// Module included in the following assemblies:
//
// assembly-oauth-authorization.adoc

[id='con-oauth-authorization-intro_{context}']
If you are using OAuth 2.0 with Keycloak for token-based authentication,
you can also use Keycloak to configure authorization rules to constrain client access to Kafka brokers.
Authentication establishes the identity of a user.
Authorization decides the level of access for that user.

Strimzi supports the use of OAuth 2.0 token-based authorization through Keycloak {keycloak-authorization-services},
which allows you to manage security policies and permissions centrally.

Security policies and permissions defined in Keycloak are used to grant access to resources on Kafka brokers.
Users and clients are matched against policies that permit access to perform specific actions on Kafka brokers.

Kafka allows all users full access to brokers by default,
and also provides the `AclAuthorizer` plugin to configure authorization based on Access Control Lists (ACLs).

ZooKeeper stores ACL rules that grant or deny access to resources based on _username_.
However, OAuth 2.0 token-based authorization with  Keycloak offers far greater flexibility on how you wish to implement access control to Kafka brokers.
In addition, you can configure your Kafka brokers to use OAuth 2.0 authorization and ACLs.

[role="_additional-resources"]
.Additional resources

* xref:assembly-oauth-authentication_str[Using OAuth 2.0 token-based authentication]
* xref:con-securing-kafka-authorization-{context}[Kafka Authorization]
* {keycloak-server-doc}
