// Module included in the following module:
//
// con-oauth-config.adoc

[id='proc-oauth-authentication-broker-config-{context}']
= Setting up OAuth 2.0 authentication on listeners

[role="_abstract"]
Configure Kafka listeners so that they are enabled to use OAuth 2.0 authentication using an authorization server.

We advise using OAuth 2.0 over an encrypted interface through through a listener with `tls: true`. 
Plain listeners are not recommended.

If the authorization server is using certificates signed by the trusted CA and matching the OAuth 2.0 server hostname, TLS connection works using the default settings.
Otherwise, you may need to configure the truststore with proper certificates or disable the certificate hostname validation.

For more information on the configuration of OAuth 2.0 authentication for Kafka broker listeners, see the link:{BookURLConfiguring}#type-KafkaListenerAuthenticationOAuth-reference[`KafkaListenerAuthenticationOAuth` schema reference^].

.Prerequisites

* Strimzi and Kafka are running
* An OAuth 2.0 authorization server is deployed

.Procedure

. Specify a listener in the `Kafka` resource with an `oauth` authentication type. 
+
.Example listener configuration with OAuth 2.0 authentication
[source,yaml,subs="+attributes"]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    listeners:
      - name: tls
        port: 9093
        type: internal
        tls: true
        authentication:
          type: oauth
      - name: external3
        port: 9094
        type: loadbalancer
        tls: true
        authentication:
          type: oauth    
      #...
----

. Configure the OAuth listener depending on the authorization server and validation type:
+
* xref:con-oauth-authentication-broker-jwt-{context}[]
* xref:con-oauth-authentication-broker-intro-{context}[]
* xref:con-oauth-authentication-broker-additional-{context}[]

. Apply the changes to the `Kafka` configuration.

. Check the update in the logs or by watching the pod state transitions:
+
[source,shell,subs="+quotes,attributes"]
----
kubectl logs -f ${POD_NAME} -c ${CONTAINER_NAME}
kubectl get pod -w
----
+
The rolling update configures the brokers to use OAuth 2.0 authentication.

.What to do next

* xref:proc-oauth-client-config-{context}[Configure your Kafka clients to use OAuth 2.0]