RBAC implemantion issue #4015

ManojKumarMaurya · 2023-07-05T04:58:12Z

ManojKumarMaurya
Jul 5, 2023

Issue submitter TODO list

I've looked up my issue in FAQ
I've searched for an already existing issues here
I've tried running master-labeled docker image and the issue still persists there
I'm running a supported version of the application which is listed here

Describe the bug (actual behavior)

while staring application app get crashed due

Expected behavior

the application should properly

**Your installation details **

auth:
  type: OAUTH2
  oauth2:
    client:
      google:
        provider: google
        clientId: jhsabdjahbfksdfnfkjdsnvdjkshfkjdsvkjdfsnvkjdsfbvkjsdhbvjsdfbv.apps.googleusercontent.example.com
        clientSecret: nbcjlsbcsjldfbnajahfjkshcfkjadbfnjkdhsabcjnsadbc sjndabc jadns csadnc jasdbcfjadsbfcjaewh
        user-name-attribute: email
        custom-params:
          type: google
          allowedDomain: example.com # for RBAC

#yamlApplicationConfig:
kafka:
  clusters:
    - name: test-cluster
      bootstrapServers: 192.60.40.100:9092
rbac:
  roles:
    - name:
      clusters:
        - test-cluster
      subjects:
        - provider: google
      type: domain
      value: example.com
    - provider: google
      type: user
      value: example.com
    - permissions:
        - resource: cluster
      name: .*
      actions: 
        - view
        - create 

    - resource: topic
      actions: 
        - view
        - create
        - edit
      name: ".*" 
    - resource: connect
      actions: .*
      name: .*

** Steps to reproduce**

docker run -p 8080:8080 -e SPRING_CONFIG_ADDITIONAL-LOCATION=/config.yml kafka-ui:latest

Logs

18:13:09,479 |-INFO in ch.qos.logback.classic.LoggerContext[default] - This is logback-classic version 1.4.7
18:13:09,615 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Could NOT find resource [logback-test.xml]
18:13:09,618 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Could NOT find resource [logback.xml]
18:13:09,640 |-INFO in ch.qos.logback.classic.BasicConfigurator@7b9a4292 - Setting up default configuration.
18:13:12,839 |-INFO in ch.qos.logback.core.joran.spi.ConfigurationWatchList@4a94ee4 - URL [jar:file:/kafka-ui-api.jar!/BOOT-INF/classes!/logback-spring.xml] is not of type file
18:13:13,200 |-INFO in ch.qos.logback.core.model.processor.AppenderModelHandler - Processing appender named [STDOUT]
18:13:13,201 |-INFO in ch.qos.logback.core.model.processor.AppenderModelHandler - About to instantiate appender of type [ch.qos.logback.core.ConsoleAppender]
18:13:13,369 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - This appender no longer admits a layout as a sub-component, set an encoder instead.
18:13:13,369 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - To ensure compatibility, wrapping your layout in LayoutWrappingEncoder.
18:13:13,369 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - See also http://logback.qos.ch/codes.html#layoutInsteadOfEncoder for details
18:13:13,369 |-INFO in ch.qos.logback.classic.model.processor.RootLoggerModelHandler - Setting level of ROOT logger to INFO
18:13:13,371 |-INFO in ch.qos.logback.classic.jul.LevelChangePropagator@4cc451f2 - Propagating INFO level on Logger[ROOT] onto the JUL framework
18:13:13,374 |-INFO in ch.qos.logback.core.model.processor.AppenderRefModelHandler - Attaching appender named [STDOUT] to Logger[ROOT]
18:13:13,374 |-INFO in ch.qos.logback.core.model.processor.DefaultProcessor@6379eb - End of configuration.
18:13:13,374 |-INFO in org.springframework.boot.logging.logback.SpringBootJoranConfigurator@294425a7 - Registering current configuration as safe fallback point

| | | |_ | / |_ _ _ /\ _ __ __ _ | | ___ | |/ /_ _ / | |____
| || || | | / _ | '| / _ | '_ / / _| ' \/ -_) | ' </ _ | | / / `|
_/|| || ___|| // _| .___,_|||___| ||__,|| |__,|
|_|

