// Module included in the following assemblies:
//
// assembly-kafka-authentication-and-authorization.adoc

[id='ref-kafka-authorization-{context}']
= Authorization

You can configure authorization for Kafka brokers using the `authorization` property in the `Kafka.spec.kafka` resource.
If the `authorization` property is missing, no authorization is enabled.
When enabled, authorization is applied to all enabled xref:assembly-configuring-kafka-broker-listeners-{context}[listeners].
The authorization method is defined in the `type` field.

You can configure:

* Simple authorization
* xref:assembly-oauth-authorization_str[{oauth} authorization] (if you are using {oauth} token based authentication)

== Simple authorization

Simple authorization in {ProductName} uses the `SimpleAclAuthorizer` plugin, the default Access Control Lists (ACLs) authorization plugin provided with Apache Kafka. ACLs allow you to define which users have access to which resources at a granular level.
To enable simple authorization, set the `type` field to `simple`.

.An example of Simple authorization
[source,yaml,subs="attributes+"]
----
# ...
authorization:
  type: simple
# ...
----

Access rules for users are xref:simple-acl-str[defined using Access Control Lists (ACLs)].
You can optionally designate a list of super users in the `superUsers` field.

[id='ref-kafka-authorization-super-user-{context}']
== Super users

Super users can access all resources in your Kafka cluster regardless of any access restrictions defined in ACLs.
To designate super users for a Kafka cluster, enter a list of user principles in the `superUsers` field.
If a user uses TLS Client Authentication, the username will be the common name from their certificate subject prefixed with `CN=`.

.An example of designating super users
[source,yaml,subs="attributes+"]
----
# ...
authorization:
  type: simple
  superUsers:
    - CN=fred
    - sam
    - CN=edward
# ...
----

NOTE: The `super.user` configuration option in the `config` property in `Kafka.spec.kafka` is ignored.
Designate super users in the `authorization` property instead.
For more information, see xref:ref-kafka-broker-configuration-{context}[Kafka broker configuration].
