title: Kafka: Set ACLs for multiple users when zookeeper.set.acl=true?
body: <p>My setup is the following:</p>
  
  <ul>
  <li>3 Zookeeper nodes secured in the following way:
  
  <ul>
  <li>SASL enabled (quorum.auth.enableSasl=true)</li>
  <li>Requires SASL for learners (learnerRequireSasl=true)</li>
  <li>Require SASL for servers (quorum.auth.serverRequireSasl=true)</li>
  <li>Require SASL for clients (requireClientAuthScheme=sasl)</li>
  <li>A jaas.conf file with the entries QuorumServer, QuorumLearner (both with the same <em>zookeeper</em> account and password), and Server (with a <em>kafka</em> plus a <strong><em>superuser</em></strong> account, plus passwords)</li>
  </ul></li>
  </ul>
  
  <p>The idea of the <em>superuser</em> account is that I can use a separate identities and secrets (and possibly permissions) for the Kafka cluster vs. connections by admins from CLI tools.</p>
  
  <p>Then...</p>
  
  <ul>
  <li>3 Kafka nodes secured in the following way:
  
  <ul>
  <li>All listeners require SASL_PLAINTEXT (listener.security.protocol.map)</li>
  <li>SASL mechanism is SCRAM-SHA-512 (sasl.enabled.mechanisms)</li>
  <li>Brokers require SASL for interbroker as well as client connections (sasl.mechanism.inter.broker.protocol)</li>
  <li>Super users: <em>kafka</em>, <em>superuser</em></li>
  <li><strong>Set ACLs</strong> on all metadata that Kafka creates (zookeeper.set.acl=true). See (KIP-38)(<a href="https://cwiki.apache.org/confluence/display/KAFKA/KIP-38%3A+ZooKeeper+Authentication" rel="nofollow noreferrer">https://cwiki.apache.org/confluence/display/KAFKA/KIP-38%3A+ZooKeeper+Authentication</a>)</li>
  </ul></li>
  </ul>
  
  <p>In Kafka + Zookeeper deployments with default settings, Zookeeper essentially applies no noteworthy protection mechanisms. Any rogue actor who can connect to a Zookeeper instance (e.g. after penetrating the so-called isolated network) can change Kafka metadata stored in Zookeeper at will, such as creating new Kafka users and elevating permissions.</p>
  
  <p>With the <strong>zookeeper.set.acl=true</strong> setting, Kafka will automatically apply ACLs to all the Znodes it creates (for clusters, topics, offsets, etc.) so that its Znodes are protected from unauthenticated and unauthorized access = more defense in depth. </p>
  
  <p><strong>Important</strong>: These ACLs are Znode ACLs (a Zookeeper concept) and not the same as the Kafka ACLs that can be applied to clusters, topics, and the like. The <em>zookeeper-shell.sh</em> example below shows the subnodes of <em>/config</em> and the ACL set on the <em>/config/users</em> Znode. Only the <em>kafka</em> identity has full control, <em>world</em> has no access whatsoever:</p>
  
  <pre><code>ls /config
     [changes, clients, brokers, users, topics]
  getAcl /config/users
     'sasl,'kafka
     : cdrwa
  </code></pre>
  
  <p>Kafka will only set ACLs on Znodes for one account, which is typically named <em>kafka</em>. Certain Kafka administration tasks, such as adding Kafka users with SCRAM-SHA-512 authentication (kafka-configs.sh tool), cannot be done through Kafka brokers but require direct interaction between the CLI tool and Zookeeper.</p>
  
  <p>And this finally gets me to the problem that I am facing: Because Znode ACLs automatically set by Kafka brokers are only set for the <em>kafka</em> identity, it is not possible to perform Zookeeper CLI operations using any other identity, such a <em>superuser</em> identity.</p>
  
  <p><strong>Question</strong>: Does anybody know how to make Kafka set Znode ACLs for more than just the <em>kafka</em> identity? Specifically, I would also like the <em>superuser</em> identity to be able to make modifications directly in Zookeeper.</p>