// This assembly is included in the following assemblies:
//
// assembly-deployment-configuration-kafka-connect.adoc
// assembly-deployment-configuration-kafka-connect-s2i.adoc

[id='assembly-kafka-connect-authorization-{context}']

= Kafka Connect user authorization

If authorization is enabled for Kafka Connect, the Kafka Connect user must be configured to provide read/write access rights to the Kafka Connect consumer group and
internal topics.

The properties for the consumer group and internal topics are automatically configured by {ProductName}, or they can be specified explicitly in the `spec` for the `KafkaConnect` or `KafkaConnectS2I` configuration.

The following example shows the configuration of the properties in the `KafkaConnect` resource, which need to be represented in the Kafka Connect user configuration.

[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaConnect
metadata:
  name: my-connect
spec:
  # ...
  config:
    group.id: my-connect-cluster <1>
    offset.storage.topic: my-connect-cluster-offsets <2>
    config.storage.topic: my-connect-cluster-configs <3>
    status.storage.topic: my-connect-cluster-status <4>
    # ...
  # ...
----
<1> Kafka Connect cluster group that the instance belongs to.
<2> Kafka topic that stores connector offsets.
<3> Kafka topic that stores connector and task status configurations.
<4> Kafka topic that stores connector and task status updates.

include::../modules/proc-configuring-kafka-connect-user-authorization.adoc[leveloffset=+1]
