You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kafka.apache.org by sc...@apache.org on 2025/02/18 09:12:14 UTC
(kafka) branch trunk updated: MINOR: Align share group admin authz with consumer group (#18936)
This is an automated email from the ASF dual-hosted git repository.
schofielaj pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/kafka.git
The following commit(s) were added to refs/heads/trunk by this push:
new 385b7ad3557 MINOR: Align share group admin authz with consumer group (#18936)
385b7ad3557 is described below
commit 385b7ad3557196f8e84b34cc536f6dd2ac1fd502
Author: Andrew Schofield <as...@confluent.io>
AuthorDate: Tue Feb 18 09:12:07 2025 +0000
MINOR: Align share group admin authz with consumer group (#18936)
Reviewers: Manikumar Reddy <ma...@gmail.com>
---
core/src/main/scala/kafka/server/KafkaApis.scala | 2 +-
docs/security.html | 18 ++++++++++++++++--
2 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/core/src/main/scala/kafka/server/KafkaApis.scala b/core/src/main/scala/kafka/server/KafkaApis.scala
index 945cd04373b..7919f483587 100644
--- a/core/src/main/scala/kafka/server/KafkaApis.scala
+++ b/core/src/main/scala/kafka/server/KafkaApis.scala
@@ -3230,7 +3230,7 @@ class KafkaApis(val requestChannel: RequestChannel,
futures += CompletableFuture.completedFuture(new DescribeShareGroupOffsetsResponseData.DescribeShareGroupOffsetsResponseGroup()
.setGroupId(groupDescribeOffsets.groupId)
.setErrorCode(Errors.UNSUPPORTED_VERSION.code))
- } else if (!authHelper.authorize(request.context, READ, GROUP, groupDescribeOffsets.groupId)) {
+ } else if (!authHelper.authorize(request.context, DESCRIBE, GROUP, groupDescribeOffsets.groupId)) {
futures += CompletableFuture.completedFuture(new DescribeShareGroupOffsetsResponseData.DescribeShareGroupOffsetsResponseGroup()
.setGroupId(groupDescribeOffsets.groupId)
.setErrorCode(Errors.GROUP_AUTHORIZATION_FAILED.code))
diff --git a/docs/security.html b/docs/security.html
index f15ef1086f2..999b4c3562e 100644
--- a/docs/security.html
+++ b/docs/security.html
@@ -2267,14 +2267,28 @@ RULE:[n:string](regexp)s/pattern/replacement/g/U</code></pre>
</tr>
<tr>
<td>DESCRIBE_SHARE_GROUP_OFFSETS (90)</td>
- <td>Read</td>
+ <td>Describe</td>
<td>Group</td>
+ <td>To describe the offset information for a partition in a share group, the application must have privileges on the
+ group and the topic. Group access is checked first, then topic access.</td>
+ </tr>
+ <tr>
+ <td>DESCRIBE_SHARE_GROUP_OFFSETS (90)</td>
+ <td>Describe</td>
+ <td>Topic</td>
<td></td>
</tr>
<tr>
<td>ALTER_SHARE_GROUP_OFFSETS (91)</td>
- <td>Alter</td>
+ <td>Read</td>
<td>Group</td>
+ <td>To alter the offset information for a partition in a share group, the application must have privileges on the
+ group and the topic. Group access is checked first, then topic access.</td>
+ </tr>
+ <tr>
+ <td>ALTER_SHARE_GROUP_OFFSETS (91)</td>
+ <td>Read</td>
+ <td>Topic</td>
<td></td>
</tr>
</tbody>