<commit_before>![image](../../images/confluent-logo-300-2.png)

# Overview

This demo showcases the [Role Based Access Control (RBAC)](https://docs.confluent.io/current/security/rbac/index.html) functionality in Confluent Platform. It is mostly for reference to see a workflow using the new RBAC feature across the services in Confluent Platform.

## Notes

* For simplicity, this demo does not require the use of LDAP. Instead it uses the Hash Login service with statically defined users/passwords

# Run the demo

## Prerequisites

1. [Confluent CLI](https://docs.confluent.io/current/cli/installing.html): `confluent` CLI must be installed on your machine, version `v0.127.0` or higher (note: as of CP 5.3, the Confluent CLI is a separate [download](https://docs.confluent.io/current/cli/installing.html))
2. [Confluent Platform 5.3](https://www.confluent.io/download/): use a clean install of Confluent Platform without modified properties files, or else the demo is not guaranteed to work
3. `jq`

## Execute the demo

1. Change directory into the `scripts` folder:

```bash
$ cd scripts
```

2. You have two options to run the demo.

* Option 1: run the demo end-to-end for all services

```bash
$ ./run.sh
```

* Option 2: step through it one service at a time

```bash
$ ./init.sh
$ ./enable-rbac-broker.sh
$ ./enable-rbac-schema-registry.sh
$ ./enable-rbac-connect.sh
$ ./enable-rbac-rest-proxy.sh
```

3. After you run the demo, view the configuration files:

```bash
# The original configuration bundled with Confluent Platform
$ ls /tmp/original_configs/

# Configurations added to each service's properties file
$ ls ../delta_configs/

# The modified configuration = original + delta
$ ls /tmp/rbac_configs/
```

4. After you run the demo, view the log files for each of the services. Since this demo uses Confluent CLI, all logs are saved in a temporary directory specified by `confluent local current`.

```bash
$ ls `confluent local current | tail -1`
connect
kafka
kafka-rest
schema-registry
zookeeper
```

5. In this demo, the metadata service (MDS) logs are saved in the above temporary directory.

```bash
$ cat `confluent local current | tail -1`/kafka/logs/metadata-service.log
```

## Stop the demo

To stop the demo, stop Confluent Platform, and delete files in `/tmp/`

```bash
$ cd scripts
$ ./cleanup.sh
```

# Summary of Configurations and Role Bindings

Here is a summary of the delta configurations and required role bindings, by service.

Reminder: for simplicity, this demo uses the Hash Login service instead of LDAP.<commit_msg>Tweak README, add ksql-server into command output<commit_after>![image](../../images/confluent-logo-300-2.png)

# Overview

This demo showcases the [Role Based Access Control (RBAC)](https://docs.confluent.io/current/security/rbac/index.html) functionality in Confluent Platform. It is mostly for reference to see a workflow using the new RBAC feature across the services in Confluent Platform.

## Notes

* For simplicity, this demo does not require the use of LDAP. Instead it uses the Hash Login service with statically defined users/passwords

# Run the demo

## Prerequisites

1. [Confluent CLI](https://docs.confluent.io/current/cli/installing.html): `confluent` CLI must be installed on your machine, version `v0.127.0` or higher (note: as of CP 5.3, the Confluent CLI is a separate [download](https://docs.confluent.io/current/cli/installing.html))
2. [Confluent Platform 5.3](https://www.confluent.io/download/): use a clean install of Confluent Platform without modified properties files, or else the demo is not guaranteed to work
3. `jq`

## Execute the demo

1. Change directory into the `scripts` folder:

```bash
$ cd scripts
```

2. You have two options to run the demo.

* Option 1: run the demo end-to-end for all services

```bash
$ ./run.sh
```

* Option 2: step through it one service at a time

```bash
$ ./init.sh
$ ./enable-rbac-broker.sh
$ ./enable-rbac-schema-registry.sh
$ ./enable-rbac-connect.sh
$ ./enable-rbac-rest-proxy.sh
$ ./enable-rbac-ksql-server.sh
```

3. After you run the demo, view the configuration files:

```bash
# The original configuration bundled with Confluent Platform
$ ls /tmp/original_configs/

# Configurations added to each service's properties file
$ ls ../delta_configs/

# The modified configuration = original + delta
$ ls /tmp/rbac_configs/
```

4. After you run the demo, view the log files for each of the services. Since this demo uses Confluent CLI, all logs are saved in a temporary directory specified by `confluent local current`.

```bash
$ ls `confluent local current | tail -1`
connect
kafka
kafka-rest
ksql-server
schema-registry
zookeeper
```

5. In this demo, the metadata service (MDS) logs are saved in the above temporary directory.

```bash
$ cat `confluent local current | tail -1`/kafka/logs/metadata-service.log
```

## Stop the demo

To stop the demo, stop Confluent Platform, and delete files in `/tmp/`

```bash
$ cd scripts
$ ./cleanup.sh
```

# Summary of Configurations and Role Bindings

Here is a summary of the delta configurations and required role bindings, by service.

Reminder: for simplicity, this demo uses the Hash Login service instead of LDAP.
{'fraction_non_alphanumeric': 0.10417067076686527, 'fraction_numerical': 0.009609840476648087, 'mean_word_length': 4.062256809338521, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 8, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3065149', 'n_tokens_mistral': 1643, 'n_tokens_neox': 1548, 'n_words': 649}