ProcessDefinitionImporter Failed to import process elements Failed with code 401: 'Unauthorized'

Camunda 8 Topics
1

Hi, I am using Camunda c8run 8.8.0-alpha8 on Windows

And I am trying to configure it to work with the External Identity Provider (Keycloak)

1- c8run\configuration\application.yaml

spring:
  profiles:
    active: 'identity,operate,tasklist,broker,consolidated-auth'
management:
  server:
    port: 9600
server:
  forward-headers-strategy: none
  address: 0.0.0.0
zeebe:
  host: 0.0.0.0
  log:
    level: info
  broker:
    gateway:
      enable: true
      network:
        host: 0.0.0.0
        port: 26500
    network:
      host: 0.0.0.0
      commandApi:
        port: 26501
      internalApi:
        port: 26502
    data:
      snapshotPeriod: 5m
      freeSpace:
        processing: 2GB
        replication: 3GB
    threads:
      cpuThreadCount: '3'
      ioThreadCount: '3'
    exporters:
      elasticsearch:
        className: io.camunda.zeebe.exporter.ElasticsearchExporter
        args:
          url: 'http://elasticsearch:9200'
          index:
            prefix: zeebe-record
      CamundaExporter:
        className: io.camunda.exporter.CamundaExporter
        args:
          connect:
            type: elasticsearch
            url: 'http://elasticsearch:9200'
          createSchema: true
camunda:
  persistent:
    sessions:
      enabled: true
  rest:
    query:
      enabled: true
  security:
    csrf:
      enabled: false
    initialization:
      defaultRoles:
        admin:
          users:
            - demo
          clients:
            - zeebe-api
    authentication:
      method: oidc
      oidc:
        client-id: camundaClient
        client-secret: zWORlgc8c63xVokfHjU0BXV5t693NaJD
        issuer-uri: 'http://localhost:9999/realms/camunda-realm'
        redirect-uri: 'http://localhost:8080/sso-callback'
        username-claim: preferred_username
        groups-claim: role
        client-id-claim: client_id
        audiences:
          - camundaClient
          - camunda-api
          - zeebe-api
          - web-modeler-api
        scope:
          - openid
          - profile
          - email
          - offline_access
          - camunda-api
      unprotectedApi: false
    authorizations:
      enabled: true

2- c8run\connectors-application.properties:

zeebe.client.broker.gateway-address=http://127.0.0.1:26500
zeebe.client.security.plaintext=true
camunda.operate.client.url=http://localhost:8080
camunda.operate.client.username=demo
camunda.operate.client.password=demo
server.port=8086
camunda.client.mode=self-managed
camunda.client.grpc-address=http://localhost:26500 
camunda.client.rest-address=http://localhost:8080 
camunda.client.auth.client-id=zeebe-api 
camunda.client.auth.client-secret=v9vUU1kdYOSeSSAGOfPZL4RjXOHKPrZe camunda.client.auth.audience=zeebe-api 
camunda.client.auth.scope=zeebe-api 
camunda.client.auth.token-url=http://localhost:9999/realms/camunda-realm/protocol/openid-connect/token

When working with operate or identity or tasklist it works fine and it redirects me to my external IDP login page and after successful login it redirects me back to operate or identity or tasklist page

but I can see errors in my connectors.log as follows:

2025-10-01T21:42:58.534+03:00 ERROR 17552 — [ scheduling-1] i.c.c.r.i.i.ProcessDefinitionImporter : Failed to import process elements

