# Deployment patterns for mTLS authentication with RBAC authorization in Confluent Platform
When you use mutual TLS (mTLS) authentication with role-based access control (RBAC) in your Confluent Platform
deployments, the following patterns are available. These patterns differ based
on whether mTLS authentication also uses token-based authentication and the type of
credentials that the client provides.
Depending on how mTLS with RBAC is deployed, the authentication behavior at the
server and the type of credentials provided by the client differs. If you include
token-based authentication, RBAC authorization uses different principal extraction
methods.
The following table summarizes the supported deployment patterns, the
authentication behavior, and the principal extraction methods.
| Deployment pattern | Authentication behavior | Principal extraction |
|--------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| mTLS authentication | Authentication requires the client to pass a certificate. If a client fails
to pass a certificate, client authentication fails. | Principal extraction from the certificate. |
| mTLS authentication with optional token authentication | Authentication options include:
- certificate (mTLS)
- certificate plus token
The client must pass a valid certificate, but can optionally pass a token
too. If both credentials are passed, both must be valid if the server is
configured for both certificate and token. | Principal extraction is first attempted from a token. If a token is not
passed, then the certificate is used. If a client passes both credentials,
the principal from the token is used. |
## Principal extraction example
The following example demonstrates how principals are extracted based on the
credentials provided. In this example, the certificate subject name is
`CN=alice`, and the token subject is `bob`. The following example shows a
request that includes both a certificate and a token.
```shell
# Example request with both certificate and token
curl \
--cacert ca-cert.pem \
--cert client-cert.pem \
--key client-key.pem \
--pass \
-H "Authorization: Bearer " \
-H "accept: application/json" \
-X GET "https://:/resource"
```
Certificate SN (Subject Name):
```text
CN = alice, OU = TEST, O = CONFLUENT, L = PaloAlto, ST = Ca, C = US
```
Decoded token from API request:
```json
{
"sub": "bob",
"name": "Bob The Builder",
"iat": 1516239022
}
```
### Principal extraction behavior
When you use mTLS authentication with RBAC authorization, the principal is
extracted based on the type of credentials that the client provides.
* If only a certificate is provided:
- Uses the certificate CN. For example, `User:alice` from `CN=alice`.
* If a token is provided (with or without a certificate):
- Uses the token subject. For example, `User:bob` from token’s `sub` claim.
* If neither a certificate nor a token is provided:
- Authentication fails.