Camunda 8.8 (Self‑Managed) + Keycloak: new users get 403 in Operate/Tasklist after 8.7→8.8 migration (old users work)

Camunda 8 Topics
1

We upgraded Camunda Self‑Managed from 8.7 to 8.8. After the migration:

  • Users that already existed in 8.7 can access Operate and Tasklist normally.

  • New users created after the upgrade (created in Keycloak Admin Console) can authenticate, but when they open Operate/Tasklist they get 403 Forbidden.

To troubleshoot, we checked the “current user / permissions” JSON returned by the platform.

Old (working) user shows roles/tenants:

  • authorizedComponents: ["*"]

  • tenants: [{ tenantId: "<default>", name: "Default" }]

  • groups: ["cm-team"]

  • roles: ["operate", "tasklist", "identity", "zeebe", ...]

New (failing) user shows nothing:

  • authorizedComponents: []

  • tenants: []

  • groups: []

  • roles: []

We also tried assigning the new user to the Default tenant in Management Identity / Identity UI, but after logout/login the JSON is still empty and Operate/Tasklist still return 403.

In Management Identity we can see the list of roles (Operate, Tasklist, Zeebe, etc.), but they are not reflected in the effective permissions for the new user.

Question : In 8.8, is there a required change in how new Keycloak users are provisioned/mapped to Identity tenants/roles compared to 8.7?

Environment (can add details):

  • Camunda: 8.8 Self‑Managed (upgraded from 8.7)

  • Identity: enabled (Management Identity UI available)

  • Error: 403 in Operate/Tasklist for newly created users

  • Multitenant enabled

  • external database is used

2

This is a known issue after upgrading from 8.7 to 8.8 - new users get empty permissions because Camunda 8.8 introduced Orchestration Cluster Identity and the Identity migration only migrates existing users, not the authorization setup for new users. I found the following relevant resources:

Does this help? If not, can anyone from the community jump in? :waving_hand:

:light_bulb: Hints: Use the Ask AI feature in Camunda’s documentation to chat with AI and get fast help. Report bugs and features in Camuda’s GitHub issue tracker. Trust the process. :robot:

4

if it is known issue how to add the new users