// Module included in the following assemblies:
//
// assembly-using-the-user-operator.adoc

[id='proc-configuring-secure-kafka-user-{context}']
= Securing user access to Kafka

[role="_abstract"]
Create or modify a `KafkaUser` to represent a client that requires secure access to the Kafka cluster.

When you configure the `KafkaUser` authentication and authorization mechanisms, ensure they match the equivalent `Kafka` configuration:

* `KafkaUser.spec.authentication` matches `Kafka.spec.kafka.listeners[*].authentication`
* `KafkaUser.spec.authorization` matches `Kafka.spec.kafka.authorization`

This procedure shows how a user is created with mTLS authentication.
You can also create a user with SCRAM-SHA authentication.

The authentication required depends on the xref:con-securing-kafka-authentication-{context}[type of authentication configured for the Kafka broker listener].

NOTE: Authentication between Kafka users and Kafka brokers depends on the authentication settings for each.
For example, it is not possible to authenticate a user with mTLS if it is not also enabled in the Kafka configuration.

.Prerequisites

* A running Kafka cluster xref:con-mutual-tls-authentication-{context}[configured with a Kafka broker listener using mTLS authentication and TLS encryption].
* A running User Operator (typically deployed with the Entity Operator).

The authentication type in `KafkaUser` should match the authentication configured in `Kafka` brokers.

.Procedure

. Configure the `KafkaUser` resource.
+
For example:
+
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaUserApiVersion}
kind: KafkaUser
metadata:
  name: my-user
  labels:
    strimzi.io/cluster: my-cluster
spec:
  authentication: <1>
    type: tls
  authorization:
    type: simple <2>
    acls:
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operations:
          - Describe
          - Read
      - resource:
          type: group
          name: my-group
          patternType: literal
        operations:
          - Read
----
<1> User authentication mechanism, defined as mutual `tls` or `scram-sha-512`.
<2> Simple authorization, which requires an accompanying list of ACL rules.

. Create or update the `KafkaUser` resource.
+
[source,shell,subs=+quotes]
kubectl apply -f _<user_config_file>_
+
The user is created, as well as a Secret with the same name as the `KafkaUser` resource.
The Secret contains a private and public key for mTLS authentication.

For information on configuring a Kafka client with properties for secure connection to Kafka brokers, see xref:setup-external-clients-str[].
