To configure OAuth client authentication, set the `type` property to `oauth`.

OAuth authentication can be configured using one of the following options:

* Client ID and secret
* Client ID and refresh token
* Access token
* TLS

.Client ID and secret
You can configure the address of your authorization server in the `tokenEndpointUri` property together with the client ID and client secret used in authentication.
The OAuth client will connect to the OAuth server, authenticate using the client ID and secret and get an access token which it will use to authenticate with the Kafka broker.
In the `clientSecret` property, specify a link to a `Secret` containing the client secret.

.An example of OAuth client authentication using client ID and client secret
[source,yaml,subs=attributes+]
----
authentication:
  type: oauth
  tokenEndpointUri: https://sso.myproject.svc:8443/auth/realms/internal/protocol/openid-connect/token
  clientId: my-client-id
  clientSecret:
    secretName: my-client-oauth-secret
    key: client-secret
----

Optionally, `scope` and `audience` can be specified if needed.

.Client ID and refresh token
You can configure the address of your OAuth server in the `tokenEndpointUri` property together with the OAuth client ID and refresh token.
The OAuth client will connect to the OAuth server, authenticate using the client ID and refresh token and get an access token which it will use to authenticate with the Kafka broker.
In the `refreshToken` property, specify a link to a `Secret` containing the refresh token.
+
.An example of OAuth client authentication using client ID and refresh token
[source,yaml,subs=attributes+]
----
authentication:
  type: oauth
  tokenEndpointUri: https://sso.myproject.svc:8443/auth/realms/internal/protocol/openid-connect/token
  clientId: my-client-id
  refreshToken:
    secretName: my-refresh-token-secret
    key: refresh-token
----

.Access token
You can configure the access token used for authentication with the Kafka broker directly.
In this case, you do not specify the `tokenEndpointUri`.
In the `accessToken` property, specify a link to a `Secret` containing the access token.

.An example of OAuth client authentication using only an access token
[source,yaml,subs=attributes+]
----
authentication:
  type: oauth
  accessToken:
    secretName: my-access-token-secret
    key: access-token
----

.TLS
Accessing the OAuth server using the HTTPS protocol does not require any additional configuration as long as the TLS certificates used by it are signed by a trusted certification authority and its hostname is listed in the certificate.

If your OAuth server is using certificates which are self-signed or are signed by a certification authority which is not trusted, you can configure a list of trusted certificates in the custom resource.
The `tlsTrustedCertificates` property contains a list of secrets with key names under which the certificates are stored.
The certificates must be stored in X509 format.

.An example of TLS certificates provided
[source,yaml,subs=attributes+]
----
authentication:
  type: oauth
  tokenEndpointUri: https://sso.myproject.svc:8443/auth/realms/internal/protocol/openid-connect/token
  clientId: my-client-id
  refreshToken:
    secretName: my-refresh-token-secret
    key: refresh-token
  tlsTrustedCertificates:
    - secretName: oauth-server-ca
      certificate: tls.crt
----

The OAuth client will by default verify that the hostname of your OAuth server matches either the certificate subject or one of the alternative DNS names.
If it is not required, you can disable the hostname verification.

.An example of disabled TLS hostname verification
[source,yaml,subs=attributes+]
----
authentication:
  type: oauth
  tokenEndpointUri: https://sso.myproject.svc:8443/auth/realms/internal/protocol/openid-connect/token
  clientId: my-client-id
  refreshToken:
    secretName: my-refresh-token-secret
    key: refresh-token
  disableTlsHostnameVerification: true
----
