CORE-15456 Support Group ACLs in Schema Registry by michael-redpanda · Pull Request #29476 · redpanda-data/redpanda

michael-redpanda · 2026-01-30T20:15:46Z

Enable Group principal support for Schema Registry ACLs with comprehensive testing.

This PR ensures that Group-based ACLs work correctly for enterprise customers with the group_based_authorization feature enabled. It includes a bug fix, extensive C++ unit tests, and Python integration tests for end-to-end validation.

Backports Required

Release Notes

none

Copilot

Pull request overview

This PR enables Group principal support for Schema Registry ACLs, allowing enterprise customers with the group_based_authorization feature to use Group-based ACLs. The change includes a bug fix in the C++ ACL parsing logic and comprehensive test coverage.

Changes:

Fixed from_string_view<principal_type> to correctly parse "group" principal type
Added C++ unit tests for Group principal parsing, authorization, and DENY precedence
Added Python integration tests covering Group ACL creation, querying, deletion, validation, mixed User/Group scenarios, and scale testing

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/v/security/acl.cc	Added missing "group" case to principal type parser
src/v/security/tests/authorizer_test.cc	Added comprehensive C++ unit tests for Group principal functionality
tests/rptest/tests/schema_registry_test.py	Added Python integration tests for Group ACL operations in Schema Registry
src/go/rpk/go.mod	Updated dependency versions for rpadmin and rpsr libraries

michael-redpanda · 2026-01-30T20:23:35Z

Force push:

FOrgot to run go mod tidy

michael-redpanda · 2026-01-30T20:25:14Z

Force push:

Addressed bot comment

Copilot

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Copilot · 2026-01-30T20:26:00Z

+        wildcard_group_acl = [self._create_test_acl(principal="Group:*")]
+        response = self.sr_client.post_security_acls(wildcard_group_acl)


Variable name wildcard_group_acl should be plural wildcard_group_acls since it contains a list of ACLs, for consistency with other test methods like group_acls, mixed_acls, and acls.

Suggested change

wildcard_group_acl = [self._create_test_acl(principal="Group:*")]

response = self.sr_client.post_security_acls(wildcard_group_acl)

wildcard_group_acls = [self._create_test_acl(principal="Group:*")]

response = self.sr_client.post_security_acls(wildcard_group_acls)

Copilot · 2026-01-30T20:26:01Z

+        empty_group_acl = [self._create_test_acl(principal="Group:")]
+        response = self.sr_client.post_security_acls(empty_group_acl)


Variable name empty_group_acl should be plural empty_group_acls since it contains a list of ACLs, for consistency with other test methods.

Suggested change

empty_group_acl = [self._create_test_acl(principal="Group:")]

response = self.sr_client.post_security_acls(empty_group_acl)

empty_group_acls = [self._create_test_acl(principal="Group:")]

response = self.sr_client.post_security_acls(empty_group_acls)

vbotbuildovich · 2026-01-30T21:45:34Z

CI test results

test results on build#79910

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason	test_history
QuotaManagementUpgradeTest	test_upgrade	null	integration	https://buildkite.com/redpanda/redpanda/builds/79910#019c10a4-10e8-4500-b9cb-eebb953b3b01	FLAKY	28/31	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0274, p0=0.1982, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.4114, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=QuotaManagementUpgradeTest&test_method=test_upgrade

test results on build#79953

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason	test_history
ShadowLinkingReplicationTests	test_with_restart	null	integration	https://buildkite.com/redpanda/redpanda/builds/79953#019c1eed-4817-41e9-9e11-b66c5f5d3344	FLAKY	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0051, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3487, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=ShadowLinkingReplicationTests&test_method=test_with_restart
ScalingUpTest	test_moves_with_local_retention	{"use_topic_property": true}	integration	https://buildkite.com/redpanda/redpanda/builds/79953#019c1eef-cb40-43cc-bd34-492954cb774a	FLAKY	28/31	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0178, p0=0.0992, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.4114, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=ScalingUpTest&test_method=test_moves_with_local_retention

pgellert

lgtm, the main question I left is if we should move the scale test away from per-PR CI runs

pgellert · 2026-02-02T11:29:32Z

+
+    @cluster(num_nodes=3)
+    @matrix(scale=[1, 100])
+    def test_group_acl_scale(self, scale):


How quick is this scale test? I'm wondering if it should go into the schema_registry_scale_test.py, which doesn't run on every CI run, but only in the nightly CDT I think.

