User management and authorization

Add a user

1. Log on to the ApsaraMQ for Confluent console. In the left-side navigation pane, click Instances.

2. On the Instances page, click the name of the instance that you want to manage.

3. On the Instance Details page, in the left-side navigation pane, click User management.

4. On the User management page, click Add LDAP user.

5. In the Add LDAP user dialog box, set a username and password, confirm the password, and then click OK.

   Important

   Usernames must be unique. Any attempt to add a user with an existing name will fail.

Delete a user

1. In the Actions column for the user you want to delete, click Delete.

2. In the System prompt dialog box, read the message and click OK.

   Important

   Deleting a user revokes all their permissions and access to the instance.

ACL authorization

Use the Confluent command-line interface (CLI) for ACL authorization. For more information, see Manage ACLs by using the Confluent CLI.

RBAC authorization

You can configure RBAC authorization in two ways:

• Use the Control Center of Alibaba Cloud Message Queue for Confluent. This method is described below.

• Use the Confluent CLI. For more information, see Manage RBAC permissions by using the Confluent CLI.

1. Log on to the ApsaraMQ for Confluent console. In the left-side navigation pane, click Instances.

2. On the Instances page, click the name of the instance that you want to manage.

3. On the Instance Details page, click Log on to console in the upper-right corner. On the logon page, enter your username and password to access the Home page of the Control Center.

4. In the upper-right corner of the Home page, choose > Manage role assignments to open the RBAC authorization page.

5. The authorization page displays 10 built-in Confluent roles.

   Important

   You cannot create custom roles; you must use the built-in Confluent roles to assign permissions.

   

6. Click the Assignments tab, and then click the Cluster ID for the cluster that you want to manage.

   

7. Grant permissions to the user based on the Cluster type.

   Kafka cluster

   1. Click the Cluster ID of the Kafka cluster and grant permissions on the required resources, such as a Cluster, Group, Topic, or TransactionId. The following example shows how to grant the user test the ResourceOwner role on a Topic with the prefix demo.

      

   2. Click Add role assignment to open the role assignment details page. Configure the parameters as shown in the following figure, and then click Save.

      

   Connect cluster

   1. Click the Cluster ID of the Connect cluster and grant permissions for the required resource (Cluster or Connector). This example demonstrates how to grant the ClusterAdmin role for the Cluster resource to the user test.

      

   2. Click Add role assignment to open the role assignment details page. Configure the parameters as shown in the following figure, and then click Save.

      

   KSQL

   1. Click the Cluster ID of KSQL to authorize the required resource (Cluster). The following example shows how to grant the ResourceOwner role for a Cluster to the user test.

      

   2. Click Add role assignment to open the role assignment details page. Configure the parameters as shown in the following figure, and then click Save.

      

   Schema Registry

   1. Click the Cluster ID of Schema Registry and grant permissions for the required resource (Cluster or Subject). The following example shows how to grant the ResourceOwner role for all Subject resources to the user test.

      

   2. Click Add role assignment to open the role assignment details page. Configure the parameters as shown in the following figure, and then click Save.