Skip to content

Commit 4256c03

Browse files
georgios-goulosgeorgios-goulos
committed
Apply suggestions from code review
1 parent af12d48 commit 4256c03

7 files changed

Lines changed: 21 additions & 24 deletions

File tree

‎docs/components/concepts/access-control/access-control-overview.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,10 @@ Understanding which identity is required for a given action helps you apply the
4141

4242
In production setups, both the Orchestration Cluster Admin and the Management Identity can integrate with an external OIDC IdP (such as Entra ID) for unified user management, single sign-on (SSO), and consistent security policies.
4343

44-
| Identity type | Description | Default IdP | External IdP support |
45-
| :----------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------- | :------------------------------------ |
44+
| Identity type | Description | Default IdP | External IdP support |
45+
| :-------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------- | :------------------------------------ |
4646
| Orchestration Cluster Admin | Built-in user management with support for external IdP integration via OIDC. Connects to enterprise IdPs such as Microsoft Entra ID, Okta, and more. | Built-in user management | OIDC integration with enterprise IdPs |
47-
| Management Identity | Uses Keycloak by default, but can be configured with an external IdP via OIDC. | Keycloak | OIDC integration with external IdPs |
47+
| Management Identity | Uses Keycloak by default, but can be configured with an external IdP via OIDC. | Keycloak | OIDC integration with external IdPs |
4848

4949
## Authentication vs. authorization
5050

@@ -61,10 +61,10 @@ Authorization determines what an authenticated user or client is allowed to acce
6161

6262
For example, a user's authorizations allow them to access Operate, view running or completed process instances, start new process instances, or claim and complete user tasks in Tasklist and through the Orchestration Cluster REST API.
6363

64-
| Identity type | Authorization model | Description | Management interface |
65-
| :----------------------------- | :------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------- |
66-
| Orchestration Cluster Admin | Fine-grained permissions | Controls access to applications, APIs, and runtime resources through specific permissions for each resource type and action (for example, `PROCESS_DEFINITION` and `USER_TASK`). | Camunda Admin UI or API |
67-
| Management Identity | Role-based access control (RBAC) | Uses predefined roles and permissions for users and groups to manage Console, Web Modeler, and Optimize. | Keycloak admin console or external IdP |
64+
| Identity type | Authorization model | Description | Management interface |
65+
| :-------------------------- | :------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------- |
66+
| Orchestration Cluster Admin | Fine-grained permissions | Controls access to applications, APIs, and runtime resources through specific permissions for each resource type and action (for example, `PROCESS_DEFINITION` and `USER_TASK`). | Camunda Admin UI or API |
67+
| Management Identity | Role-based access control (RBAC) | Uses predefined roles and permissions for users and groups to manage Console, Web Modeler, and Optimize. | Keycloak admin console or external IdP |
6868

6969
### How authentication and authorization work together
7070

‎docs/self-managed/components/modeler/web-modeler/configuration/configuration.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ The available configuration options depend on the version of the cluster:
5151
| `CAMUNDA_MODELER_CLUSTERS_0_URL_GRPC` | [Internal or external](#notes-on-host-names-and-port-numbers) address where the [Zeebe gRPC API](/apis-tools/zeebe-api/grpc.md) can be reached. | `grpc://camunda:26500`,<br/>`grpcs://camunda.example.com:26500` |
5252
| `CAMUNDA_MODELER_CLUSTERS_0_URL_REST` | [Internal or external](#notes-on-host-names-and-port-numbers) address where the cluster's REST APIs can be reached. Used as the base URL for requests to the [Orchestration Cluster API](/apis-tools/orchestration-cluster-api-rest/orchestration-cluster-api-rest-overview.md) (`/v2` endpoints) as well as the [Operate](/apis-tools/operate-api/overview.md) and [Tasklist](/apis-tools/tasklist-api-rest/tasklist-api-rest-overview.md) APIs (`/v1` endpoints). | `http://camunda:8080`,<br/>`https://camunda.example.com` |
5353
| `CAMUNDA_MODELER_CLUSTERS_0_URL_WEBAPP` | [External](#notes-on-host-names-and-port-numbers) address where the cluster's web applications can be reached in a browser. | `https://camunda.example.com` |
54-
| `CAMUNDA_MODELER_CLUSTERS_0_AUTHORIZATIONS_ENABLED` | Indicates if [authorizations are enabled](/self-managed/components/orchestration-cluster/admin/overview.md#enable-api-authentication-and-authorizations) for the cluster. If `true`, users will see a hint when they deploy from Web Modeler. | `true` |
54+
| `CAMUNDA_MODELER_CLUSTERS_0_AUTHORIZATIONS_ENABLED` | Indicates if [authorizations are enabled](/self-managed/components/orchestration-cluster/admin/overview.md#enable-api-authentication-and-authorizations) for the cluster. If `true`, users will see a hint when they deploy from Web Modeler. | `true` |
5555

