Skip to main content
Quick navigation

Client Id validation

View the full demo in realtime​

You can either follow all the steps manually, or watch the recording

Review the docker compose environment​

As can be seen from docker-compose.yaml the demo environment consists of the following services:

  • gateway1
  • gateway2
  • kafka-client
  • kafka1
  • kafka2
  • kafka3
  • schema-registry
cat docker-compose.yaml

Starting the docker environment​

Start all your docker processes, wait for them to be up and ready, then run in background

  • --wait: Wait for services to be running|healthy. Implies detached mode.
  • --detach: Detached mode: Run containers in the background
docker compose up --detach --wait

Creating topic users on gateway1​

Creating on gateway1:

  • Topic users with partitions:1 and replication-factor:1
kafka-topics \
    --bootstrap-server localhost:6969 \
    --replication-factor 1 \
    --partitions 1 \
    --create --if-not-exists \
    --topic users

Listing topics in gateway1​

kafka-topics \
    --bootstrap-server localhost:6969 \
    --list

Adding interceptor client-id​

step-07-client-id-interceptor.json:

{
  "kind" : "Interceptor",
  "apiVersion" : "gateway/v2",
  "metadata" : {
    "name" : "client-id"
  },
  "spec" : {
    "comment" : "Adding interceptor: client-id",
    "pluginClass" : "io.conduktor.gateway.interceptor.safeguard.ClientIdRequiredPolicyPlugin",
    "priority" : 100,
    "config" : {
      "namingConvention" : "naming-convention-.*"
    }
  }
}
curl \
    --silent \
    --request PUT "http://localhost:8888/gateway/v2/interceptor" \
    --header "Content-Type: application/json" \
    --user "admin:conduktor" \
    --data @step-07-client-id-interceptor.json | jq

Listing interceptors​

Listing interceptors on gateway1

curl \
    --silent \
    --request GET "http://localhost:8888/gateway/v2/interceptor" \
    --user "admin:conduktor" | jq

Creating topic customers on gateway1​

Creating on gateway1:

  • Topic customers with partitions:1 and replication-factor:1
kafka-topics \
    --bootstrap-server localhost:6969 \
    --replication-factor 1 \
    --partitions 1 \
    --create --if-not-exists \
    --topic customers

[!IMPORTANT] We get the following exception

org.apache.kafka.common.errors.PolicyViolationException:
> Request parameters do not satisfy the configured policy. clientId 'adminclient-2' is invalid, naming convention must match with regular expression 'naming-convention-.*'

Let's update the client id to match the convention​

echo >> client.properties    
echo "client.id=naming-convention-for-this-application" >> client.properties

Creating topic customers on gateway1​

Creating on gateway1:

  • Topic customers with partitions:1 and replication-factor:1
kafka-topics \
    --bootstrap-server localhost:6969 \
    --command-config client.properties \
    --replication-factor 1 \
    --partitions 1 \
    --create --if-not-exists \
    --topic customers

Check in the audit log that produce was denied​

Check in the audit log that produce was denied in cluster kafka1

kafka-console-consumer \
    --bootstrap-server localhost:9092,localhost:9093,localhost:9094 \
    --topic _conduktor_gateway_auditlogs \
    --from-beginning \
    --timeout-ms 3000 \| jq 'select(.type=="SAFEGUARD" and .eventData.plugin=="io.conduktor.gateway.interceptor.safeguard.ClientIdRequiredPolicyPlugin")'

returns 1 event

{
  "id" : "96121d90-c50b-47fa-a9a4-3ea7216bcd97",
  "source" : "krn://cluster=p0KPFA_mQb2ixdPbQXPblw",
  "type" : "SAFEGUARD",
  "authenticationPrincipal" : "passthrough",
  "userName" : "anonymous",
  "connection" : {
    "localAddress" : null,
    "remoteAddress" : "/192.168.224.1:54240"
  },
  "specVersion" : "0.1.0",
  "time" : "2024-11-17T19:58:55.588787595Z",
  "eventData" : {
    "interceptorName" : "client-id",
    "level" : "error",
    "plugin" : "io.conduktor.gateway.interceptor.safeguard.ClientIdRequiredPolicyPlugin",
    "message" : "Request parameters do not satisfy the configured policy. clientId 'adminclient-2' is invalid, naming convention must match with regular expression 'naming-convention-.*'"
  }
}

Tearing down the docker environment​

Remove all your docker processes and associated volumes

  • --volumes: Remove named volumes declared in the "volumes" section of the Compose file and anonymous volumes attached to containers.
docker compose down --volumes

Conclusion

You can now make sure you have valid client id to help the right customers