<a id="authentication-overview"></a>

# Authentication in Confluent Platform

By default, Confluent Platform is installed without authentication. Confluent Platform supports the following
authentication mechanisms and protocols for Confluent Server brokers.

<a id="kafka-sasl-auth"></a>

<a id="sasl-authentication-options"></a>

## SASL

SASL (Simple Authentication Security Layer) is a framework that provides developers
of applications and shared libraries with mechanisms for authentication, data
integrity-checking, and encryption. The following topics explain how to configure
SASL in Confluent Platform.

- [SASL/GSSAPI (Kerberos)](sasl/gssapi/overview.md#kafka-sasl-auth-gssapi)
- [SASL/OAUTHBEARER](sasl/oauthbearer/overview.md#cp-oauth-authentication)
- [SASL/PLAIN](sasl/plain/overview.md#kafka-sasl-auth-plain)
- [SASL/PLAIN (using LDAP)](ldap/client-authentication-ldap.md#client-auth-with-ldap)
- [SASL/SCRAM](sasl/scram/overview.md#kafka-sasl-auth-scram)
- [Delegation Tokens (SASL/SSL)](delegation-tokens/overview.md#kafka-sasl-delegate-auth)

<a id="mtls-authentication-option"></a>

## Mutual TLS (mTLS)

With mTLS, both Kafka clients and servers use
TLS certificates to verify each other’s identities to ensure that traffic
is secure and trusted in both directions. The following topics explain how
to configure mTLS in a Confluent Platform cluster.

- [SSL/TLS](mutual-tls/overview.md#kafka-ssl-authentication)

<a id="http-basic-auth-authentication-option"></a>

## HTTP Basic Authentication

You can use [HTTP Basic Authentication](https://en.wikipedia.org/wiki/Basic_access_authentication)
to authenticate with the Admin REST APIs using a username and password pair, which
are presented to the REST Proxy server using the `Authorization` HTTP header.

- [HTTP Basic Auth](http-basic-auth/overview.md#http-basic-auth)

<a id="sso-for-c3-authentication"></a>

### Single sign-on (SSO) for Confluent Control Center

You can use SSO to offload the management of your Control Center users and authenticate to an OIDC-compliant
identity provider (Microsoft Entra ID (Azure Active Directory), Okta, Keycloak, and others).
By using SSO, you can manage your users in one place and use the same credentials to provide
a seamless experience across Confluent Control Center and Confluent Cloud. The following topics explain how to configure
OIDC SSO for Confluent Control Center.

- [OIDC SSO for Confluent Control Center](sso-for-c3/overview.md#sso-for-c3)

## Related content

[Use OAuth/OIDC for Authentication in Confluent Platform](oauth-oidc/overview.md#oauth-oidc-authentication-overview)