5656
#### Additional configuration for cluster versions < 8.8
5757

@@ -64,11 +64,11 @@ The available configuration options depend on the version of the cluster:
6464

6565
#### Available authentication methods
6666

67-
| Method | Description | When to use? |
68-
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
67+
| Method | Description | When to use? |
68+
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
6969
| `BEARER_TOKEN` | Web Modeler sends the authenticated user's token in the `Authorization` header with every request to the cluster. | **Cluster version >= 8.8**<br/>The cluster uses [OIDC authentication](/self-managed/components/orchestration-cluster/admin/connect-external-identity-provider.md) with the same identity provider as Web Modeler.<br/>_Note_: You need to ensure that the cluster [accepts Web Modeler's token audience](/self-managed/components/orchestration-cluster/admin/connect-external-identity-provider.md#step-4-configure-the-oidc-connection-details).<br/><br/>**Cluster version < 8.8**<br/>The cluster uses [Camunda Identity-based authentication](/versioned_docs/version-8.7/self-managed/zeebe-deployment/security/client-authorization.md#camunda-identity-authorization) and the external identity provider supports access tokens with multiple audiences (example provider: Keycloak).<br/>_Note_: For the token to be accepted by the different cluster components, it must contain each component's audience. |
70-
| `BASIC` | Web Modeler sends a username and password with every request to the cluster. The credentials have to be provided by the user in the UI. | **Cluster version >= 8.8**<br/>The cluster uses basic authentication.<br/><br/>**Cluster version < 8.8**<br/>not supported |
71-
| `NONE` | Web Modeler does not send any authentication information. | **Cluster version >= 8.8**<br/>The cluster API is [configured as unprotected](/self-managed/components/orchestration-cluster/admin/overview.md#enable-api-authentication-and-authorizations) and can be used without authentication.<br/><br/>**Cluster version < 8.8**<br/>The authentication / token validation in the Zeebe Gateway is [disabled](/versioned_docs/version-8.7/self-managed/zeebe-deployment/security/client-authorization.md#camunda-identity-authorization). |
70+
| `BASIC` | Web Modeler sends a username and password with every request to the cluster. The credentials have to be provided by the user in the UI. | **Cluster version >= 8.8**<br/>The cluster uses basic authentication.<br/><br/>**Cluster version < 8.8**<br/>not supported |
71+
| `NONE` | Web Modeler does not send any authentication information. | **Cluster version >= 8.8**<br/>The cluster API is [configured as unprotected](/self-managed/components/orchestration-cluster/admin/overview.md#enable-api-authentication-and-authorizations) and can be used without authentication.<br/><br/>**Cluster version < 8.8**<br/>The authentication / token validation in the Zeebe Gateway is [disabled](/versioned_docs/version-8.7/self-managed/zeebe-deployment/security/client-authorization.md#camunda-identity-authorization). |
7272

7373
### Database
7474

‎docs/self-managed/components/orchestration-cluster/admin/connect-external-identity-provider.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -538,7 +538,6 @@ RP-initiated logout is enabled by default for all new deployments.
538538
**Logout behavior depends on this setting:**
539539

540540
- **Orchestration Cluster-only logout (RP-initiated logout disabled)**
541-
542541
- Clears only the Orchestration Cluster session.
543542
- No request is sent to the IdP, so the user remains signed in there.
544543

‎docs/self-managed/components/orchestration-cluster/admin/debugging-authentication.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,11 @@ Common questions you can answer with these steps:
1818
The flow consists of three key steps:
1919

2020
1. **Request authentication**
21-
2221
- **Input:** HTTP request
2322
- **Output:** Spring `Authentication` object with user identity
2423
- **Layer:** Spring Security
2524

2625
2. **Establish Orchestration Cluster user context**
27-
2826
- **Input:** Spring `Authentication`
2927
- **Output:** `CamundaAuthentication` object with roles, groups, and tenant memberships
3028
- **Layer:** Orchestration Cluster authentication

0 commit comments

Comments
 (0)