// This assembly is included in the following assemblies:
//
// assembly-oauth-security.adoc

[id="assembly-managing-policies-permissions-keycloak-{context}"]
= Setting up permissions in Keycloak

[role="_abstract"]
When using Keycloak as the OAuth 2.0 authorization server, Kafka permissions are granted to user accounts or service accounts using authorization permissions.
To grant permissions to access Kafka, create an _OAuth client specification_ in Keycloak that maps the authorization models of Keycloak Authorization Services and Kafka.

include::../../modules/oauth/con-kafka-keycloak-authz-models.adoc[leveloffset=+1]
include::../../modules/oauth/con-mapping-keycloak-authz-services-to-kafka-model.adoc[leveloffset=+1]
include::../../modules/oauth/ref-example-permissions-for-kafka-operations.adoc[leveloffset=+1]
include::../../modules/oauth/proc-oauth-authorization-keycloak-example.adoc[leveloffset=+1]