redpanda icon indicating copy to clipboard operation
redpanda copied to clipboard

mTLS Authz test: user migrates entire cluster to mTLS

Open NyaliaLui opened this issue 3 years ago • 1 comments

  • Start with enable_sasl=true
  • Set authentication_method=mtls_identity for all brokers
  • Set kafka_mtls_principal_mapping_rules and kafka_enable_authorization=true. This will enable authZ across the cluster.
  • Check that authZ still works on all brokers and mTLS identity is used for authN.

NyaliaLui avatar Jul 29 '22 20:07 NyaliaLui

Manual tests were successful on a 3 broker cluster where I executed rolling restarts. One test migrated a cluster to use authentication_method=sasl and another manual test used authentication_method=mtls_identity and a principal mapping rule of RULE:^O=Redpanda,CN=(cluster_describe|redpanda.service.admin|admin)$/$1/. Both tests successfully executed a simple authz/authn check using rpk acl list

The automated test in #5784 needs some improvements because it is not using rolling restarts.

NyaliaLui avatar Aug 05 '22 21:08 NyaliaLui