Configuring Kafka Topic Permissions

Notes and Constraints

• If parameter allow.everyone.if.no.acl.found is set to true and no users are granted permissions for a topic, all users can publish messages or subscribe to the topic. If permissions for a topic have been granted to one or more users, only these users can or publish messages or subscribe to the topic. The value of allow.everyone.if.no.acl.found can be modified.
• If allow.everyone.if.no.acl.found is set to false, only the initial user (set when ciphertext access is enabled for the first time) and other authorized users have the permission to publish messages or subscribe to topics. The value of allow.everyone.if.no.acl.found can be modified.
• If allow.everyone.if.no.acl.found is changed from the initial default value true to false, the initial user has the publish and subscribe permissions for all topics regardless of whether the value is changed again.
• If both the default and individual user permissions are configured for a topic, the union of the permissions is used.
• Unavailable for single-node instances.
• Permissions may be temporarily invalid during the configuration, throwing client error message "AuthorizationException". In this case, set a retry mechanism on the client. For details, see Suggestions on Using the Kafka Client.

Prerequisites

• Ciphertext has been enabled for the Kafka instance.
• A user is created.

Viewing Topic Permissions on the Topic Details Page

1. Log in to the Kafka console.
2. Click in the upper left corner to select the region where your instance is located.
3. Click the desired Kafka instance to go to the instance details page.
4. In the navigation pane, choose Instances > Topics.
5. Click a topic name to go to the topic details page.
6. Choose the User Permissions tab.
7. View all authorized users of the topic and their permissions.

   Table 1 User permissions

   Parameter	Description
   Username	Users who have the publish or subscribe permissions
   Permission	Permissions of the user.

Granting Multiple Users the Permission for the Same Topic

1. Log in to the Kafka console.
2. Click in the upper left corner to select the region where your instance is located.
3. Click the desired Kafka instance to go to the instance details page.
4. In the navigation pane, choose Instances > Topics.
5. Go to the user permission page in either of the following ways:
   • In the row containing the desired topic, click Grant User Permission.
   • Click the desired topic name to go to the topic details page. Click Configure Permission in the upper right corner.
   • Click the desired topic name to go to the topic details page. Choose the User Permissions tab. Click Configure Permission.

6. Grant topic permissions to users.
   • To grant the same permissions to all users, select Default permissions and then select permissions. As shown in the following figure, all users can publish messages to this topic.
     Figure 1 Granting the same permissions to all users
     
   • To grant different permissions to different users, do not select Default permissions. In the Users area of the Grant User Permission dialog box, select target users. If there are many users, enter the username in the search box for a quick search. In the Topic Permissions area, configure permissions (Subscribe, Publish, or Publish/Subscribe) for the users. As shown in the following figure, only the test, send, and receive users can subscribe to or publish messages to this topic. The send_receive user cannot subscribe to or publish messages to this topic.
     Figure 2 Granting permissions to individual users
     

   If both the default and individual user permissions are configured for a topic, the union of the permissions is used. As shown in the following figure, the test and receive users can subscribe to and publish messages to this topic, while other users can only publish messages to this topic.

   Figure 3 Granting topic permissions to users
   

7. At the bottom of the User Permissions dialog box, click Auto Enter. The system will automatically enter MODIFY in the text box. Then, click OK. The Current Tasks page is displayed.
8. The topic permission is configured when the Configure topic permission task is in the Successful state.
9. Verify whether the permissions are correct.
   1. In the navigation pane, choose Topics.
   2. Click the desired topic name to go to the topic details page.
   3. Choose the User Permissions tab.
   4. View the configured user permissions.
      Figure 4 Viewing authorized users and their permissions
      

Granting Multiple Users the Permission for Multiple Topics

1. Log in to the Kafka console.
2. Click in the upper left corner to select the region where your instance is located.
3. Click the desired Kafka instance to go to the instance details page.
4. In the navigation pane, choose Instances > Topics.
5. Select the topics to be configured with user permissions and click Grant User Permission.
6. Set topic permissions in batches.
   The permissions already set for a user are not displayed. Setting permissions in batches overwrites the previous permission settings. For example, user test already has the Publish/Subscribe permission on Topic01. When the Publish permission is set for the user in a batch permission setting, the user only has the Publish permission on Topic01.

   • To grant the same permissions to all users, select Default permissions and then select permissions. As shown in the following figure, all users can publish messages to topics 01 and 02.
     Figure 5 Granting the same permissions to all users
     
   • To grant different permissions to different users, do not select Default permissions. In the Users area of the Grant User Permission dialog box, select target users. If there are many users, enter the username in the search box for a quick search. In the Topic Permissions area, configure different permissions for the users. As shown in the following figure, only the test, send, and receive users can subscribe to or publish messages to topic01 and 02. The send_receive user cannot subscribe to or publish messages to these topics.
     Figure 6 Granting permissions to multiple users
     

   If both the default and individual user permissions are configured for a topic, the union of the permissions is used. As shown in the following figure, the test and receive users can subscribe to and publish messages to topic01 and 02, while other users can only publish messages to them.

   Figure 7 Granting topic permissions to users
   

7. At the bottom of the Set Permissions dialog box, click Auto Enter. The system will automatically enter MODIFY in the text box. Then, click OK. The Current Tasks page is displayed.
8. The topic permission is configured when the Configure topic permission task is in the Successful state.
9. Verify whether the permissions are correct.
   1. In the navigation pane, choose Topics.
   2. Click the desired topic name to go to the topic details page.
   3. Choose the User Permissions tab.
   4. View the configured user permissions.
      Figure 8 Viewing authorized users and their permissions
      

Deleting Permissions for a Topic

1. Log in to the Kafka console.
2. Click in the upper left corner to select the region where your instance is located.
3. Click the desired Kafka instance to go to the instance details page.
4. In the navigation pane, choose Instances > Topics.
5. Go to the user permission page in either of the following ways:
   • In the row containing the desired topic, click Grant User Permission.
   • Click the name of the topic to go to the topic details page. Click Configure Permission in the upper right corner.
   • Click the name of the topic to go to the topic details page. Choose the User Permissions tab. Click Configure Permission.

6. In the Topic Permissions area, in the row containing the user, click Delete.
7. At the bottom of the User Permissions dialog box, click Auto Enter. The system will automatically enter MODIFY in the text box. Then, click OK. The Current Tasks page is displayed.
8. The topic permission is deleted when the Configure topic permission task is in the Successful state.
9. Verify whether the permissions have been deleted.
   1. In the navigation pane, choose Topics.
   2. Click the name of the topic to go to the topic details page.
   3. Choose the User Permissions tab.
   4. The user is deleted if it is not displayed in User Permissions.

Related Document

To set topic permissions by calling an API, see Granting User Permissions.