You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by GitBox <gi...@apache.org> on 2021/03/31 13:56:17 UTC
[GitHub] [kafka] ijuma opened a new pull request #10450: KAFKA-12590: Remove deprecated SimpleAclAuthorizer and related classes
ijuma opened a new pull request #10450:
URL: https://github.com/apache/kafka/pull/10450
`SimpleAclAuthorizer` was deprecated in Apache Kafka 2.4 (released in December 2019).
`AclAuthorizer` is its replacement.
Details on the issues affecting the old Authorizer interface can be found in the KIP:
https://cwiki.apache.org/confluence/display/KAFKA/KIP-504+-+Add+new+Java+Authorizer+Interface
### Committer Checklist (excluded from commit message)
- [ ] Verify design and implementation
- [ ] Verify test coverage and CI build status
- [ ] Verify documentation (including upgrade notes)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] ijuma commented on a change in pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes in 3.0
Posted by GitBox <gi...@apache.org>.
ijuma commented on a change in pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#discussion_r606398713
##########
File path: tests/kafkatest/tests/core/security_rolling_upgrade_test.py
##########
@@ -93,8 +93,8 @@ def roll_in_sasl_mechanism(self, security_protocol, new_sasl_mechanism):
self.kafka.interbroker_sasl_mechanism = new_sasl_mechanism
self.bounce()
- # Bounce again with ACLs for new mechanism. Use old SimpleAclAuthorizer here to ensure that is also tested.
- self.set_authorizer_and_bounce(security_protocol, security_protocol, KafkaService.SIMPLE_AUTHORIZER)
+ # Bounce again with ACLs for new mechanism.
+ self.set_authorizer_and_bounce(security_protocol, security_protocol, KafkaService.ACL_AUTHORIZER)
Review comment:
Thanks, updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] ijuma commented on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes in 3.0
Posted by GitBox <gi...@apache.org>.
ijuma commented on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-812682607
@omkreddy I updated the PR description to elaborate a bit more on the motivation. I agree we should go ahead with this PR. Can you review it, please?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] omkreddy commented on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
omkreddy commented on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-811147963
Sentry project is retired. so no worries i think.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] ijuma commented on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
ijuma commented on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-811142776
Also, did Sentry migrate?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] omkreddy commented on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
omkreddy commented on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-811139340
looks like [Apache Ranger](https://github.com/apache/ranger/blob/master/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java) is not migrated to the new interface.
maybe we can remove and send a mail to the mailing list?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] ijuma commented on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
ijuma commented on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-812679620
I filed a JIRA for Apache Ranger:
https://issues.apache.org/jira/browse/RANGER-3231
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] omkreddy edited a comment on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
omkreddy edited a comment on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-811147963
Sentry project has retired. so no issues i think.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] ijuma merged pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes in 3.0
Posted by GitBox <gi...@apache.org>.
ijuma merged pull request #10450:
URL: https://github.com/apache/kafka/pull/10450
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] ijuma commented on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
ijuma commented on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-811142442
@omkreddy Thanks. Maybe we can file a JIRA. Their code would probably be quite a bit simpler by not having to deal with the Scala conversions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] rondagostino commented on a change in pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes in 3.0
Posted by GitBox <gi...@apache.org>.
rondagostino commented on a change in pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#discussion_r606392072
##########
File path: docs/upgrade.html
##########
@@ -27,6 +27,8 @@ <h5><a id="upgrade_300_notable" href="#upgrade_300_notable">Notable changes in 3
or updating the application not to use internal classes.</li>
<li>The Streams API removed all deprecated APIs that were deprecated in version 2.5.0 or earlier.
For a complete list of removed APIs compare the detailed Kafka Streams upgrade notes.</li>
+ <li>The deprecated Scala <code>Authorizer</code><code>, <code>SimpleAclAuthorizer</code> and related classes have been removed. Please use the Java <code>Authorizer</code>
Review comment:
extra/unbalanced opening tag at end of `<code>Authorizer</code><code>`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] ijuma commented on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
ijuma commented on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-811090385
@rajinisivaram @omkreddy Thoughts on this? Do you know if third-party implementations have migrated to the new interface?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] omkreddy edited a comment on pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes
Posted by GitBox <gi...@apache.org>.
omkreddy edited a comment on pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#issuecomment-811147963
Sentry project is retired. so no issues i think.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] rondagostino commented on a change in pull request #10450: KAFKA-12590: Remove deprecated kafka.security.auth.Authorizer, SimpleAclAuthorizer and related classes in 3.0
Posted by GitBox <gi...@apache.org>.
rondagostino commented on a change in pull request #10450:
URL: https://github.com/apache/kafka/pull/10450#discussion_r606394773
##########
File path: tests/kafkatest/tests/core/security_rolling_upgrade_test.py
##########
@@ -93,8 +93,8 @@ def roll_in_sasl_mechanism(self, security_protocol, new_sasl_mechanism):
self.kafka.interbroker_sasl_mechanism = new_sasl_mechanism
self.bounce()
- # Bounce again with ACLs for new mechanism. Use old SimpleAclAuthorizer here to ensure that is also tested.
- self.set_authorizer_and_bounce(security_protocol, security_protocol, KafkaService.SIMPLE_AUTHORIZER)
+ # Bounce again with ACLs for new mechanism.
+ self.set_authorizer_and_bounce(security_protocol, security_protocol, KafkaService.ACL_AUTHORIZER)
Review comment:
Can invoke `self.set_authorizer_and_bounce(security_protocol, security_protocol)` as is done elsewhere in this file and eliminate the ability to specify a different authorizer class name in the method, like this:
```
def set_authorizer_and_bounce(self, client_protocol, broker_protocol):
self.kafka.authorizer_class_name = KafkaService.ACL_AUTHORIZER
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org