Kafka Authorization with Keycloak – Not Working

[houas6]

Hello everyone,
I'm a student currently working on deploying Kafka using Strimzi on Azure Kubernetes Service (AKS).
I've successfully configured mTLS for authentication, and everything is working well in that regard.
Now, I'm trying to enable authorization using Keycloak, but unfortunately (whenever i change the authorization type to keycloak it want and oauth authentication ) , it doesn't seem to be working.
Here are relevant snippets from my setup. At this point, only mTLS authentication is functioning.

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: mycluster
  namespace: kafka
  labels:
    app: mycluster
  annotations:
    cert-manager.io/cluster-issuer: "******.cloud-letsencrypt-prod"
spec:
  kafka:
    replicas: 3
    storage:
      type: jbod
      volumes:
        - id: 0
          type: persistent-claim
          size: 50Gi
          deleteClaim: true
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          name: kafka-metrics
          key: kafka-metrics-config.yml
    config:
      auto.create.topics.enable: "false"
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      default.replication.factor: 3
      min.insync.replicas: 2
      ssl.client.auth: "required"
      authorizer.class.name: "kafka.security.authorizer.AclAuthorizer"
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
        authentication:
          type: tls
      - name: external
        port: 9094
        type: ingress
        tls: true
        authentication:
          type: tls
        configuration:
          class: nginx
          bootstrap:
            annotations:
              external-dns.alpha.kubernetes.io/hostname: bootstrap.*******
              external-dns.alpha.kubernetes.io/ttl: "60"
              nginx.ingress.kubernetes.io/ssl-passthrough: "true"
              nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
              nginx.ingress.kubernetes.io/ingress.class: "nginx"
            host: bootstrap.*****
          brokers:
            - broker: 0
              annotations:
                external-dns.alpha.kubernetes.io/hostname: broker-0.***
                external-dns.alpha.kubernetes.io/ttl: "60"
                nginx.ingress.kubernetes.io/ssl-passthrough: "true"
                nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
                nginx.ingress.kubernetes.io/ingress.class: "nginx"
              host: broker-0.******
            - broker: 1
              annotations:
                external-dns.alpha.kubernetes.io/hostname: broker-1.****
                external-dns.alpha.kubernetes.io/ttl: "60"
                nginx.ingress.kubernetes.io/ssl-passthrough: "true"
                nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
                nginx.ingress.kubernetes.io/ingress.class: "nginx"
              host: broker-1.****
            - broker: 2
              annotations:
                external-dns.alpha.kubernetes.io/hostname: broker-2.*****
                external-dns.alpha.kubernetes.io/ttl: "60"
                nginx.ingress.kubernetes.io/ssl-passthrough: "true"
                nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
                nginx.ingress.kubernetes.io/ingress.class: "nginx"
              host: broker-2.****
          brokerCertChainAndKey:
            secretName: mycluster-lets-encrypt
            certificate: tls.crt
            key: tls.key
    authorization:
      type: simple
      clientId: "*******"
      tokenEndpointUri: "https://************/auth/realms/master/protocol/openid-connect/token"
      delegateToKafkaAcls: false
      tlsTrustedCertificates:
        - secretName: ca-truststore
          certificate: isrgrootx1.pem
  zookeeper:
    replicas: 3
    storage:
      type: persistent-claim
      size: 20Gi
      deleteClaim: true
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          name: kafka-metrics
          key: zookeeper-metrics-config.yml
  entityOperator:
    topicOperator: {}
    userOperator: {}
  kafkaExporter:
    topicRegex: ".*"
    groupRegex: ".*"

/////////////////////////////////

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: my-user
  namespace: kafka
  labels:
    strimzi.io/cluster: mycluster
spec:
  authentication:
    type: tls
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operations:
          - Describe
          - Read
        host: "*"
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operations:
          - Create
          - Describe
          - Write
        host: "*"
      - resource:
          type: group
          name: "*"
          patternType: literal
        operations:
          - Read
        host: "*"
      - resource:
          type: cluster
          name: kafka-cluster
        operations:
          - Describe  # Required for DescribeLogDirs
        host: "*"

[katheris]

Hi @houas6 to provide any help we really need more details about what exactly is going wrong, the configuration you used when trying to enable keycloak authorization and oauth authentication, and also logs from the operator and Kafka pods would be useful as well.