// This assembly is included in the following assemblies:
//
// assembly-oauth-security.adoc

[id='proc-oauth-server-config-{context}']
= Configuring an OAuth 2.0 authorization server

[role="_abstract"]
Before you can use OAuth 2.0 token-based access, you must configure an authorization server for integration with Strimzi.
The steps are dependent on the chosen authorization server.
Consult the product documentation for the authorization server for information on how to set up OAuth 2.0 access.

Prepare the authorization server to work with Strimzi by defining _OAUth 2.0 clients_ for Kafka and each Kafka client component of your application.
In relation to the authorization server, the Kafka cluster and Kafka clients are both regarded as OAuth 2.0 clients.

In general, configure OAuth 2.0 clients in the authorization server with the following client credentials enabled:

* Client ID (for example, `kafka` for the Kafka cluster)
* Client ID and secret as the authentication mechanism

NOTE: You only need to use a client ID and secret when using a non-public introspection endpoint of the authorization server.
The credentials are not typically required when using public authorization server endpoints, as with fast local JWT token validation.
