For the complete documentation index, see llms.txt.
Skip to main content
Version: 8.11 (unreleased)

Set up the Helm chart with basic authentication

By default, Camunda 8 Self-Managed uses Basic authentication for all components deployed through the Helm chart. This method requires no additional configuration and is ideal for local or development environments.

Bitnami subcharts removed in Camunda 8.10

Earlier releases bundled Keycloak and PostgreSQL through Bitnami subcharts (identityKeycloak, webModelerPostgresql). As of Camunda 8.10 (Helm chart 15.x), the bundled Bitnami subcharts are removed: deploy Keycloak and PostgreSQL with Kubernetes operators or managed services, as shown in the examples below.

note

Because Basic authentication is enabled by default, components that depend on Management Identity (which implements OIDC/OAuth authentication) are disabled by default. These components include:

  • Management Identity
  • Console
  • Web Modeler
  • Keycloak
  • Optimize

In this guide, you'll learn how to:

  • Deploy the Orchestration Cluster and Connectors with Basic authentication.
  • Add additional components, using a hybrid approach, combining Basic authentication and OIDC.

Enable the Orchestration Cluster and Connectors​

The Orchestration Cluster and Connectors are enabled, by default, with Basic authentication. No additional configuration is required—simply deploy the Helm chart, and these components will be available.

Default users​

Two users are created by default:

UsernamePasswordRoleDescription
demodemoadminInitial administrative user
connectorconnectorconnectorsUsed by the Connectors component to authenticate with the Orchestration Cluster API

For details on configuring initial users and their roles, see Orchestration Cluster Admin initialization.

Helm arrays

In Helm, arrays must be overwritten in full. If you change these configuration settings, keep in mind that the default array must be configured in your custom values.yaml if you want to keep those users and role assignments. For example, when adding the user foo or assigning roles to foo, keep also the values for the demo and connectors user.

Connect to the cluster​

To access the Orchestration Cluster and Connectors from your local machine using kubectl port-forward, refer to Accessing components without Ingress.

Log in with the default credentials:

  • Username: demo
  • Password: demo

Enable additional components​

The following components require Management Identity with an OIDC provider and, therefore, don't support basic authentication:

  • Console
  • Web Modeler
  • Optimize

However, you can still enable these components alongside a Basic authentication Orchestration Cluster by using a hybrid authentication setup:

  • Orchestration Cluster and Connectors use basic authentication
  • Console, Web Modeler, Optimize, and Management Identity use OIDC

In this section, you'll learn how to configure hybrid authentication with internal Keycloak. You can also apply this approach with other OIDC setups, such as external Keycloak or an external OIDC provider

When deploying process models from Web Modeler to a Basic authentication Orchestration Cluster, you'll be prompted to enter credentials in the deployment dialog.

Configuration steps​

Follow the internal Keycloak guide with these modifications:

  1. When you create a secret, omit the following keys. They aren't needed for Basic authentication setups:

    • identity-connectors-client-token
    • identity-orchestration-client-token

  2. Set basic as the authentication method for the Orchestration Cluster and Connectors:

orchestration:
  security:
    authentication:
      method: basic

connectors:
  security:
    authentication:
      method: basic
  1. Skip the OIDC sections for the Orchestration Cluster and Connectors.

Full configuration example​

This example shows a complete configuration of hybrid authentication with internal Keycloak:

global:
  identity:
    auth:
      enabled: true
      type: KEYCLOAK
      publicIssuerUrl: http://keycloak-service:18080/auth/realms/camunda-platform
      issuerBackendUrl: http://keycloak-service:18080/auth/realms/camunda-platform
      optimize:
        secret:
          existingSecret: "camunda-credentials"
          existingSecretKey: "identity-optimize-client-token"
    keycloak:
      url:
        protocol: http
        host: keycloak-service
        port: "18080"
      contextPath: /auth
      realm: /realms/camunda-platform
      auth:
        adminUser: temp-admin
        secret:
          existingSecret: keycloak-initial-admin
          existingSecretKey: password

identity:
  enabled: true
  firstUser:
    secret:
      existingSecret: "camunda-credentials"
      existingSecretKey: "identity-firstuser-password"
  externalDatabase:
    enabled: true
    host: pg-identity-rw
    port: 5432
    database: identity
    username: identity
    secret:
      existingSecret: pg-identity-secret
      existingSecretKey: password

optimize:
  enabled: true

connectors:
  security:
    authentication:
      method: basic

camundaHub:
  enabled: true # Deploys both Console and Web Modeler
  restapi:
    mail:
      fromAddress: noreply@example.com
    externalDatabase:
      host: pg-hub-rw
      port: 5432
      database: hub
      username: hub
      secret:
        existingSecret: pg-hub-secret
        existingSecretKey: password

orchestration:
  security:
    authentication:
      method: basic

Connect to the cluster​

To access the additional components, refer to Connect to the cluster in the internal Keycloak guide.

Next steps​