search

confluentinc / kafka-rest

Confluent REST Proxy for Kafka
https://docs.confluent.io/current/kafka-rest/docs/index.html
Other
42 stars 644 forks source link

Enhance Error codes when lack of authorisation (ACL) #291

Open simplesteph opened 7 years ago

simplesteph commented 7 years ago

Currently, if the REST Proxy is logged in using SASL, and not authorised to a topic, we get the following in the REST Proxy log:

WARN Error while fetching metadata with correlation id 143 : {jsontest=UNKNOWN_TOPIC_OR_PARTITION} (org.apache.kafka.clients.NetworkClient)

But the REST Client receives this response after a minute:

{"offsets":[{"partition":null,"offset":null,"error_code":50003,"error":"Failed to update metadata after 60000 ms."}],"key_schema_id":null,"value_schema_id":null}

We would need to get a better error code, at least returning the UNKNOWN_TOPIC_OR_PARTITION error, instantaneously?

rmkellogg commented 7 years ago

I am using Apache Ranger (v0.6.0) in conjunction with the Kafka REST Proxy (v3.2.1). In my case, I have policies defined to control access to topics. The error message shown is TOPIC_AUTHORIZATION_FAILED instead of UNKNOXN_TOPIC_OR_PARTITION After 60 seconds, the client does return the same error message. Unfortunately, the REST Proxy then continually tries to update metadata.

Have you had any luck or discovered a work-around?