Keycloak is an external authentication service. It stores sensitive login crednetials.

Use case for AMQ Streams: "John" can produce messages to topic x but nowhere else. There will also be more generic use cases.

We are not building an auth component into Streams. Instead, Streams will delegate all password management and authorization rules to Keycloak. Streams will use the OAuth protocol for interacting with Keycloak.