[Audit] - Error when consuming records from audit topic __kui-audit-log

[smahroug]

Issue submitter TODO list

• I've looked up my issue in FAQ
• I've searched for an already existing issues here
• I've tried running main-labeled docker image and the issue still persists there
• I'm running a supported version of the application which is listed here

Describe the bug (actual behavior)

I activated the audit feature. The audit logs are produced in the topic : __kui-audit-log
Here the config :

kafka:
  clusters:
    - name: LAB
      audit:
        topic-audit-enabled: true
        console-audit-enabled: true
        topic: '__kui-audit-log' # default name
        audit-topic-properties: # any kafka topic properties in format of a map
          - retention.ms: 43200000
        audit-topics-partitions: 1 # how many partitions, default is 1
        level: all # either ALL or ALTER_ONLY (default). ALL will log all read operations.

Permissions are set to be able to read from all the topics starting with "_"

 - resource: topic
          value: "_*"
          actions:
            - VIEW # can be upper or lower case
            - CREATE
            - EDIT
            - DELETE
            - MESSAGES_READ
            - MESSAGES_PRODUCE
            - MESSAGES_DELETE

Server error appears :

Expected behavior

I expect that audit records can be consumed by Kafka UI __kui-audit-log

Your installation details

1 - app version : 1.0.0 [https://github.com/kafbat/kafka-ui/commit/2956664bd712266f7340659dc9fbb83e6f3f1923]

Steps to reproduce

Activate the audit feature and display the records in :

Screenshots

No response

Logs

155478 [parallel-1] INFO  audit - {"timestamp":"2024-04-09T09:37:47.553857498Z","username":"xxxxxxxxx","clusterName":"DEV","resources":[{"type":"TOPIC","id":"A-TOPIC-FOR-TESTS-v0.1","alter":false,"accessType":["VIEW"]}],"operation":"getTopicDetails","result":{"success":true}}
155483 [reactor-http-epoll-4] INFO  audit - {"timestamp":"2024-04-09T09:37:47.559365355Z","username":"xxxxxxxxx","clusterName":"LAB","resources":[{"type":"TOPIC","id":"__kui-audit-log","alter":false,"accessType":["MESSAGES_READ"]},{"type":"AUDIT","alter":false,"accessType":["VIEW"]}],"operation":"getTopicMessages","result":{"success":false,"error":"ACCESS_DENIED"}}
156495 [reactor-http-epoll-1] INFO  audit - {"timestamp":"2024-04-09T09:37:48.571260932Z","username":"xxxxxxxxx","clusterName":"LAB","resources":[{"type":"TOPIC","id":"__kui-audit-log","alter":false,"accessType":["MESSAGES_READ"]},{"type":"AUDIT","alter":false,"accessType":["VIEW"]}],"operation":"getTopicMessages","result":{"success":false,"error":"ACCESS_DENIED"}}
156639 [reactor-http-epoll-4] ERROR o.s.b.a.w.r.e.AbstractErrorWebExceptionHandler - [bcf6b1bf-103]  500 Server Error for HTTP GET "/api/clusters/DEV/topics/A-TOPIC-FOR-TESTS-v0.1/messages/v2?limit=100&mode="
java.lang.NullPointerException: null
        at com.google.common.base.Preconditions.checkNotNull(Preconditions.java:903)
        Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
Error has been observed at the following site(s):
        *__checkpoint ⇢ io.kafbat.ui.config.CorsGlobalConfiguration$$Lambda$1330/0x0000000100930680 [DefaultWebFilterChain]
        *__checkpoint ⇢ io.kafbat.ui.config.CustomWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ io.kafbat.ui.config.ReadOnlyModeFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ AuthorizationWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ ExceptionTranslationWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ LogoutWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ ServerRequestCacheWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ SecurityContextServerWebExchangeWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ LogoutPageGeneratingWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ LoginPageGeneratingWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ OAuth2LoginAuthenticationWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ OAuth2AuthorizationRequestRedirectWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ ReactorContextWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ HttpHeaderWriterWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ org.springframework.security.web.server.WebFilterChainProxy [DefaultWebFilterChain]
        *__checkpoint ⇢ org.springframework.web.filter.reactive.ServerHttpObservationFilter [DefaultWebFilterChain]
        *__checkpoint ⇢ HTTP GET "/api/clusters/DEV/topics/A-TOPIC-FOR-TESTS-v0.1/messa

Additional context

"operation":"getTopicMessages","result":{"success":false,"error":"ACCESS_DENIED"}

getTopicMessages is normaly guaranteed by permission MESSAGES_READ on the resource topic value: "_*"

[smahroug]

RBAC documentation didn't say anything about special permission for the audit topic.

[Haarolean]

RBAC documentation didn't say anything about special permission for the audit topic.

yep there are none, it's rather a bug :) we'll fix this within current release

[Haarolean]

Duplicate of #253