Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add zeebe tokenScope w/ postfix to MSFT Entra doc #3285

Merged
merged 12 commits into from
Feb 15, 2024
Merged

Add zeebe tokenScope w/ postfix to MSFT Entra doc #3285

Changes from 6 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
a051145
add zeebe tokenScope w/ postfix
akeller Feb 2, 2024
ccaaf75
reuse terms from page
akeller Feb 2, 2024
c385727
add yaml
akeller Feb 2, 2024
390ada2
Lessons learned configuring Web Modeler
upgradingdave Feb 5, 2024
357c78e
remove tokenScope
akeller Feb 9, 2024
0965085
Merge branch 'main' into entra-docs-zeebe-tokenscope
akeller Feb 9, 2024
fd46e76
Update docs/self-managed/platform-deployment/helm-kubernetes/guides/c…
akeller Feb 13, 2024
ddb3063
Update docs/self-managed/platform-deployment/helm-kubernetes/guides/c…
akeller Feb 13, 2024
e5f89b4
review fixes
akeller Feb 14, 2024
cd06baf
Merge branch 'entra-docs-zeebe-tokenscope' of https://github.com/camu…
akeller Feb 14, 2024
a8112f4
backport 8.4
akeller Feb 14, 2024
5bb4b9c
Merge branch 'main' into entra-docs-zeebe-tokenscope
akeller Feb 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 31 additions & 15 deletions ...naged/platform-deployment/helm-kubernetes/guides/connect-to-an-oidc-provider.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,8 +117,9 @@ When using OIDC, set `connectors.inbound.mode: disabled` [in your Connectors Hel

2. Within the app registered in Step
1, [configure a platform](https://learn.microsoft.com/en-gb/entra/identity-platform/quickstart-register-app#configure-platform-settings)
of type `web`. The expected redirect URI of the component you are configuring an app for can be found
in [component-specific configuration](#component-specific-configuration).
of type `Web` for Operate, TaskList, and Optimize. [Configure a platform](https://learn.microsoft.com/en-gb/entra/identity-platform/quickstart-register-app#configure-platform-settings)
of type `Single-page application` for Modeler. The expected redirect URI of the component you are configuring an app for can be found
in [component-specific configuration](#component-specific-configuration). Make sure the redirect URIs entered here match the redirect URI's configured in step 4.

3. Once you have registered a platform for your app a client secret needs to be created. To do this, see [adding a client secret](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-client-secret). Make a note of the value of the client secret as it will be required later on.

Expand All @@ -129,48 +130,56 @@ When using OIDC, set `connectors.inbound.mode: disabled` [in your Connectors Hel

```
CAMUNDA_IDENTITY_TYPE=MICROSOFT
CAMUNDA_IDENTITY_ISSUER=<URL_OF_ISSUER>
CAMUNDA_IDENTITY_ISSUER_BACKEND_URL=<URL_OF_ISSUER> // this is used for container to container communication
CAMUNDA_IDENTITY_ISSUER=https://login.microsoftonline.com/<Client ID from step 1>/v2.0
CAMUNDA_IDENTITY_ISSUER_BACKEND_URL=https://login.microsoftonline.com/<Client ID from step 1>/v2.0
CAMUNDA_IDENTITY_CLIENT_ID=<Client ID from step 1>
CAMUNDA_IDENTITY_CLIENT_SECRET=<Client secret from step 3>
CAMUNDA_IDENTITY_AUDIENCE=<Audience of your application>
CAMUNDA_IDENTITY_AUDIENCE=<Client ID from step 1>
```

