// This assembly is included in the following assemblies:
//
// assembly-deployment-configuration.adoc

[id='assembly-oauth-authentication_{context}']
= Using {oauth} token-based authentication

{ProductName} supports the use of {oauth} authentication using the _SASL OAUTHBEARER_ mechanism.

{oauth} enables standardized token-based authentication and authorization between applications, using a central authorization server to issue tokens that grant limited access to resources.

You can configure {oauth} authentication, then xref:assembly-oauth-authorization_{context}[{oauth} authorization].
{oauth} authentication can also be used in conjunction with xref:simple-acl-{context}[ACL-based Kafka authorization].

Using {oauth} token-based authentication, application clients can access resources on application servers (called _resource servers_) without exposing account credentials.

The application client passes an access token as a means of authenticating, which application servers can also use to determine the level of access to grant.
The authorization server handles the granting of access and inquiries about access.

In the context of {ProductName}:

* Kafka brokers act as {oauth} resource servers
* Kafka clients act as {oauth} application clients

Kafka clients authenticate to Kafka brokers.
The brokers and clients communicate with the {oauth} authorization server, as necessary, to obtain or validate access tokens.

For a deployment of {ProductName}, {oauth} integration provides:

* Server-side {oauth} support for Kafka brokers
* Client-side {oauth} support for Kafka MirrorMaker, Kafka Connect and the Kafka Bridge

.Additional resources

* {oauth2-site}

include::modules/con-oauth-authentication-flow.adoc[leveloffset=+1]
include::modules/con-oauth-authentication-broker.adoc[leveloffset=+1]
include::modules/con-oauth-authentication-client.adoc[leveloffset=+1]
include::modules/con-oauth-authentication-client-options.adoc[leveloffset=+1]
include::modules/con-oauth-config.adoc[leveloffset=+1]
include::modules/con-oauth-server-examples.adoc[leveloffset=+1]
