Authentication
Depending on your configuration, users and applications authenticate with Camunda 8 via the IdP using the OAuth 2.0 protocol, using either a login page or M2M tokens.
Login page authentication
When a user accesses a Camunda 8 web application, they are shown the login page provided by the configured IdP.
M2M (machine-to-machine) authentication
Applications can authenticate with Camunda 8 using M2M (machine-to-machine) tokens.
Prerequisites
The following prerequisites are required for M2M authentication:
Prerequisite | Description |
---|---|
Identity | A running Identity service. |
Application | An application for your service. |
Client ID | The client ID of your application. |
Client secret | The client secret of your application. |
REST client | A REST client of your choice. |
Generate a token
In the following example, the Keycloak instance that supports Identity can be found via http://localhost:18080
. This might be different for your Identity configuration, adjust the host name (and port if required) if required.
To request a token, use the following cURL command, replacing the placeholders with your application details:
curl --location --request POST 'http://localhost:18080/auth/realms/camunda-platform/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=[CLIENT_ID]' \
--data-urlencode 'client_secret=[CLIENT_SECRET]' \
--data-urlencode 'grant_type=client_credentials'
The following shows an example successful authentication response:
{
"access_token": "<TOKEN>",
"expires_in": 300,
"refresh_expires_in": 0,
"token_type": "Bearer",
"not-before-policy": 0
}
You can use the token to authenticate an application with Camunda components, for example to access Operate REST APIs.