</TabItem>
<TabItem value="helm">

```
```yaml
global:
identity:
auth:
issuer: <URL_OF_ISSUER>
issuer: https://login.microsoftonline.com/<Client ID from step 1>/v2.0
# this is used for container to container communication
issuerBackendUrl: <URL_OF_ISSUER>
tokenUrl: <TOKEN_URL_ENDPOINT>
jwksUrl: <JWKS_URL>
issuerBackendUrl: https://login.microsoftonline.com/<Client ID from step 1>/v2.0
tokenUrl: https://login.microsoftonline.com/<Client ID from step 1>/oauth2/v2.0/token
jwksUrl: https://login.microsoftonline.com/<Client ID from step 1>/discovery/v2.0/keys
type: "MICROSOFT"
publicIssuerUrl: https://login.microsoftonline.com/<Client ID from step 1>/v2.0
operate:
clientId: <Client ID from step 1>
audience: <Audience of your application>
audience: <Client ID from step 1>
existingSecret: <Client secret from step 3>
redirectUrl: <See table below>
tasklist:
clientId: <Client ID from step 1>
audience: <Audience of your application>
audience: <Client ID from step 1>
existingSecret: <Client secret from step 3>
redirectUrl: <See table below>
optimize:
clientId: <Client ID from step 1>
audience: <Audience of your application>
audience: <Client ID from step 1>
existingSecret: <Client secret from step 3>
redirectUrl: <See table below>
zeebe:
clientId: <Client ID from step 1>
audience: <Audience of your application>
audience: <Client ID from step 1>
existingSecret: <Client secret from step 3>
tokenScope: "<Client ID from step 1>/.default"
webModeler:
clientId: <Client ID from step 1>
clientApiAudience: <Audience for your application>
clientApiAudience: <Client ID from step 1>
publicApiAudience: <Audience for using Web Modeler's API. For security reasons, use a different value than for clientApiAudience>
redirectUrl: <See table below>
```

<!-- Add ingress and image for completeness?-->

</TabItem>
</Tabs>

Expand All @@ -187,6 +196,12 @@ process.
To successfully authenticate wth Entra ID, you should use the `v2.0` API. This means that
the `CAMUNDA_IDENTITY_ISSUER_BACKEND_URL` value should end with `/v2.0`.

It's also important to follow the [steps described here](https://learn.microsoft.com/en-us/entra/identity-platform/reference-app-manifest#configure-the-app-manifest) to configure the app manifest and set the [accesstokenAcceptedVersion](https://learn.microsoft.com/en-us/entra/identity-platform/reference-app-manifest#accesstokenacceptedversion-attribute) to `2` like so:

```json
"accessTokenAcceptedVersion": 2,
```

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if in here, although its not directly related to this PR, we could add a note to say that the Identity UI is not available in this version? We can then remove this for 8.5 which is when the Identity UI is being introduced?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Ben-Sheppard can you add that in a separate PR or issue? It would be up to you and the Identity team to remember to remove it for 8.5. Is there an epic you can associate this with?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea sure, I can raise a PR and then track it

:::note
Connectors do not yet support authentication with Microsoft Entra ID as the OIDC provider. When using OIDC, set `connectors.inbound.mode: disabled` [in your Connectors Helm values](https://artifacthub.io/packages/helm/camunda/camunda-platform#connectors-parameters).
:::
Expand All @@ -202,3 +217,4 @@ Connectors do not yet support authentication with Microsoft Entra ID as the OIDC
| Optimize | https://<OPTIMIZE_URL>/api/authentication/callback | There is a fallback if you use the existing ENV vars to configure your authentication provider, if you use a custom `yaml`, you need to update your properties to match the new values in this guide.<br/><br/>When using an OIDC provider, the following features are not currently available: User permissions tab in collections, digests, `Alerts` tab in collections. |
| Tasklist | https://<TASKLIST_URL>/identity-callback | |
| Web Modeler | https://<WEB_MODELER_URL>/login-callback | Using a different OIDC provider than Keycloak currently disables all checks of the permissions claim both for using Web Modeler via the UI and via the public API.<br/><br/> Required configuration variables for webapp:<br/>`OAUTH2_CLIENT_ID=[client-id]`<br/>`OAUTH2_JWKS_URL=[provider-jwks-url]`<br/>`OAUTH2_TOKEN_AUDIENCE=[client-audience]`<br/>`OAUTH2_TOKEN_ISSUER=[provider-issuer]`<br/>`OAUTH2_TYPE=[provider-type]`<br/><br/> Required configuration variables for restapi:<br/>`CAMUNDA_IDENTITY_BASEURL=[identity-base-url]`<br/>`CAMUNDA_IDENTITY_TYPE=[provider-type]`<br/>`CAMUNDA_MODELER_SECURITY_JWT_AUDIENCE_INTERNAL_API=[client-audience]`<br/>`CAMUNDA_MODELER_SECURITY_JWT_AUDIENCE_PUBLIC_API=[publicapi-audience]` (for security reasons, <strong>use a different value here than for `CAMUNDA_MODELER_SECURITY_JWT_AUDIENCE_INTERNAL_API`</strong>)<br/>`SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI=[provider-issuer]` |
| Zeebe | no redirect URI | Instead, include `tokenScope:"<Azure-AppRegistration-ClientID> /.default "` |
Loading