[id="con-kafka-keycloak-authz-models_{context}"]
= Kafka and Keycloak authorization models

[role="_abstract"]
Kafka and Keycloak use different authorization models.

.Kafka authorization model
Kafka's authorization model uses _resource types_ and _operations_ to describe ACLs for a user.
When a Kafka client performs an action on a broker, the broker uses the configured `KeycloakAuthorizer` to check the client's permissions, based on the action and resource type.

Each resource type has a set of available permissions for operations.
For example, the `Topic` resource type has `Create` and `Write` permissions among others.

Refer to the https://kafka.apache.org/documentation/#security_authz_primitives[Kafka authorization model] in the Kafka documentation for the full list of resources and permissions. 

.Keycloak authorization model

Keycloak's authorization services model has four concepts for defining and granting permissions: 

* Resources 
* Scopes
* Policies
* Permissions

For information on these concepts, see the guide to {keycloak-authorization-services}.
