Great question! Yes, the OIDC configuration can be applied to c8run in Camunda 8.8.0! This is a significant improvement from previous versions.
c8run + OIDC Support in Camunda 8.8.0
Key Changes:
- Before 8.8: c8run did NOT support Identity/OIDC integration
- From 8.8 alpha: c8run now includes built-in Identity with OIDC support
- No Docker required: You can now use external identity providers directly with c8run
c8run OIDC Configuration
Method 1: Environment Variables
Set these environment variables before starting c8run:
# Export environment variables
export CAMUNDA_IDENTITY_TYPE=GENERIC
export CAMUNDA_IDENTITY_BASE_URL=http://localhost:8080
export CAMUNDA_IDENTITY_ISSUER=https://your-duende-server.com
export CAMUNDA_IDENTITY_ISSUER_BACKEND_URL=https://your-duende-server.com
export CAMUNDA_IDENTITY_CLIENT_ID=camunda-c8run
export CAMUNDA_IDENTITY_CLIENT_SECRET=your-client-secret
export CAMUNDA_IDENTITY_AUDIENCE=camunda-c8run
export IDENTITY_INITIAL_CLAIM_NAME=sub
export IDENTITY_INITIAL_CLAIM_VALUE=admin-user-id
export SPRING_PROFILES_ACTIVE=oidc
# Then start c8run
./c8run start
Method 2: Configuration File (application.yaml)
Create an application.yaml file in your c8run directory:
camunda:
identity:
type: GENERIC
baseUrl: http://localhost:8080
issuer: https://your-duende-server.com
issuerBackendUrl: https://your-duende-server.com
clientId: camunda-c8run
clientSecret: your-client-secret
audience: camunda-c8run
initialClaimName: sub
initialClaimValue: admin-user-id
spring:
profiles:
active: oidc
Duende Identity Server Setup for c8run
Register a single client in Duende for c8run:
new Client
{
ClientId = "camunda-c8run",
ClientSecrets = { new Secret("your-client-secret".Sha256()) },
AllowedGrantTypes = GrantTypes.Code,
RedirectUris = {
"http://localhost:8080/auth/login-callback", // Identity
"http://localhost:8081/identity-callback", // Tasklist
"http://localhost:8082/identity-callback", // Operate
"http://localhost:8083/api/authentication/callback" // Optimize
},
AllowedScopes = { "openid", "profile", "email" },
AllowOfflineAccess = true,
AllowedCorsOrigins = {
"http://localhost:8080",
"http://localhost:8081",
"http://localhost:8082",
"http://localhost:8083"
}
}
Complete c8run Setup Steps
1. Configure Duende Identity Server
- Register the c8run client with appropriate redirect URIs
- Configure CORS for localhost ports
- Set up proper scopes and claims
2. Configure c8run
- Set environment variables OR create application.yaml
- Ensure all URLs point to your Duende server
- Use consistent client ID and secret
3. Start c8run
# With environment variables
./c8run start
# Or specify config file
./c8run start --spring.config.location=application.yaml
4. Test the Integration
- Access Tasklist:
http://localhost:8081
- You’ll be redirected to Duende for authentication
- After login, you’ll be redirected back to Camunda
- Use APIs with Bearer tokens from Duende
Important Notes
Limitations:
- Alpha Feature: The new Identity in 8.8.0 is still in alpha
- Local Development: Primarily designed for development/evaluation
- Single Client: c8run typically uses one client for all components
Advantages:
- No Docker Required: Direct OIDC integration without containers
- Simplified Setup: Built-in Identity eliminates Keycloak dependency
- Full API Support: All task operations work with external IdP tokens
References
This setup gives you the complete user flow you wanted: Duende authentication → c8run APIs → task operations → audit trail - all in a local development environment!
Would you like me to help you troubleshoot any specific part of the c8run OIDC setup?
Your Requirements - All Supported
Next Steps
Key Configuration Points
Do NOT enforce Candidate Users/Groups by default
Updated Implementation Checklist