Authentication
Camunda Hub authenticates users with OpenID Connect (OIDC), using the same configuration settings as the Orchestration Cluster.
Authentication and user management
In 8.10, Camunda Hub authenticates users with the same camunda.security.* settings as the Orchestration Cluster, while Management Identity keeps managing users and their access. For how the responsibilities are split, see management and modeling component authentication.
Management Identity is still required for Camunda Hub in 8.10. For more information, see manage access and permissions.
Configure OIDC authentication
Camunda Hub uses the following settings to validate tokens and identify users:
- Application properties
- Environment variables
camunda:
security:
authentication:
oidc:
issuer-uri: https://keycloak.example.com/auth/realms/camunda-platform
client-id: web-modeler
username-claim: name # optional, default: name
audiences: web-modeler-api,web-modeler-public-api # optional
| Environment variable | Description | Example value | Default value |
|---|---|---|---|
CAMUNDA_SECURITY_AUTHENTICATION_OIDC_ISSUERURI | URL of the token issuer, used for JWT validation. Individual endpoints are fetched from the provider's well-known configuration endpoint. | https://keycloak.example.com/auth/realms/camunda-platform | - |
CAMUNDA_SECURITY_AUTHENTICATION_OIDC_CLIENTID | Client ID of the Camunda Hub application configured in your identity provider. | web-modeler | - |
CAMUNDA_SECURITY_AUTHENTICATION_OIDC_USERNAMECLAIM | [optional] Token claim used to assign usernames. | preferred_username | name |
CAMUNDA_SECURITY_AUTHENTICATION_OIDC_AUDIENCES | [optional] Comma-separated list of accepted audience claim values, used for JWT validation. Includes the audiences for both user access tokens and the public Camunda Hub API. | web-modeler-api,web-modeler-public-api | - |
Upgrading from 8.9
If you configured Camunda Hub authentication in 8.9, no action is required to upgrade to 8.10. Camunda Hub translates your existing settings to the settings above at startup. Those 8.9 settings are deprecated, however, and are removed in 8.11, so migrate to the camunda.security.authentication.oidc.* settings before upgrading to 8.11.
If you set more than one of the three 8.9 audience properties, they merge into the single camunda.security.authentication.oidc.audiences list. Set camunda.security.authentication.oidc.audiences explicitly so the resulting list is the one you intend.
For the mapping between the 8.9 and 8.10 settings, see upgrade Camunda components from 8.9 to 8.10.
Use a different OIDC provider than Keycloak
By default, Camunda Hub uses the built-in Keycloak instance as its identity provider. To use a different OIDC provider, follow the steps in the OIDC connection guide.
If you connect the Orchestration Cluster to an external identity provider, use the same provider for Camunda Hub. Both components read the same camunda.security.authentication.oidc.* settings, which gives you one authentication configuration to maintain and one place to manage users.