title: Is there a way to set up Kafka ACL to allow using any consumer group without listing them
body: <p>I am trying to set up Kafka, where each user have several topics, but each topic may be consumed with any number of consumer group by the user the topic belongs to.</p>
  
  <p><strong>Kafka server version used</strong>: kafka_2.12-2.4.0 (Commit:77a89fcf8d7fa018)</p>
  
  <p><strong>Kafka client version used</strong>: confluent kafka 1.2.2</p>
  
  <p>In Kafka ACL have successfully configured users, so they can only access only their own topic. I'm struggling to set up group permissions in such a way where each user can use any number of consumer groups just for their own topic without seeing what consumer groups others have.</p>
  
  <p>The following enables every user to use any consumer group:</p>
  
  <pre><code>bin/kafka-acls.sh localhost:9092 --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=zookeeper.address --add --allow-principal User:* --operation Read --group '*'
  </code></pre>
  
  <p>However, according to <a href="https://docs.confluent.io/current/kafka/authorization.html" rel="nofollow noreferrer">https://docs.confluent.io/current/kafka/authorization.html</a> Read operation implicitly grants Describe operation. As Describe operation includes access to 'ListGroup' API, which I do not want my users to be able to do, I executed the following:</p>
  
  <pre><code>bin/kafka-acls.sh localhost:9092 --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=zookeeper.address --add --deny-principal User:* --operation Describe --group '*'
  </code></pre>
  
  <p>The two commands above result in the following ACLs:</p>
  
  <pre><code>Current ACLs for resource `Group:LITERAL:*`:
          User:* has Deny permission for operations: Describe from hosts: *
          User:* has Allow permission for operations: Read from hosts: *
  </code></pre>
  
  <p>The problem with this is I'm getting the following exception:</p>
  
  <pre><code>Confluent.Kafka.ConsumeException: Broker: Group authorization failed
  </code></pre>
  
  <p>Which leads me to believe I'm either trying to achieve the impossible or trying it wrong.</p>
  
  <p><strong>TLDR</strong>: Is it possible to set up Kafka ACLs to allow using any consumer group without also granting ListGroups API permission at the same time?</p>
  
  <p>Thanks for any answer.</p>