"
{code}


was (Author: sliebau):
Hi [~Soyee]: can you try adding quotation marks around the wildcards in your command please? Otherwise your shell will probably expand those to filenames as seen here.

 
{code:java}
// kafka-acls --authorizer-properties zookeeper.connect=data-pipeline-1.orion.com:2181 --add --allow-principal User:connect-consumer --consumer --topic "*" --group "*"
{code}

> Kafka ACL does not work expected with wildcard
> ----------------------------------------------
>
>                 Key: KAFKA-6972
>                 URL: https://issues.apache.org/jira/browse/KAFKA-6972
>             Project: Kafka
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 0.11.0.0
>         Environment: OS : CentOS 7, 64bit.
> Confluent : 3.3, Kafka 0.11.
>            Reporter: Soyee Deng
>            Priority: Major
>
> Just started with Confluent 3.3 platform and Kafka 0.11 having SSL as transportation security and Kerberos to restrict the access control based on the holding principals. In order to make life easier, wildcard is extensively used in my environment. But it turned out that is not working as expected. 
> My issue is that when I run the command _kafka-acls_ under one directory with some files, this command would pick up the name of first file as the topic name or group name. e.g. In my case, abcd.txt would be chosen while giving my principal connect-consumer the permissions of consuming message from any topic with any group Id.
> [quality@data-pipeline-1 test_dir]$ KAFKA_OPTS=-Djava.security.auth.login.config='/etc/security/jaas/broker-jaas.conf' kafka-acls --authorizer-properties zookeeper.connect=data-pipeline-1.orion.com:2181 --add --allow-principal User:connect-consumer --consumer --topic * --group *
>  Adding ACLs for resource `Topic:abcd.txt`:
>  User:connect-consumer has Allow permission for operations: Describe from hosts: *
>  User:connect-consumer has Allow permission for operations: Read from hosts: *
> Adding ACLs for resource `Group:abcd.txt`:
>  User:connect-consumer has Allow permission for operations: Read from hosts: *
> Current ACLs for resource `Topic:abcd.txt`:
>  User:connect-consumer has Allow permission for operations: Describe from hosts: *
>  User:connect-consumer has Allow permission for operations: Read from hosts: *
>  User:connect-consumer has Allow permission for operations: Write from hosts: *
> Current ACLs for resource `Group:abcd.txt`:
>  User:connect-consumer has Allow permission for operations: Read from hosts: *
>  
> My current work around solution is changing command context to an empty directory and run above command, it works as expected. 
>  



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)