// Module included in the following assemblies:
//
// overview/assembly-security-overview.adoc

[id="security-configuration-authorization_{context}"]
= Authorization

Kafka clusters use authorization to control the operations that are permitted on Kafka brokers by specific clients or users.
If applied to a Kafka cluster, authorization is enabled for all listeners used for client connection.

If a user is added to a list of _super users_ in a Kafka broker configuration,
the user is allowed unlimited access to the cluster regardless of any authorization constraints implemented through authorization mechanisms.

Supported authorization mechanisms:

* Simple authorization
* OAuth 2.0 authorization (if you are using OAuth 2.0 token-based authentication)
* Open Policy Agent (OPA) authorization
* Custom authorization

Simple authorization uses `AclAuthorizer`, the default Kafka authorization plugin.
`AclAuthorizer` uses Access Control Lists (ACLs) to define which users have access to which resources.
For custom authorization, you configure your own `Authorizer` plugin to enforce ACL rules. 

OAuth 2.0 and OPA provide policy-based control from an authorization server.
Security policies and permissions used to grant access to resources on Kafka brokers are defined in the authorization server.

URLs are used to connect to the authorization server and verify that an operation requested by a client or user is allowed or denied.
Users and clients are matched against the policies created in the authorization server that permit access to perform specific actions on Kafka brokers.
