root
/
kafka
mirror of https://github.com/apache/kafka.git
1
0
Fork 0
Code Issues Actions 2 Packages Projects Releases Wiki Activity

MINOR: Align share group admin authz with consumer group (#18936) 

Reviewers: Manikumar Reddy <manikumar.reddy@gmail.com>
This commit is contained in:
Andrew Schofield 2025-02-18 09:12:07 +00:00 committed by GitHub
parent 1f47a78a10
commit 385b7ad355
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/src/main/scala/kafka/server/KafkaApis.scala
View File

@ -3230,7 +3230,7 @@ class KafkaApis(val requestChannel: RequestChannel,
futures += CompletableFuture.completedFuture(new DescribeShareGroupOffsetsResponseData.DescribeShareGroupOffsetsResponseGroup()
.setGroupId(groupDescribeOffsets.groupId)
.setErrorCode(Errors.UNSUPPORTED_VERSION.code))
} else if (!authHelper.authorize(request.context, READ, GROUP, groupDescribeOffsets.groupId)) {
} else if (!authHelper.authorize(request.context, DESCRIBE, GROUP, groupDescribeOffsets.groupId)) {
futures += CompletableFuture.completedFuture(new DescribeShareGroupOffsetsResponseData.DescribeShareGroupOffsetsResponseGroup()
.setGroupId(groupDescribeOffsets.groupId)
.setErrorCode(Errors.GROUP_AUTHORIZATION_FAILED.code))

18
docs/security.html
View File

@ -2267,14 +2267,28 @@ RULE:[n:string](regexp)s/pattern/replacement/g/U</code></pre>
</tr>
<tr>
<td>DESCRIBE_SHARE_GROUP_OFFSETS (90)</td>
<td>Read</td>
<td>Describe</td>
<td>Group</td>
<td>To describe the offset information for a partition in a share group, the application must have privileges on the
group and the topic. Group access is checked first, then topic access.</td>
</tr>
<tr>
<td>DESCRIBE_SHARE_GROUP_OFFSETS (90)</td>
<td>Describe</td>
<td>Topic</td>
<td></td>
</tr>
<tr>
<td>ALTER_SHARE_GROUP_OFFSETS (91)</td>
<td>Alter</td>
<td>Read</td>
<td>Group</td>
<td>To alter the offset information for a partition in a share group, the application must have privileges on the
group and the topic. Group access is checked first, then topic access.</td>
</tr>
<tr>
<td>ALTER_SHARE_GROUP_OFFSETS (91)</td>
<td>Read</td>
<td>Topic</td>
<td></td>
</tr>
</tbody>