Scenario 10.5.1 · ACLs: authorizing a producer
TopicAuthorizationException: authorizing a Kafka producer
The authorizer is deny-by-default: a producer with no ACL is denied (TopicAuthorizationException), then an ALLOW Write ACL lets the same principal produce.
Run this scenario in the playgroundAuthorization on · no ACLs. t+0.000s
The cluster has authorization enabled but an empty ACL set. Kafka's authorizer is deny-by-default: with no matching ALLOW rule, every operation is refused. Producer p1 authenticates as the principal App:orders-svc - an identity string, not a real SASL login.
Open at this step: step 1, Authorization on · no ACLsProduce denied (no ACL). t+1.000s
p1 tries to produce to orders. No ACL grants App:orders-svc the Write operation on this topic, so the broker rejects the request with TopicAuthorizationException before any record reaches the log. The producer goes to an error state and nothing is appended.
Open at this step: step 2, Produce denied (no ACL)ACL added: Write on orders. t+1.700s
An ALLOW ACL is added: principal App:orders-svc, operation Write, resource topic orders. This is the single rule the deny-by-default authorizer was waiting for - the authorization model now contains exactly one rule.
Open at this step: step 3, ACL added: Write on ordersSame producer now writes. t+2.300s
With the matching ALLOW ACL in place, the very same producer (same principal, no restart) produces successfully - the record is appended and acknowledged. Authorization changed the outcome; nothing else did.
Open at this step: step 4, Same producer now writesWhat you start with
Kafka's authorizer is deny-by-default: a request with no matching ACL is rejected. Here a producer with no ACL is denied with a TopicAuthorizationException, then an ALLOW Write ACL is added for that principal and the same produce succeeds.
Step by step
- Authorization on · no ACLs t+0.000s The cluster has authorization enabled but an empty ACL set. Kafka's authorizer is deny-by-default: with no matching ALLOW rule, every operation is refused. Producer p1 authenticates as the principal App:orders-svc - an identity string, not a real SASL login. Open at this step: step 1, Authorization on · no ACLs
- Produce denied (no ACL) t+1.000s p1 tries to produce to orders. No ACL grants App:orders-svc the Write operation on this topic, so the broker rejects the request with TopicAuthorizationException before any record reaches the log. The producer goes to an error state and nothing is appended. Open at this step: step 2, Produce denied (no ACL)
- ACL added: Write on orders t+1.700s An ALLOW ACL is added: principal App:orders-svc, operation Write, resource topic orders. This is the single rule the deny-by-default authorizer was waiting for - the authorization model now contains exactly one rule. Open at this step: step 3, ACL added: Write on orders
- Same producer now writes t+2.300s With the matching ALLOW ACL in place, the very same producer (same principal, no restart) produces successfully - the record is appended and acknowledged. Authorization changed the outcome; nothing else did. Open at this step: step 4, Same producer now writes
The takeaway
Access is granted by explicit ALLOW ACLs on a principal-and-resource - without one, even a correctly configured client cannot write, which is exactly what deny-by-default guarantees.
Embed this scenario
Paste this into a blog post, a course page or your team's docs. The scenario plays inside your page, and the link under it points readers to this walkthrough.
<iframe src="https://monedula.dev/kafka-simulator/embed/?scenario=10.5.1" title="Kafka Simulator: ACLs: authorizing a producer" width="100%" height="520" style="border:1px solid #d0d0d0;border-radius:8px" loading="lazy"></iframe>
<p><a href="https://monedula.dev/kafka-simulator/scenarios/acls-authorizing-a-producer/">TopicAuthorizationException: authorizing a Kafka producer</a></p>