Skip to content

Commit e34520f

Browse files
HaaroleanHaarolean
authored
Implement LDAP authentication (provectus#1173)
* Sync container versions in examples * Add ldap required dependencies * Create a separate package for security configs * Fix annoying checkstyle line length * Refactor auth security configuration setup * Implement ldap authentication. Closes provectus#1023 * Review fixes * Review fixes
1 parent b2586c4 commit e34520f

22 files changed

+299
-94
lines changed

‎docker/auth-ldap.yaml

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
---
2+
version: '2'
3+
services:
4+
5+
kafka-ui:
6+
container_name: kafka-ui
7+
image: provectuslabs/kafka-ui:latest
8+
ports:
9+
- 8080:8080
10+
depends_on:
11+
- zookeeper0
12+
- kafka0
13+
- schemaregistry0
14+
environment:
15+
KAFKA_CLUSTERS_0_NAME: local
16+
KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka0:29092
17+
KAFKA_CLUSTERS_0_ZOOKEEPER: zookeeper0:2181
18+
KAFKA_CLUSTERS_0_JMXPORT: 9997
19+
KAFKA_CLUSTERS_0_SCHEMAREGISTRY: http://schemaregistry0:8085
20+
KAFKA_CLUSTERS_0_KAFKACONNECT_0_NAME: first
21+
KAFKA_CLUSTERS_0_KAFKACONNECT_0_ADDRESS: http://kafka-connect0:8083
22+
KAFKA_CLUSTERS_1_NAME: secondLocal
23+
KAFKA_CLUSTERS_1_BOOTSTRAPSERVERS: kafka1:29092
24+
KAFKA_CLUSTERS_1_ZOOKEEPER: zookeeper1:2181
25+
KAFKA_CLUSTERS_1_JMXPORT: 9998
26+
KAFKA_CLUSTERS_1_SCHEMAREGISTRY: http://schemaregistry1:8085
27+
KAFKA_CLUSTERS_1_KAFKACONNECT_0_NAME: first
28+
KAFKA_CLUSTERS_1_KAFKACONNECT_0_ADDRESS: http://kafka-connect0:8083
29+
AUTH_TYPE: "LDAP"
30+
SPRING_LDAP_URLS: "ldap://ldap:10389"
31+
SPRING_LDAP_DN_PATTERN: "cn={0},ou=people,dc=planetexpress,dc=com"
32+
33+
ldap:
34+
image: rroemhild/test-openldap:latest
35+
hostname: "ldap"
36+
37+
zookeeper0:
38+
image: confluentinc/cp-zookeeper:5.2.4
39+
environment:
40+
ZOOKEEPER_CLIENT_PORT: 2181
41+
ZOOKEEPER_TICK_TIME: 2000
42+
ports:
43+
- 2181:2181
44+
45+
kafka0:
46+
image: confluentinc/cp-kafka:5.3.1
47+
depends_on:
48+
- zookeeper0
49+
ports:
50+
- 9092:9092
51+
- 9997:9997
52+
environment:
53+
KAFKA_BROKER_ID: 1
54+
KAFKA_ZOOKEEPER_CONNECT: zookeeper0:2181
55+
KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka0:29092,PLAINTEXT_HOST://localhost:9092
56+
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT
57+
KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
58+
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
59+
JMX_PORT: 9997
60+
KAFKA_JMX_OPTS: -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=kafka0 -Dcom.sun.management.jmxremote.rmi.port=9997
61+
62+
schemaregistry0:
63+
image: confluentinc/cp-schema-registry:5.5.0
64+
ports:
65+
- 8085:8085
66+
depends_on:
67+
- zookeeper0
68+
- kafka0
69+
environment:
70+
SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS: PLAINTEXT://kafka0:29092
71+
SCHEMA_REGISTRY_KAFKASTORE_CONNECTION_URL: zookeeper0:2181
72+
SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL: PLAINTEXT
73+
SCHEMA_REGISTRY_HOST_NAME: schemaregistry0
74+
SCHEMA_REGISTRY_LISTENERS: http://schemaregistry0:8085
75+
76+
SCHEMA_REGISTRY_SCHEMA_REGISTRY_INTER_INSTANCE_PROTOCOL: "http"
77+
SCHEMA_REGISTRY_LOG4J_ROOT_LOGLEVEL: INFO
78+
SCHEMA_REGISTRY_KAFKASTORE_TOPIC: _schemas

