// Module included in the following assemblies:
//
// overview/assembly-security-overview.adoc

[id="security-configuration-authentication_{context}"]
= Authentication
Kafka listeners use authentication to ensure a secure client connection to the Kafka cluster.

Supported authentication mechanisms:

* TLS client authentication
* SASL SCRAM-SHA-512
* {oauth} token based authentication

The User Operator manages user credentials for TLS and SCRAM authentication, but not {oauth}.
For example, through the User Operator you can create a user representing a client that requires access to the Kafka cluster, and specify TLS as the authentication type.

Using {oauth} token based authentication, application clients can access Kafka brokers without exposing account credentials.
An authorization server handles the granting of access and inquiries about access.
