Access to topics without and with authn and authz

[atxforkafka]

I am looking for a recommended solution for Kafka configurations that allow unauthenticated and unauthorized access to specific topics while requiring authn and authz for others. The preferred for authorization is simple and authentication is scram-sha-512

[scholzj]

I don't think there is a recommended solution because what you are asking for is absolutely not recommended and insecure.

If you wanna do it, you can:

• Create multiple listeners with and without authentication
• Enable authorization
• For users with authentication, you can manage the ACL rules as normal (e.g. using the User Operator if you enabled it)
• The users connecting without authentication will be given the username ANONYMOUS -> so, you can use the Kafka APIs and manually configure ACL rules for the ANONYMOUS user to access your selected topics

However, please keep in mind that:

• This is hard to monitor and manage -> you never know if someone changed the ACLs for the ANONYMOUS user etc.
• Any security bug in Kafka authorization might be immediately misused by the anonymous users because you do not have the authentication as an additional layer of protection

[atxforkafka]

I created a listener with no authentication and a KafkaUser name anonymous with simple authorization ACLs
My test with a producer sends a message to the topic in the ACLs for user anonymous resulted with error below.
Message delivery failed: KafkaError{code=TOPIC_AUTHORIZATION_FAILED,val=29,str="Broker: Topic authorization failed"}
What am I missing?

[scholzj]

You cannot use KafkaUser for this because the username is ANONYMOUS in upper case. As I said, you would need to use the Kafka Admin APi to create the ACLs for this user.

[atxforkafka]

    bin/kafka-acls.sh --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:ANONYMOUS --resource-type TOPIC --resource-name my-topic --operation READ_WRITE --permission ALLOW