// Module included in the following assemblies:
//
// assembly-securing-access.adoc

[id='con-securing-kafka-authorization-{context}']
= Configuring authorized access to Kafka

[role="_abstract"]
Configure authorized access to a Kafka cluster using the `Kafka.spec.kafka.authorization` property in the `Kafka` resource.
If the `authorization` property is missing, no authorization is enabled and clients have no restrictions.
When enabled, authorization is applied to all enabled listeners.
The authorization method is defined in the `type` field.

Supported authorization options:

* link:{BookURLConfiguring}#type-KafkaAuthorizationSimple-reference[Simple authorization]
* xref:assembly-oauth-authorization_str[OAuth 2.0 authorization] (if you are using OAuth 2.0 token based authentication)
* link:{BookURLConfiguring}#type-KafkaAuthorizationOpa-reference[Open Policy Agent (OPA) authorization]
* link:{BookURLConfiguring}#type-KafkaAuthorizationCustom-reference[Custom authorization]

.Kafka cluster authorization options
image::kafka-authorization-config-options.png[options for kafka authorization configuration]

== Designating super users

Super users can access all resources in your Kafka cluster regardless of any access restrictions,
and are supported by all authorization mechanisms.

To designate super users for a Kafka cluster, add a list of user principals to the `superUsers` property.
If a user uses mTLS authentication, the username is the common name from the TLS certificate subject prefixed with `CN=`.
If you are not using the User Operator and using your own certificates for mTLS, the username is the full certificate subject.

A full certificate subject can include the following fields: 

* `CN=<common_name>`
* `OU=<organizational_unit>`
* `O=<organization>` 
* `L=<locality>`
* `ST=<state>`
* `C=<country_code>` 

Omit any fields that are not applicable.

.An example configuration with super users
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
metadata:
  name: my-cluster
  namespace: myproject
spec:
  kafka:
    # ...
    authorization:
      type: simple
      superUsers:
        - CN=user-1
        - user-2
        - CN=user-3
        - CN=user-4,OU=my-ou,O=my-org,L=my-location,ST=my-state,C=US
        - CN=user-5,OU=my-ou,O=my-org,C=GB
        - CN=user-6,O=my-org
    # ...
----
