// Module included in the following assemblies:
//
// overview/assembly-security-overview.adoc

[id="security-configuration-authentication_{context}"]
= Authentication
Kafka listeners use authentication to ensure a secure client connection to the Kafka cluster.

Supported authentication mechanisms:

* mTLS authentication (on listeners with TLS-enabled encryption)
* SASL SCRAM-SHA-512
* OAuth 2.0 token based authentication
* Custom authentication

The User Operator manages user credentials for mTLS and SCRAM authentication, but not OAuth 2.0.
For example, through the User Operator you can create a user representing a client that requires access to the Kafka cluster, and specify `tls` as the authentication type.

Using OAuth 2.0 token-based authentication, application clients can access Kafka brokers without exposing account credentials.
An authorization server handles the granting of access and inquiries about access.

Custom authentication allows for any type of Kafka-supported authentication. It can provide more flexibility, but also adds complexity.