2023-07-04 18:13:13,626 INFO [background-preinit] o.h.v.i.u.Version: HV000001: Hibernate Validator 8.0.0.Final
2023-07-04 18:13:14,060 INFO [main] c.p.k.u.KafkaUiApplication: Starting KafkaUiApplication using Java 17.0.6 with PID 1 (/kafka-ui-api.jar started by kafkaui in /)
2023-07-04 18:13:14,065 DEBUG [main] c.p.k.u.KafkaUiApplication: Running with Spring Boot v3.0.6, Spring v6.0.8
2023-07-04 18:13:14,069 INFO [main] c.p.k.u.KafkaUiApplication: No active profile set, falling back to 1 default profile: "default"
2023-07-04 18:13:30,611 INFO [main] o.s.b.a.e.w.EndpointLinksResolver: Exposing 2 endpoint(s) beneath base path '/actuator'
2023-07-04 18:13:30,734 INFO [main] o.s.b.a.s.r.ReactiveUserDetailsServiceAutoConfiguration:

Using generated security password: 8b706638-82b3-4e93-92db-777043a029f4

2023-07-04 18:13:31,473 INFO [main] c.p.k.u.c.a.OAuthSecurityConfig: Configuring OAUTH2 authentication.
2023-07-04 18:13:33,233 INFO [main] o.s.b.w.e.n.NettyWebServer: Netty started on port 8080
2023-07-04 18:13:33,292 INFO [main] c.p.k.u.KafkaUiApplication: Started KafkaUiApplication in 22.547 seconds (process running for 26.201)

Screenshots

No response

Logs

ec2-user@ip-172-34-26-20 ~]$ docker logs 488f905ac0ca
04:06:09,977 |-INFO in ch.qos.logback.classic.LoggerContext[default] - This is logback-classic version 1.4.7
04:06:10,022 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Could NOT find resource [logback-test.xml]
04:06:10,023 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Could NOT find resource [logback.xml]
04:06:10,031 |-INFO in ch.qos.logback.classic.BasicConfigurator@3835c46 - Setting up default configuration.
04:06:10,937 |-INFO in ch.qos.logback.core.joran.spi.ConfigurationWatchList@1dde4cb2 - URL [jar:file:/kafka-ui-api.jar!/BOOT-INF/classes!/logback-spring.xml] is not of type file
04:06:11,076 |-INFO in ch.qos.logback.core.model.processor.AppenderModelHandler - Processing appender named [STDOUT]
04:06:11,076 |-INFO in ch.qos.logback.core.model.processor.AppenderModelHandler - About to instantiate appender of type [ch.qos.logback.core.ConsoleAppender]
04:06:11,126 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - This appender no longer admits a layout as a sub-component, set an encoder instead.
04:06:11,126 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - To ensure compatibility, wrapping your layout in LayoutWrappingEncoder.
04:06:11,126 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - See also http://logback.qos.ch/codes.html#layoutInsteadOfEncoder for details
04:06:11,126 |-INFO in ch.qos.logback.classic.model.processor.RootLoggerModelHandler - Setting level of ROOT logger to INFO
04:06:11,126 |-INFO in ch.qos.logback.classic.jul.LevelChangePropagator@7714e963 - Propagating INFO level on Logger[ROOT] onto the JUL framework
04:06:11,128 |-INFO in ch.qos.logback.core.model.processor.AppenderRefModelHandler - Attaching appender named [STDOUT] to Logger[ROOT]
04:06:11,128 |-INFO in ch.qos.logback.core.model.processor.DefaultProcessor@20ce78ec - End of configuration.
04:06:11,128 |-INFO in org.springframework.boot.logging.logback.SpringBootJoranConfigurator@393671df - Registering current configuration as safe fallback point

| | | |_ | / |_ _ _ /\ _ __ __ _ | | ___ | |/ /_ _ / | |____
| || || | | / _ | '| / _ | '_ / / _| ' \/ -_) | ' </ _ | | / / `|
_/|| || ___|| // _| .___,_|||___| ||__,|| |__,|
|_|

