// Module included in the following assemblies:
//
// assembly-securing-access.adoc

[id='con-securing-kafka-authorization-{context}']
= Kafka authorization

[role="_abstract"]
Configure authorization for Kafka brokers using the `Kafka.spec.kafka.authorization` property in the `Kafka` resource.
If the `authorization` property is missing, no authorization is enabled and clients have no restrictions.
When enabled, authorization is applied to all enabled listeners.
The authorization method is defined in the `type` field.

Supported authorization options:

* link:{BookURLConfiguring}#type-KafkaAuthorizationSimple-reference[Simple authorization]
* xref:assembly-oauth-authorization_str[OAuth 2.0 authorization] (if you are using OAuth 2.0 token based authentication)
* link:{BookURLConfiguring}#type-KafkaAuthorizationOpa-reference[Open Policy Agent (OPA) authorization]
* link:{BookURLConfiguring}#type-KafkaAuthorizationCustom-reference[Custom authorization]

.Kafka cluster authorization options
image::kafka-authorization-config-options.png[options for kafka authorization configuration]

== Super users

Super users can access all resources in your Kafka cluster regardless of any access restrictions,
and are supported by all authorization mechanisms.

To designate super users for a Kafka cluster, add a list of user principals to the `superUsers` property.
If a user uses mTLS authentication, the username is the common name from the TLS certificate subject prefixed with `CN=`.
If you are not using the User Operator and using your own certificates for mTLS, the username is the full certificate subject.
A full certificate subject can have the following fields: `CN=user,OU=my_ou,O=my_org,L=my_location,ST=my_state,C=my_country_code`. 
Omit any fields that are not present.

.An example configuration with super users
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
metadata:
  name: my-cluster
  namespace: myproject
spec:
  kafka:
    # ...
    authorization:
      type: simple
      superUsers:
        - CN=client_1
        - user_2
        - CN=client_3
        - CN=client_4,OU=my_ou,O=my_org,L=my_location,ST=my_state,C=US
        - CN=client_5,OU=my_ou,O=my_org,C=GB
        - CN=client_6,O=my_org
    # ...
----
