[id="con-kafka-keycloak-authz-models_{context}"]
= Kafka and Keycloak authorization models overview

[role="_abstract"]

Kafka and Keycloak Authorization Services use different authorization models.

[discrete]
== Kafka authorization model

Kafka's authorization model uses _resource types_. 
When a Kafka client performs an action on a broker, the broker uses the configured `KeycloakAuthorizer` to check the client's permissions, based on the action and resource type.

Kafka uses five resource types to control access: `Topic`, `Group`, `Cluster`, `TransactionalId`, and `DelegationToken`.
Each resource type has a set of available permissions.

*Topic*

* `Create`
* `Write`
* `Read`
* `Delete`
* `Describe`
* `DescribeConfigs`
* `Alter`
* `AlterConfigs`

*Group*

* `Read`
* `Describe`
* `Delete`

*Cluster*

*  `Create`
*  `Describe`
*  `Alter`
*  `DescribeConfigs`
*  `AlterConfigs`
*  `IdempotentWrite`
*  `ClusterAction`

*TransactionalId*

*  `Describe`
*  `Write`

*DelegationToken*

* `Describe`

[discrete]
== Keycloak Authorization Services model

The Keycloak Authorization Services model has four concepts for defining and granting permissions: _resources_, _authorization scopes_, _policies_, and _permissions_.

Resources:: A resource is a set of resource definitions that are used to match resources with permitted actions.
A resource might be an individual topic, for example, or all topics with names starting with the same prefix.
A resource definition is associated with a set of available authorization scopes, which represent a set of all actions available on the resource.
Often, only a subset of these actions is actually permitted.

Authorization scopes:: An authorization scope is a set of all the available actions on a specific resource definition.
When you define a new resource, you add scopes from the set of all scopes.

Policies:: A policy is an authorization rule that uses criteria to match against a list of accounts.
Policies can match:
* _Service accounts_ based on client ID or roles
* _User accounts_ based on username, groups, or roles.

Permissions:: A permission grants a subset of authorization scopes on a specific resource definition to a set of users.

[role="_additional-resources"]
.Additional resources
* link:https://kafka.apache.org/documentation/#security_authz_primitives[Kafka authorization model]