2023-07-05 04:06:11,176 INFO [background-preinit] o.h.v.i.u.Version: HV000001: Hibernate Validator 8.0.0.Final
2023-07-05 04:06:11,287 WARN [main] c.p.k.u.u.DynamicConfigOperations: Dynamic config file /etc/kafkaui/dynamic_config.yaml doesnt exist or not readable
2023-07-05 04:06:11,292 INFO [main] c.p.k.u.KafkaUiApplication: Starting KafkaUiApplication using Java 17.0.6 with PID 1 (/kafka-ui-api.jar started by kafkaui in /)
2023-07-05 04:06:11,293 DEBUG [main] c.p.k.u.KafkaUiApplication: Running with Spring Boot v3.0.6, Spring v6.0.8
2023-07-05 04:06:11,294 INFO [main] c.p.k.u.KafkaUiApplication: No active profile set, falling back to 1 default profile: "default"
2023-07-05 04:06:14,636 WARN [main] o.s.b.w.r.c.AnnotationConfigReactiveWebServerApplicationContext: Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'accessController' defined in URL [jar:file:/kafka-ui-api.jar!/BOOT-INF/classes!/com/provectus/kafka/ui/controller/AccessController.class]: Unsatisfied dependency expressed through constructor parameter 0: Error creating bean with name 'accessControlService' defined in URL [jar:file:/kafka-ui-api.jar!/BOOT-INF/classes!/com/provectus/kafka/ui/service/rbac/AccessControlService.class]: Unsatisfied dependency expressed through constructor parameter 1: Error creating bean with name 'rbac-com.provectus.kafka.ui.config.auth.RoleBasedAccessControlProperties': Could not bind properties to 'RoleBasedAccessControlProperties' : prefix=rbac, ignoreInvalidFields=false, ignoreUnknownFields=true
2023-07-05 04:06:14,670 INFO [main] o.s.b.a.l.ConditionEvaluationReportLogger:

Error starting ApplicationContext. To display the condition evaluation report re-run your application with 'debug' enabled.
2023-07-05 04:06:14,715 ERROR [main] o.s.b.d.LoggingFailureAnalysisReporter:

APPLICATION FAILED TO START

Description:

Binding to target [Bindable@79ab3a71 type = java.util.List<com.provectus.kafka.ui.model.rbac.Role>, value = 'provided', annotations = array[[empty]]] failed:

Property: rbac.roles[1].provider
Value: "google"
Origin: URL [file:/config.yml] - 27:17
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[1].type
Value: "user"
Origin: URL [file:/config.yml] - 28:13
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[1].value
Value: "rebelfoods.com"
Origin: URL [file:/config.yml] - 29:14
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[2].actions[0]
Value: "view"
Origin: URL [file:/config.yml] - 34:11
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[2].actions[1]
Value: "create"
Origin: URL [file:/config.yml] - 35:11
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[2].name
Value: ".*"
Origin: URL [file:/config.yml] - 32:13
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[2].permissions[0].resource
Value: "cluster"
Origin: URL [file:/config.yml] - 31:21
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[3].actions[0]
Value: "view"
Origin: URL [file:/config.yml] - 39:11
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[3].actions[1]
Value: "create"
Origin: URL [file:/config.yml] - 40:11
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[3].actions[2]
Value: "edit"
Origin: URL [file:/config.yml] - 41:11
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[3].name
Value: ".*"
Origin: URL [file:/config.yml] - 42:13
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[3].resource
Value: "topic"
Origin: URL [file:/config.yml] - 37:17
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[4].actions
Value: ".*"
Origin: URL [file:/config.yml] - 45:16
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[4].name
Value: ".*"
Origin: URL [file:/config.yml] - 46:13
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.
Property: rbac.roles[4].resource
Value: "connect"
Origin: URL [file:/config.yml] - 44:17
Reason: The elements [rbac.roles[1].provider,rbac.roles[1].type,rbac.roles[1].value,rbac.roles[2].actions[0],rbac.roles[2].actions[1],rbac.roles[2].name,rbac.roles[2].permissions[0].resource,rbac.roles[3].actions[0],rbac.roles[3].actions[1],rbac.roles[3].actions[2],rbac.roles[3].name,rbac.roles[3].resource,rbac.roles[4].actions,rbac.roles[4].name,rbac.roles[4].resource] were left unbound.

