// This assembly is included in the following assemblies:
//
// assembly-securing-access.adoc

[id='assembly-securing-kafka-clients-{context}']
= Security options for Kafka clients

[role="_abstract"]
Use the `KafkaUser` resource to configure the authentication mechanism, authorization mechanism, and access rights for Kafka clients.
In terms of configuring security, clients are represented as users.

You can authenticate and authorize user access to Kafka brokers.
Authentication permits access, and authorization constrains the access to permissible actions.

You can also create _super users_ that have unconstrained access to Kafka brokers.

The authentication and authorization mechanisms must match the xref:proc-securing-kafka-{context}[specification for the listener used to access the Kafka brokers].

.Configuring users for secure access to Kafka brokers
For more information on configuring a `KafkaUser` resource to access Kafka brokers securely, see the following sections:

* xref:proc-configuring-kafka-user-str[Securing user access to Kafka]
* link:{BookURLDeploying}#setup-external-clients-str[Setting up access for clients outside of Kubernetes^]

include::../modules/con-securing-client-labels.adoc[leveloffset=+1]
include::../modules/con-securing-client-authentication.adoc[leveloffset=+1]
include::../modules/con-securing-client-authorization.adoc[leveloffset=+1]
