:_mod-docs-content-type: CONCEPT

// Module included in the following assemblies:
//
// assembly-securing-kafka-clients.adoc

[id='con-securing-client-authorization-{context}']
= Configuring user authorization

[role="_abstract"]
Use the `KafkaUser` custom resource to configure authorization rules for users (clients) that require access to a Kafka cluster. 
Configure the rules using the `authorization` property in `KafkaUser.spec`.
By specifying a `type`, you control what rules are used.

To use simple authorization, you set the `type` property to `simple` in `KafkaUser.spec.authorization`.
The simple authorization uses the Kafka Admin API to manage the ACL rules inside your Kafka cluster.
Whether ACL management in the User Operator is enabled or not depends on your authorization configuration in the Kafka cluster.

* For simple authorization, ACL management is always enabled.
* For OPA authorization (deprecated), ACL management is always disabled.
* For Keycloak authorization, you can manage the ACL rules directly in Keycloak.
  You can also delegate authorization to the simple authorizer as a fallback option in the configuration.
  When delegation to the simple authorizer is enabled, the User Operator will enable management of ACL rules as well.
* For custom authorization using a custom authorization plugin, use the `supportsAdminApi` property in the `.spec.kafka.authorization` configuration of the `Kafka` custom resource to enable or disable the support.

Authorization is cluster-wide.
The authorization type must match the equivalent configuration in the `Kafka` custom resource.

If ACL management is not enabled, Strimzi rejects a resource if it contains any ACL rules.

If you're using a standalone deployment of the User Operator, ACL management is enabled by default.
You can disable it using the `STRIMZI_ACLS_ADMIN_API_SUPPORTED` environment variable.

If no authorization is specified, the User Operator does not provision any access rights for the user.
Whether such a `KafkaUser` can still access resources depends on the authorizer being used.
For example, for `simple` authorization, this is determined by the `allow.everyone.if.no.acl.found` configuration in the Kafka cluster.