Action:

Update your application's configuration

Additional context

I was try setup role based access policy on kafka UI where some of group memeber have write, modify delete access and some needs to read only access

Answered by Haarolean

Jul 6, 2023

Your rbac config structure is not properly indented.
Please refer to our documentation, here's one example with a full structure: here

View full answer

Haarolean · 2023-07-05T12:27:02Z

Haarolean
Jul 5, 2023

Hi, please format your config as yaml (using triple backticks) so we could take a look

0 replies

ManojKumarMaurya · 2023-07-06T05:49:20Z

ManojKumarMaurya
Jul 6, 2023
Author

@Haarolean I have formatted config yaml please have a look and suggest

0 replies

Haarolean · 2023-07-06T11:32:59Z

Haarolean
Jul 6, 2023

Your rbac config structure is not properly indented.
Please refer to our documentation, here's one example with a full structure: here

21 replies

Haarolean Jul 12, 2023

@ManojKumarMaurya please post your actual config. You have a provider "oauth_google" which has a missing value property.

ManojKumarMaurya Jul 12, 2023
Author

@Haarolean Thanks again for your response, Now it's working and I am able to login

Now I have a question how could I add multiple team members to the group currently I have added 1 as the string

subjects:
        - provider: oauth_google
          type: user
          value: "[email protected]"

Yaml

rbac:
  roles:
    - name: "readonly"
      clusters:
        - local
        - dev
        - staging-cluster
        - prod
      subjects:
        - provider: oauth_google
          type: user
          value: "[email protected]"
      permissions:
        - resource: clusterconfig
          actions: [ "view" ]

        - resource: topic
          value: ".*"
          actions: 
            - VIEW
            - MESSAGES_READ

        - resource: consumer
          value: ".*"
          actions: [ view ]

        - resource: schema
          value: ".*"
          actions: [ view ]

        - resource: connect
          value: ".*"
          actions: [ view ]

        - resource: acl
          actions: [ view ]
      
    - name: "admins"
      clusters:
        - local
        - dev
        - staging-cluster
        - prod
      subjects:
        # - provider: oauth_google
        #   type: domain
        #   value: "rebelfoods.com"
        - provider: oauth_google
          type: user
          value: "[email protected]"
      permissions:
        - resource: applicationconfig
          actions: all
      
        - resource: clusterconfig
          actions: all

        - resource: topic
          value: ".*"
          actions: all

        - resource: consumer
          value: ".*"
          actions: all

        - resource: schema
          value: ".*"
          actions: all

        - resource: connect
          value: ".*"
          actions: all

        - resource: ksql
          actions: all
          
        - resource: acl
          #value: ".*"
          actions: all

Haarolean Jul 12, 2023

subjects:
        - provider: oauth_google
          type: user
          value: "[email protected]"
        - provider: oauth_google
          type: user
          value: "[email protected]"

ManojKumarMaurya Jul 13, 2023
Author

@Haarolean Thanks so much for helping me it's really great this help a lot.

Haarolean Jul 13, 2023

@ManojKumarMaurya you're welcome, glad it works.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RBAC implemantion issue #4015

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 21 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

RBAC implemantion issue #4015

ManojKumarMaurya Jul 5, 2023

Issue submitter TODO list

Describe the bug (actual behavior)

Expected behavior

Screenshots

Logs

Additional context

Replies: 3 comments · 21 replies

Haarolean Jul 5, 2023

ManojKumarMaurya Jul 6, 2023 Author

Haarolean Jul 6, 2023

Haarolean Jul 12, 2023

ManojKumarMaurya Jul 12, 2023 Author

Haarolean Jul 12, 2023

ManojKumarMaurya Jul 13, 2023 Author

Haarolean Jul 13, 2023

ManojKumarMaurya
Jul 5, 2023

Replies: 3 comments 21 replies

Haarolean
Jul 5, 2023

ManojKumarMaurya
Jul 6, 2023
Author

Haarolean
Jul 6, 2023

ManojKumarMaurya Jul 12, 2023
Author

ManojKumarMaurya Jul 13, 2023
Author