Skip to main content

Schema registry ACL definitions

A Schema Registry ACL controls who can read or write Schema Registry resources in Karapace. These ACLs are separate from Apache Kafka Access Control Lists, which control access to topics and other Kafka resources.

ACL entry fields​

Each ACL entry has three parts:

  • Username: A service user on your Aiven for Apache Kafka® service.
  • Operation: One of:
    • schema_registry_read
    • schema_registry_write (always includes schema_registry_read)
  • Resource: One of these formats:
    • Config:: Controls access to global compatibility configuration. Users with this resource can get or set the default schema compatibility mode. Getting the configuration requires schema_registry_read. Setting it requires schema_registry_write.
    • Subject:subject_name: Controls access to a subject in Schema Registry.
tip

The username and resource name values can use wildcards:

  • * matches any characters
  • ? matches a single character

How access decisions work​

When a user requests a resource, Schema Registry checks whether any ACL entry matches the user and the resource. If a matching entry grants the required operation, access is allowed. Entry order does not affect the decision.

If no ACL entry grants access, Schema Registry returns an HTTP 401 Unauthorized status code.

Endpoint permissions​

  • Read-only endpoints need schema_registry_read for the subject. For endpoints that return data for multiple subjects, the response includes only subjects the user can read.
  • Write endpoints need schema_registry_write for the subject.

Examples​

UsernameOperationResourceEffect
user_1schema_registry_readConfig:Read global compatibility configuration.
user_1schema_registry_readSubject:s1Read data for subject s1 only. List responses omit other subjects.
user_1schema_registry_writeSubject:s1Add, update, or delete data for subject s1. Includes read access.
user_readonly*schema_registry_readSubject:s*Read access for usernames with prefix user_readonly to subjects with prefix s.
user_write*schema_registry_writeSubject:s*Write access for usernames with prefix user_write to subjects with prefix s. Includes read access.

Superuser access​

The user that manages ACLs is a superuser with write access to everything in Schema Registry. In the Aiven Console, that superuser can view and modify all schemas on the Schemas tab of a Kafka service. The superuser and its ACL entries are not visible in the Console. Aiven adds them automatically.

note

Create and manage ACL entries with the Aiven CLI or see Manage Karapace schema registry authorization.

Related pages