A principal is the authenticated security identity that represents a client when it accesses protected Kafka resources. Authentication establishes this identity during connection setup and keeps it active for the session; unauthenticated clients use the name User:ANONYMOUS. section 13.2.2
Authorization uses the principal name to decide what the client may do. Kafka ACLs express whether a principal may perform an operation on a named or prefixed resource, optionally from a particular host. Authorization checks super-admin status, Deny rules, and then Allow rules. section 13.2.3
Online-shop service permissions
In an online shop, the checkout service writes completed purchases to checkout.changelog. The payment-processing service reads that topic and its consumer group, while checkout-analytics reads the changelog and receives permissions for its checkout.analytics.* topics and internal Kafka Streams topics. section 13.2.3
With mutual TLS, the broker derives the principal by default from the client certificate’s full Distinguished Name. A principal-mapping rule can extract a simpler Common Name, such as alice, for use in later ACLs. SASL provides an alternative authentication framework. section 13.2.2
CN=alice,OU=myOrgUnit,O=SampleCorp,L=SampleCity,ST=SampleState,C=SampleCountry
Inspect a certificate Distinguished Name that can supply a mutual-TLS principal. section 13.2.2
listener.name.ssl.ssl.principal.mapping.rules= \
RULE:^CN=([^,]*).*$/$1/L ,\
DEFAULT
Inspect the mapping rule that extracts the CN from a Distinguished Name. section 13.2.2
Table 13.2 Kafka ACLs structure
| Component |
Options |
Examples |
|---|---|---|
| Principal |
|
|
| Resource type |
|
|
| Pattern type |
|
|
| Resource name |
|
|
| Operation |
|
|
| Permission type |
|
|
| Host |
|
|
Browse the ACL fields used to identify principals, resources, operations, permissions, and hosts. section 13.2.3
