:_mod-docs-content-type: CONCEPT

Configures access control rules for a `KafkaUser` when brokers are using `simple` authorization.

.Example `KafkaUser` configuration with simple authorization
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaUserApiVersion}
kind: KafkaUser
metadata:
  name: my-user
  labels:
    strimzi.io/cluster: my-cluster
spec:
  # ...
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: "*"
          patternType: literal
        operations:
          - Read
          - Describe
      - resource:
          type: group
          name: my-group
          patternType: prefix
        operations:
          - Read
----

Use the `resource` property to specify the resource that the rule applies to.

Simple authorization supports four resource types, which are specified in the `type` property:

* Topics (`topic`)
* Consumer Groups (`group`)
* Clusters (`cluster`)
* Transactional IDs (`transactionalId`)

For Topic, Group, and Transactional ID resources you can specify the name of the resource the rule applies to in the `name` property.

Cluster type resources have no name.

A name is specified as a `literal` or a `prefix` using the `patternType` property.

* Literal names are taken exactly as they are specified in the `name` field.
* Prefix names use the `name` value as a prefix and then apply the rule to all resources with names starting with that value.

When `patternType` is set as `literal`, you can set the name to `*` to indicate that the rule applies to all resources.

For more details about `simple` authorization, ACLs, and supported combinations of resources and operations, see link:{ApacheKafkaDocsBase}security/authorization-and-acls/[Authorization and ACLs^].
