// Module included in the following assemblies:
//
// assembly-oauth-authorization.adoc

[id='con-oauth-authorization-mechanism_{context}']
= OAuth 2.0 authorization mechanism

OAuth 2.0 authorization in Strimzi uses Keycloak server Authorization Services REST endpoints to extend token-based authentication with Keycloak by applying defined security policies on a particular user,
and providing a list of permissions granted on different resources for that user.
Policies use roles and groups to match permissions to users.
OAuth 2.0 authorization enforces permissions locally based on the received list of grants for the user from Keycloak Authorization Services.

== Kafka broker custom authorizer

A Keycloak _authorizer_ (`KeycloakRBACAuthorizer`) is provided with Strimzi.
To be able to use the Keycloak REST endpoints for Authorization Services provided by Keycloak,
you configure a custom authorizer on the Kafka broker.

The authorizer fetches a list of granted permissions from the authorization server as needed,
and enforces authorization locally on the Kafka Broker, making rapid authorization decisions for each client request.
