Camunda 8.8.5 ClientIntilizationService: Please supply valid client secret for orchestration

Camunda 8 Topics
1

Error:

ClientIntilizationService: Please supply valid client secret for orchestration

Using Camunda 8.8.5

Error occurred in the Management Identity. My keycloak and other components are running fine. But identity is getting shutdown giving above error.

2

Hi @vinothkumar,

This error indicates that the Identity component is missing a required client secret configuration for orchestration. This is a common issue in Camunda 8.8.5, particularly when using Helm deployments.

Classification: Problem

Root Cause

The ClientInitializationService in Identity fails when required client secrets are missing or empty. Based on similar cases, this is typically caused by missing orchestration client secret configuration.

Solution

You need to configure the orchestration client secrets in your values.yaml file using the new 8.8+ secret structure:

1. Orchestration OIDC Client Secret

orchestration:
  security:
    authentication:
      oidc:
        secret:
          # For non-production (choose one):
          inlineSecret: "your-orchestration-client-secret"
          # OR for production:
          existingSecret: "your-k8s-secret-name"
          existingSecretKey: "orchestration-secret-key"

2. Orchestration Migration Identity Client Secret (if using external IdP/OIDC)

orchestration:
  migration:
    identity:
      clientId: your-migration-client-id
      secret:
        inlineSecret: "your-migration-client-secret"
        # OR use existingSecret/existingSecretKey pattern

Steps to Fix

  1. Check your current values.yaml for the orchestration.security.authentication.oidc.secret.* and orchestration.migration.identity.secret.* configurations
  2. Ensure you’re using the 8.8+ secret pattern with the secret: { inlineSecret | existingSecret | existingSecretKey } structure
  3. Verify referenced Kubernetes Secrets exist and contain the expected values
  4. Redeploy using helm upgrade after updating your values

Additional Information Needed

To provide more specific guidance, could you please share:

  • Your current values.yaml configuration for the orchestration sections mentioned above
  • The complete Identity error logs
  • Whether you’re using external OIDC/Keycloak integration

References

Let me know if you need help with the specific configuration once you share your current setup!