ifdef::context[:parent-context: {context}]

[id="assembly-managing-policies-permissions-keycloak_{context}"]
= Managing policies and permissions in Keycloak Authorization Services

:context: authz-model

[role="_abstract"]
This section describes the authorization models used by Keycloak Authorization Services and Kafka, and defines the important concepts in each model.

To grant permissions to access Kafka, you can map Keycloak Authorization Services objects to Kafka resources by creating an _OAuth client specification_ in Keycloak.
Kafka permissions are granted to user accounts or service accounts using Keycloak Authorization Services rules.

xref:ref-example-permissions-for-kafka-operations_{context}[Examples] are shown of the different user permissions required for common Kafka operations, such as creating and listing topics.

include::../../modules/oauth/con-kafka-keycloak-authz-models.adoc[leveloffset=+1]

include::../../modules/oauth/con-mapping-keycloak-authz-services-to-kafka-model.adoc[leveloffset=+1]

include::../../modules/oauth/ref-example-permissions-for-kafka-operations.adoc[leveloffset=+1]

ifdef::parent-context[:context: {parent-context}]
ifndef::parent-context[:!context:]
