Kafka access with granular permissions

[tomcsyke]

Hi All!

Please help me to solve.
Possible Kafka UI can not handle user/topic authorization?

I have already configured with Keycloak and I used using the following environment variables:

OAUTH_CLIENT_ID: "kafka-ui"
OAUTH_AUTHORIZATION_URL: "https://keycloak.companywebsite.com/realms/kafka-ui-companyproject-dev/protocol/openid-connect/auth"
AUTH_TYPE: "OAUTH2"
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID: "kafka-ui-companyproject-dev"
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET: "CLiEnTsEcReT"
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI: "https://keycloak.companywebsite.com/realms/kafka-ui-companyproject-dev"
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_SCOPE: "openid"

It worked successfully with Keycloak, when picked up users at the realm config, then users can login, but unfortunately they reached all the topics. How can I configure Kafka UI with Keycloak to handle user/topic authorization? So how can we allow to reach the different Kafka topics with only the allowed users ?

If this not possible how can I configure it with MSK? (without kafka UI) Kafka is deployed into Amazon EKS.

Thank you very much for your answer in advance.

Best regards,
Erik

[Haarolean]

Hey, role based access control feature is in progress (#753). Until that, you can't limit access to separate topics.
And we do support MSK, yes. You can install kafka-ui from AWS marketplace as well.

[Haarolean]

@tomcsyke Wdym? Configure what exactly? I don't get the "(without Kafka UI)" part.

[tomcsyke]

Your question is valid. What I would like to know is that there is an option to configure Kafka without Kafka UI, using MSK. But this is not part of Kafka UI development, so please ignore my previous question.

Thank you for your reply so far.

[Haarolean]

@tomcsyke MSK is a managed kafka by AWS, so you can't set up kafka with another kafka :)

[tomcsyke]

@Haarolean Sorry to bother you with one more question. Is it possible to connect a Kafka UI to a Kafka service installed with MSK in AWS? In this case, can the issue of user management be solved at Topics?

[Haarolean]

@tomcsyke yes, we do support MSK, but the problem would persist in case you don't have an access to all the topics.