Camunda 8.10.0-alpha5 - how to connect process app to SAAS using External IDP?

[firstpostcommenter]

Hi,

I am trying to connect my application to Camunda SAAS using Microsoft IDP.

I get below error:

Neither username claim ($[‘https://camunda.com/meta’\]\['email’]) nor clientId claim (https://camunda.com/clientId) could be found in the claims

I use Java application and Camunda’s camunda-spring-boot-starter library with below config:

camunda:
  client:
    mode: saas
    cloud:
      region: <region>
      cluster-id: <respective cluster id>
    tenant-id: <default>
    auth:
      client-id: azure-app-client-id
      client-secret: secret
      token-url: https://login.microsoft.com/<azure-tenant-id>/oauth2/v2.0/token
      scope: azure-provider-app-client-id/.default

In Camunda cluster IDP configuration I have given the client id claim as “azp” and yet Camunda tries to search for a different claim

How to resolve this?

[zee-bot]

Connecting a Java application to Camunda SaaS with Microsoft Entra ID as an external IdP requires careful configuration of token claims, especially since azp appears in both user and M2M tokens which can cause the claim resolution to fail. I found the following relevant resources:

• Connect an external identity provider – Step 3: Configure the identity provider in Console
• Connect an external identity provider – Considerations for Microsoft Entra ID
• Connect an external identity provider – Troubleshooting
• Troubleshoot OIDC authentication – Claim not found
• JWT token claims reference
• Camunda Spring Boot Starter – Configuration (OIDC authentication)
• Camunda Spring Boot Starter – Properties reference (camunda.client.auth)

Does this help? If not, can anyone from the community jump in?

---

Hints: Use the Ask AI feature in Camunda’s documentation to chat with AI and get fast help. Report bugs and features in Camuda’s GitHub issue tracker. Trust the process.

[firstpostcommenter]

This is an issue in the 8.10-alpha* version. Issue is fixed in 8.10-gen2 version or above