This runs very quickly

- Fix missing group mapping in from_string_view<principal_type> - Add C++ tests for group principal parsing and authorization - Add Python integration tests for Schema Registry group ACL operations This ensures group-based ACLs work correctly for enterprise customers with the group_based_authorization feature enabled. Signed-off-by: Michael Boquard <michael@redpanda.com>

Update rpsr to v0.1.3 which permits Group principal ACL creation for Schema Registry ACLs. Signed-off-by: Michael Boquard <michael@redpanda.com>

michael-redpanda · 2026-02-02T15:03:01Z

Force push:

Addressed PR comments

Copilot

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Copilot · 2026-02-02T15:03:24Z

+            assert acl["principal"].startswith("Group:team_"), (
+                f"Unexpected principal: {acl['principal']}"


Use self.assert_true() instead of assert for consistency with the rest of the test suite and to ensure proper test framework error reporting.

Suggested change

assert acl["principal"].startswith("Group:team_"), (

f"Unexpected principal: {acl['principal']}"

self.assert_true(

acl["principal"].startswith("Group:team_"),

f"Unexpected principal: {acl['principal']}",

Copilot · 2026-02-02T15:03:25Z

+    EXPECT_THROW(acl_principal::from_string("Group:*"), acl_conversion_error);
+
+    // Test empty group name throws
+    EXPECT_THROW(acl_principal::from_string("Group:"), std::exception);


Consider using a more specific exception type (e.g., acl_conversion_error) instead of the generic std::exception for consistency with the wildcard test on line 3253.

Suggested change

EXPECT_THROW(acl_principal::from_string("Group:"), std::exception);

EXPECT_THROW(acl_principal::from_string("Group:"), acl_conversion_error);

michael-redpanda · 2026-02-02T17:42:53Z

There's something wrong with the license checks here (https://redpandadata.slack.com/archives/C02PGU02EMR/p1767675745170899). Another PR (#29153) also had this problem, but I guess we can bypass it and it shouldn't block future PRs.

Copilot AI review requested due to automatic review settings January 30, 2026 20:15

michael-redpanda requested review from a team, kbatuigas and r-vasquez as code owners January 30, 2026 20:15

github-actions Bot added area/rpk area/redpanda labels Jan 30, 2026

michael-redpanda requested review from nguyen-andrew and pgellert January 30, 2026 20:16

michael-redpanda self-assigned this Jan 30, 2026

Copilot AI reviewed Jan 30, 2026

View reviewed changes

Comment thread tests/rptest/tests/schema_registry_test.py Outdated

Comment thread tests/rptest/tests/schema_registry_test.py

michael-redpanda force-pushed the gbac/core-15456-sr-acl branch from 8344852 to 25943fe Compare January 30, 2026 20:23

michael-redpanda force-pushed the gbac/core-15456-sr-acl branch from 25943fe to 22403ec Compare January 30, 2026 20:25

michael-redpanda requested a review from Copilot January 30, 2026 20:25

Copilot AI reviewed Jan 30, 2026

View reviewed changes

r-vasquez requested a review from graham-rp January 30, 2026 21:46

pgellert previously approved these changes Feb 2, 2026

View reviewed changes

michael-redpanda added 2 commits February 2, 2026 10:02

rpk: update rpsr to support Group ACL creation

859e768

Update rpsr to v0.1.3 which permits Group principal ACL creation for Schema Registry ACLs. Signed-off-by: Michael Boquard <michael@redpanda.com>

michael-redpanda dismissed pgellert’s stale review via 859e768 February 2, 2026 15:02

michael-redpanda force-pushed the gbac/core-15456-sr-acl branch from 22403ec to 859e768 Compare February 2, 2026 15:02

michael-redpanda requested review from Copilot and pgellert February 2, 2026 15:02

Copilot AI reviewed Feb 2, 2026

View reviewed changes

pgellert approved these changes Feb 2, 2026

View reviewed changes

michael-redpanda merged commit 267115c into redpanda-data:dev Feb 2, 2026
25 of 29 checks passed

		wildcard_group_acl = [self._create_test_acl(principal="Group:*")]
		response = self.sr_client.post_security_acls(wildcard_group_acl)

		empty_group_acl = [self._create_test_acl(principal="Group:")]
		response = self.sr_client.post_security_acls(empty_group_acl)

		assert acl["principal"].startswith("Group:team_"), (
		f"Unexpected principal: {acl['principal']}"

	EXPECT_THROW(acl_principal::from_string("Group:"), std::exception);
	EXPECT_THROW(acl_principal::from_string("Group:"), acl_conversion_error);

Conversation

michael-redpanda commented Jan 30, 2026

Backports Required

Release Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

michael-redpanda commented Jan 30, 2026

Uh oh!

michael-redpanda commented Jan 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

vbotbuildovich commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI test results

Uh oh!

pgellert left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pgellert Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

michael-redpanda Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

michael-redpanda commented Feb 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

michael-redpanda commented Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vbotbuildovich commented Jan 30, 2026 •

edited

Loading