RBAC Feature for AZURE AD

[vijayaganesh7]

Does RBAC feature is currently support for Azure AD ? I tried to configure RBAC with Azure AD but getting below error, would like to know more about it.

############ Config file : ###############

kafka:
  clusters:
    - name: MyKafkaCluster
      bootstrapServers: "kafka-broker-1:9093,kafka-broker-2:9095,kafka-broker-3:9097"
 
server:
  forward-headers-strategy: "native"

dynamic.config.enabled: "true"

auth:
  type: OAUTH2
  oauth2:
    client:
      azuread:
        clientId: xxxxx
        clientSecret: xxxxx
        scope: openid
        client-name: azure
        provider: azuread
        issuer-uri: "https://login.microsoftonline.com/68b865d5-cf18-4b2b-82a4-a4eddb9c5237/v2.0"
        jwk-set-uri: "https://login.microsoftonline.com/68b865d5-cf18-4b2b-82a4-a4eddb9c5237/discovery/v2.0/keys"
        custom-params:
          type: oauth # fill this if you're gonna use RBAC. Supported values: cognito, google, github, oauth (for other generic providers)
          roles-field: roles # required for RBAC, a field name in OAuth token which will contain user's roles/groups

rbac:
  roles:
    - name: "readonly"
      clusters:
        - local
      subjects:
        - provider: oauth
          type: role
          value: "DEV_ROLE"
      permissions:
        - resource: clusterconfig
          actions: [ "view" ]
        - resource: topic
          value: ".*"
          actions: 
            - VIEW
            - MESSAGES_READ

######### ERROR##############

kafka-ui | 2024-04-09 07:35:33,656 ERROR [main] o.s.b.SpringApplication: Application run failed
kafka-ui | org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'accessController' defined in URL [jar:file:/kafka-ui-api.jar!/BOOT-INF/classes!/com/provectus/kafka/ui/controller/AccessController.class]: Unsatisfied dependency expressed through constructor parameter 0: Error creating bean with name 'accessControlService' defined in URL [jar:file:/kafka-ui-api.jar!/BOOT-INF/classes!/com/provectus/kafka/ui/service/rbac/AccessControlService.class]: Unsatisfied dependency expressed through constructor parameter 1: Error creating bean with name 'rbac-com.provectus.kafka.ui.config.auth.RoleBasedAccessControlProperties': Invocation of init method failed
kafka-ui | at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:800)
kafka-ui | at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:245)
kafka-ui | at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:1352)

[Haarolean]

Hi, the issue you're encountering is related to rbac, but can't say what's the root issue here as the stacktrace is cut.

Please note, this repo is no longer maintained (#4255), but I'll be happy to assist you here: https://github.com/kafbat/kafka-ui (either a discussion or a thread on discord would work)

[vijayaganesh7]

Thanks for the reply Haarolean. Will check out the new repo.