// This assembly is included in the following assemblies:
//
// configuring/configuring.adoc

[id='assembly-securing-access-{context}']
= Securing access to Kafka

[role="_abstract"]
Secure your Kafka cluster by managing the access a client has to Kafka brokers.
A secure connection between Kafka brokers and clients can encompass the following:

* Encryption for data exchange
* Authentication to prove identity
* Authorization to allow or decline actions executed by users

In Strimzi, securing a connection involves configuring listeners and user accounts:

Listener configuration:: Use the `Kafka` resource to configure listeners for client connections to Kafka brokers.
Listeners define how clients authenticate, such as using mTLS, SCRAM-SHA-512, OAuth 2.0, or custom authentication methods.
To enhance security, configure TLS encryption to secure communication between Kafka brokers and clients.
You can further secure TLS-based communication by specifying the supported TLS versions and cipher suites in the Kafka broker configuration.
+
For an added layer of protection, use the `Kafka` resource to specify authorization methods for the Kafka cluster, such as simple, OAuth 2.0, OPA, or custom authorization.

User accounts:: Set up user accounts and credentials with `KafkaUser` resources in Strimzi. 
Users represent your clients and determine how they should authenticate and authorize with the Kafka cluster. 
The authentication and authorization mechanisms specified in the user configuration must match the Kafka configuration. 
Additionally, define Access Control Lists (ACLs) to control user access to specific topics and actions for more fine-grained authorization.
To further enhance security, specify user quotas to limit client access to Kafka brokers based on byte rates or CPU utilization.
+
You can also add producer or consumer configuration to your clients if you wish to limit the TLS versions and cipher suites they use.
The configuration on the clients must only use protocols and cipher suites that are enabled on the broker.

NOTE: If you are using an OAuth 2.0 to manage client access, user authentication and authorization credentials are managed through the authorization server.

Strimzi operators automate the configuration process and create the certificates required for authentication.
The Cluster Operator automatically sets up TLS certificates for data encryption and authentication within your cluster.

//Config options for securing Kafka
include::assembly-securing-kafka-brokers.adoc[leveloffset=+1]

//Config options for clients
include::assembly-securing-kafka-clients.adoc[leveloffset=+1]

//Config to secure access
include::assembly-securing-kafka.adoc[leveloffset=+1]

//oauth options
include::../oauth/assembly-oauth-authentication.adoc[leveloffset=+1]
include::../oauth/assembly-oauth-authorization.adoc[leveloffset=+1]
