// Module included in the following assemblies:
//
// assembly-oauth-authorization.adoc

[id='con-oauth-authorization-intro_{context}']
If you are using OAuth 2.0 with Keycloak for token-based authentication,
you can also use Keycloak to configure authorization rules to constrain client access to Kafka brokers.
Authentication establishes the identity of a user.
Authorization decides the level of access for that user.

Strimzi supports the use of OAuth 2.0 token-based authorization through Keycloak {keycloak-authorization-services},
which allows you to manage security policies and permissions centrally.

Security policies and permissions defined in Keycloak are used to grant access to resources on Kafka brokers.
Users and clients are matched against policies that permit access to perform specific actions on Kafka brokers.

Kafka allows all users full access to brokers by default,
and also provides the `AclAuthorizer` and `StandardAuthorizer` plugins to configure authorization based on Access Control Lists (ACLs).
The ACL rules managed by these plugins are used to grant or deny access to resources based on the _username_, and these rules are stored within the Kafka cluster itself.
However, OAuth 2.0 token-based authorization with Keycloak offers far greater flexibility on how you wish to implement access control to Kafka brokers.
In addition, you can configure your Kafka brokers to use OAuth 2.0 authorization and ACLs.

[role="_additional-resources"]
.Additional resources

* xref:assembly-oauth-authentication_str[Using OAuth 2.0 token-based authentication]
* xref:con-securing-kafka-authorization-{context}[Kafka Authorization]
* {keycloak-server-doc}