‎docker/kafka-cluster-sr-auth.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ services:
1111
- 2182:2181
1212

1313
kafka1:
14-
image: confluentinc/cp-kafka:5.2.4
14+
image: confluentinc/cp-kafka:5.3.1
1515
depends_on:
1616
- zookeeper1
1717
environment:
@@ -54,7 +54,7 @@ services:
5454
SCHEMA_REGISTRY_KAFKASTORE_TOPIC: _schemas
5555

5656
kafka-init-topics:
57-
image: confluentinc/cp-kafka:5.2.4
57+
image: confluentinc/cp-kafka:5.3.1
5858
volumes:
5959
- ./message.json:/data/message.json
6060
depends_on:

‎docker/kafka-clusters-only.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ services:
1111
- 2181:2181
1212

1313
kafka0:
14-
image: confluentinc/cp-kafka:5.2.4
14+
image: confluentinc/cp-kafka:5.3.1
1515
depends_on:
1616
- zookeeper0
1717
environment:
@@ -28,7 +28,7 @@ services:
2828
- 9997:9997
2929

3030
kafka01:
31-
image: confluentinc/cp-kafka:5.2.4
31+
image: confluentinc/cp-kafka:5.3.1
3232
depends_on:
3333
- zookeeper0
3434
environment:
@@ -53,7 +53,7 @@ services:
5353
- 2182:2181
5454

5555
kafka1:
56-
image: confluentinc/cp-kafka:5.2.4
56+
image: confluentinc/cp-kafka:5.3.1
5757
depends_on:
5858
- zookeeper1
5959
environment:
@@ -70,7 +70,7 @@ services:
7070
- 9998:9998
7171

7272
schemaregistry0:
73-
image: confluentinc/cp-schema-registry:5.2.4
73+
image: confluentinc/cp-schema-registry:5.5.0
7474
depends_on:
7575
- zookeeper0
7676
- kafka0
@@ -107,7 +107,7 @@ services:
107107
SCHEMA_REGISTRY_KAFKASTORE_TOPIC: _schemas
108108

109109
kafka-connect0:
110-
image: confluentinc/cp-kafka-connect:5.2.4
110+
image: confluentinc/cp-kafka-connect:6.0.1
111111
ports:
112112
- 8083:8083
113113
depends_on:
@@ -133,7 +133,7 @@ services:
133133

134134

135135
kafka-init-topics:
136-
image: confluentinc/cp-kafka:5.2.4
136+
image: confluentinc/cp-kafka:5.3.1
137137
volumes:
138138
- ./message.json:/data/message.json
139139
depends_on:

‎docker/kafka-ui-auth-context.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ services:
1616
KAFKA_CLUSTERS_0_ZOOKEEPER: zookeeper0:2181
1717
KAFKA_CLUSTERS_0_JMXPORT: 9997
1818
SERVER_SERVLET_CONTEXT_PATH: /kafkaui
19-
AUTH_ENABLED: "true"
19+
AUTH_TYPE: "LOGIN_FORM"
2020
SPRING_SECURITY_USER_NAME: admin
2121
SPRING_SECURITY_USER_PASSWORD: pass
2222

@@ -29,7 +29,7 @@ services:
2929
- 2181:2181
3030

3131
kafka0:
32-
image: confluentinc/cp-kafka:5.2.4
32+
image: confluentinc/cp-kafka:5.3.1
3333
depends_on:
3434
- zookeeper0
3535
ports:
@@ -46,7 +46,7 @@ services:
4646
KAFKA_JMX_OPTS: -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=kafka0 -Dcom.sun.management.jmxremote.rmi.port=9997
4747

4848
kafka-init-topics:
49-
image: confluentinc/cp-kafka:5.2.4
49+
image: confluentinc/cp-kafka:5.3.1
5050
volumes:
5151
- ./message.json:/data/message.json
5252
depends_on:

‎docker/kafka-ui-connectors.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ services:
3838
- 2181:2181
3939

4040
kafka0:
41-
image: confluentinc/cp-kafka:5.2.4
41+
image: confluentinc/cp-kafka:5.3.1
4242
depends_on:
4343
- zookeeper0
4444
ports:
@@ -63,7 +63,7 @@ services:
6363
ZOOKEEPER_TICK_TIME: 2000
6464

6565
kafka1:
66-
image: confluentinc/cp-kafka:5.2.4
66+
image: confluentinc/cp-kafka:5.3.1
6767
depends_on:
6868
- zookeeper1
6969
ports:
@@ -82,7 +82,7 @@ services:
8282
KAFKA_JMX_OPTS: -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=kafka1 -Dcom.sun.management.jmxremote.rmi.port=9998
8383

8484
schemaregistry0:
85-
image: confluentinc/cp-schema-registry:5.2.4
85+
image: confluentinc/cp-schema-registry:5.5.0
8686
ports:
8787
- 8085:8085
8888
depends_on:
@@ -148,7 +148,7 @@ services:
148148
# AWS_SECRET_ACCESS_KEY: ""
149149

150150
kafka-init-topics:
151-
image: confluentinc/cp-kafka:5.2.4
151+
image: confluentinc/cp-kafka:5.3.1
152152
volumes:
153153
- ./message.json:/data/message.json
154154
depends_on:

‎docker/kafka-ui-jmx-secured.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ services:
8181
- ./jmx/jmxremote.access:/jmx/jmxremote.access
8282

8383
schemaregistry0:
84-
image: confluentinc/cp-schema-registry:5.2.4
84+
image: confluentinc/cp-schema-registry:5.5.0
8585
ports:
8686
- 8085:8085
8787
depends_on:
@@ -99,7 +99,7 @@ services:
9999
SCHEMA_REGISTRY_KAFKASTORE_TOPIC: _schemas
100100

101101
kafka-connect0:
102-
image: confluentinc/cp-kafka-connect:5.2.4
102+
image: confluentinc/cp-kafka-connect:6.0.1
103103
ports:
104104
- 8083:8083
105105
depends_on:
@@ -124,7 +124,7 @@ services:
124124
CONNECT_PLUGIN_PATH: "/usr/share/java,/usr/share/confluent-hub-components"
125125

126126
kafka-init-topics:
127-
image: confluentinc/cp-kafka:5.2.4
127+
image: confluentinc/cp-kafka:5.3.1
128128
volumes:
129129
- ./message.json:/data/message.json
130130
depends_on:

‎docker/kafka-ui-zookeeper-ssl.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ services:
6060
- 2182:2182
6161

6262
kafka0:
63-
image: confluentinc/cp-kafka:5.2.4
63+
image: confluentinc/cp-kafka:5.3.1
6464
depends_on:
6565
- zookeeper0
6666
ports:
@@ -89,7 +89,7 @@ services:
8989
KAFKA_ZOOKEEPER_SSL_TRUSTSTORE_TYPE: JKS
9090

9191
schemaregistry0:
92-
image: confluentinc/cp-schema-registry:5.2.4
92+
image: confluentinc/cp-schema-registry:5.5.0
9393
ports:
9494
- 8085:8085
9595
depends_on:
@@ -107,7 +107,7 @@ services:
107107
SCHEMA_REGISTRY_KAFKASTORE_TOPIC: _schemas
108108

109109
kafka-connect0:
110-
image: confluentinc/cp-kafka-connect:5.2.4
110+
image: confluentinc/cp-kafka-connect:6.0.1
111111
ports:
112112
- 8083:8083
113113
depends_on:
@@ -132,7 +132,7 @@ services:
132132
CONNECT_PLUGIN_PATH: "/usr/share/java,/usr/share/confluent-hub-components"
133133

134134
kafka-init-topics:
135-
image: confluentinc/cp-kafka:5.2.4
135+
image: confluentinc/cp-kafka:5.3.1
136136
volumes:
137137
- ./message.json:/data/message.json
138138
depends_on:

‎docker/kafka-ui.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ services:
3939
- 2181:2181
4040

4141
kafka0:
42-
image: confluentinc/cp-kafka:5.2.4
42+
image: confluentinc/cp-kafka:5.3.1
4343
depends_on:
4444
- zookeeper0
4545
ports:
@@ -62,7 +62,7 @@ services:
6262
ZOOKEEPER_TICK_TIME: 2000
6363

6464
kafka1:
65-
image: confluentinc/cp-kafka:5.2.4
65+
image: confluentinc/cp-kafka:5.3.1
6666
depends_on:
6767
- zookeeper1
6868
ports:
@@ -79,7 +79,7 @@ services:
7979
KAFKA_JMX_OPTS: -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=kafka1 -Dcom.sun.management.jmxremote.rmi.port=9998
8080

8181
schemaregistry0:
82-
image: confluentinc/cp-schema-registry:5.2.4
82+
image: confluentinc/cp-schema-registry:5.5.0
8383
ports:
8484
- 8085:8085
8585
depends_on:
@@ -140,7 +140,7 @@ services:
140140
CONNECT_PLUGIN_PATH: "/usr/share/java,/usr/share/confluent-hub-components"
141141

142142
kafka-init-topics:
143-
image: confluentinc/cp-kafka:5.2.4
143+
image: confluentinc/cp-kafka:5.3.1
144144
volumes:
145145
- ./message.json:/data/message.json
146146
depends_on:

‎etc/checkstyle/checkstyle.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242

4343
<module name="LineLength">
4444
<property name="fileExtensions" value="java"/>
45-
<property name="max" value="100"/>
45+
<property name="max" value="120"/>
4646
<property name="ignorePattern" value="^package.*|^import.*|a href|href|http://|https://|ftp://"/>
4747
</module>
4848

‎guides/SSO.md

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ This is a main parameters required for enabling SSO
2323
#### Step 3
2424
To launch UI for Apache Kafka with enabled TLS and SSO run following:
2525
``` bash
26-
docker run -p 8080:8080 -v `pwd`/cert:/opt/cert -e AUTH_ENABLED=true \
26+
docker run -p 8080:8080 -v `pwd`/cert:/opt/cert -e AUTH_TYPE=LOGIN_FORM \
2727
-e SECURITY_BASIC_ENABLED=true \
2828
-e SERVER_SSL_KEY_STORE_TYPE=PKCS12 \
2929
-e SERVER_SSL_KEY_STORE=/opt/cert/ui-for-apache-kafka.p12 \
@@ -35,16 +35,15 @@ docker run -p 8080:8080 -v `pwd`/cert:/opt/cert -e AUTH_ENABLED=true \
3535
-e SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI=https://dev-a63ggcut.auth0.com/ \
3636
-e TRUST_STORE=/opt/cert/ui-for-apache-kafka.p12 \
3737
-e TRUST_STORE_PASSWORD=123456 \
38-
provectuslabs/kafka-ui:0.1.0
38+
provectuslabs/kafka-ui:latest
3939
```
4040
In the case with trusted CA-signed SSL certificate and SSL termination somewhere outside of application we can pass only SSO related environment variables:
4141
``` bash
42-
docker run -p 8080:8080 -v `pwd`/cert:/opt/cert -e AUTH_ENABLED=true \
43-
-e SECURITY_BASIC_ENABLED=true \
42+
docker run -p 8080:8080 -v `pwd`/cert:/opt/cert -e AUTH_TYPE=OAUTH2 \
4443
-e SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID=uhvaPKIHU4ZF8Ne4B6PGvF0hWW6OcUSB \
4544
-e SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET=YXfRjmodifiedTujnkVr7zuW9ECCAK4TcnCio-i \
4645
-e SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI=https://dev-a63ggcut.auth0.com/ \
47-
provectuslabs/kafka-ui:0.1.0
46+
provectuslabs/kafka-ui:latest
4847
```
4948

5049
#### Step 4 (optional)

0 commit comments

Comments
 (0)