// Module included in the following assemblies:
//
// assembly-oauth-authorization.adoc

[id='con-oauth-authorization-mechanism_{context}']
= {oauth} authorization mechanism

{oauth} authorization in {ProductName} uses {keycloak-server} server Authorization Services REST endpoints to extend token-based authentication with {keycloak-server} by applying defined security policies on a particular user,
and providing a list of permissions granted on different resources for that user.
Policies use roles and groups to match permissions to users.
{oauth} authorization enforces permissions locally based on the received list of grants for the user from {keycloak-server} Authorization Services.

== Kafka broker custom authorizer

A {keycloak-server} _authorizer_ (`KeycloakRBACAuthorizer`) is provided with {ProductName}.
To be able to use the {keycloak-server} REST endpoints for Authorization Services provided by {keycloak-server},
you configure a custom authorizer on the Kafka broker.

The authorizer fetches a list of granted permissions from the authorization server as needed,
and enforces authorization locally on the Kafka Broker, making rapid authorization decisions for each client request.
