Kafka issue: group-based permission ineffective for topic metadata access control

[cdanger]

Group-based permission does not work for topic metadata/offset access control with Kafka Java-based clients.

Affects Kafka 2.0.0.

Behavior: when calling poll(...) method, Java KafkaConsumer instances use DESCRIBE operation on topics to fetch topic metadata, before joining their consumer group (READ GROUP X) and before reading topic data. Therefore, the Authorizer is unable to know the consumer group ID at this point, and therefore unable to use group-based permissions for controlling access to the topic metadata. (It works as expected for topic data because the Kafka client joins its consumer group before reading the data.)

TODO:

• Report this security limitation to Kafka developers