io.camunda.client.api.command.ClientException: io.camunda.client.api.command.ClientHttpException: Failed with code 401: ‘Unauthorized’
at io.camunda.client.impl.http.HttpCamundaFuture.unwrapExecutionException(HttpCamundaFuture.java:87)
at io.camunda.client.impl.http.HttpCamundaFuture.join(HttpCamundaFuture.java:43)
at io.camunda.connector.runtime.inbound.search.SearchQueryClientImpl.queryProcessDefinitions(SearchQueryClientImpl.java:48)
at io.camunda.connector.runtime.inbound.importer.ProcessDefinitionSearch.query(ProcessDefinitionSearch.java:54)
at io.camunda.connector.runtime.inbound.importer.ProcessDefinitionImporter.scheduleImport(ProcessDefinitionImporter.java:54)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at org.springframework.scheduling.support.ScheduledMethodRunnable.runInternal(ScheduledMethodRunnable.java:130)
at org.springframework.scheduling.support.ScheduledMethodRunnable.lambda$run$2(ScheduledMethodRunnable.java:124)
at io.micrometer.observation.Observation.observe(Observation.java:498)
at org.springframework.scheduling.support.ScheduledMethodRunnable.run(ScheduledMethodRunnable.java:124)
at org.springframework.scheduling.config.Task$OutcomeTrackingRunnable.run(Task.java:85)
at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:358)
at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1575)
Caused by: io.camunda.client.api.command.ClientHttpException: Failed with code 401: ‘Unauthorized’
at io.camunda.client.impl.http.ApiCallback.handleErrorResponse(ApiCallback.java:90)
at io.camunda.client.impl.http.ApiCallback.completed(ApiCallback.java:64)
at io.camunda.client.impl.http.ApiCallback.completed(ApiCallback.java:32)
at org.apache.hc.core5.concurrent.BasicFuture.completed(BasicFuture.java:148)
at org.apache.hc.core5.concurrent.ComplexFuture.completed(ComplexFuture.java:72)
at org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient$2$1.completed(InternalAbstractHttpAsyncClient.java:321)
at org.apache.hc.core5.http.nio.support.AbstractAsyncResponseConsumer$1.completed(AbstractAsyncResponseConsumer.java:101)
at org.apache.hc.core5.http.nio.entity.AbstractBinAsyncEntityConsumer.completed(AbstractBinAsyncEntityConsumer.java:87)
at org.apache.hc.core5.http.nio.entity.AbstractBinDataConsumer.streamEnd(AbstractBinDataConsumer.java:83)
at org.apache.hc.core5.http.nio.support.AbstractAsyncResponseConsumer.streamEnd(AbstractAsyncResponseConsumer.java:142)
at org.apache.hc.client5.http.impl.async.HttpAsyncMainClientExec$1.streamEnd(HttpAsyncMainClientExec.java:283)
at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamHandler.dataEnd(ClientHttp1StreamHandler.java:285)
at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamDuplexer.dataEnd(ClientHttp1StreamDuplexer.java:371)
at org.apache.hc.core5.http.impl.nio.AbstractHttp1StreamDuplexer.onInput(AbstractHttp1StreamDuplexer.java:340)
at org.apache.hc.core5.http.impl.nio.AbstractHttp1IOEventHandler.inputReady(AbstractHttp1IOEventHandler.java:64)
at org.apache.hc.core5.http.impl.nio.ClientHttp1IOEventHandler.inputReady(ClientHttp1IOEventHandler.java:41)
at org.apache.hc.core5.reactor.InternalDataChannel.onIOEvent(InternalDataChannel.java:143)
at org.apache.hc.core5.reactor.InternalChannel.handleIOEvent(InternalChannel.java:51)
at org.apache.hc.core5.reactor.SingleCoreIOReactor.processEvents(SingleCoreIOReactor.java:176)
at org.apache.hc.core5.reactor.SingleCoreIOReactor.doExecute(SingleCoreIOReactor.java:125)
at org.apache.hc.core5.reactor.AbstractSingleCoreIOReactor.execute(AbstractSingleCoreIOReactor.java:92)
at org.apache.hc.core5.reactor.IOReactorWorker.run(IOReactorWorker.java:44)

Please advise why I am getting this exception and how to fix it.

2

Hi @devmsaleh,

I can see you’re experiencing a 401 Unauthorized error with the ProcessDefinitionImporter when trying to configure c8run 8.8.0-alpha8 with Keycloak as an external identity provider. This is a Problem that typically indicates an authentication configuration issue.

Looking at your configuration, I notice a few potential issues:

Main Issues Identified:

1. Profile Configuration

Your current profile configuration includes consolidated-auth, but for OIDC authentication with external identity providers like Keycloak, you should use the oidc profile instead:

spring:
  profiles:
    active: "identity,operate,tasklist,broker,oidc"  # Use 'oidc' instead of 'consolidated-auth'

2. Configuration Structure

Your configuration uses a security section, but c8run 8.8.0 expects the OIDC configuration under camunda.identity. Here’s the correct structure:

camunda:
  identity:
    type: KEYCLOAK
    baseUrl: http://localhost:8080
    issuer: http://localhost:9999/realms/camunda-realm
    issuerBackendUrl: http://localhost:9999/realms/camunda-realm
    clientId: camundaClient
    clientSecret: zWORlgc8c63xVokfHjU0BXV5t693NaJD
    audience: camundaClient
    initialClaimName: preferred_username
    initialClaimValue: demo  # or your admin user

3. Common Causes of 401 Errors:

  • Incorrect client credentials: Ensure the clientId and clientSecret in your configuration exactly match those in your Keycloak realm
  • Wrong issuer URL: Verify that http://localhost:9999/realms/camunda-realm is accessible and correct
  • Missing client configuration in Keycloak: Ensure your Keycloak client is properly configured with the correct redirect URIs and grant types
  • Keycloak service not ready: Make sure Keycloak is fully started before starting c8run

Recommended Configuration:

Replace your current application.yaml with:

spring:
  profiles:
    active: "identity,operate,tasklist,broker,oidc"

management:
  server:
    port: 9600

server:
  forward-headers-strategy: none
  address: 0.0.0.0

zeebe:
  host: 0.0.0.0
  log:
    level: "info"

broker:
  gateway:
    enable: true
    network:
      host: 0.0.0.0
      port: 26500
  network:
    host: 0.0.0.0
    commandApi:
      port: 26501
    internalApi:
      port: 26502
  data:
    snapshotPeriod: 5m
    freeSpace:
      processing: 2GB
      replication: 3GB
  threads:
    cpuThreadCount: "3"
    ioThreadCount: "3"
  exporters:
    elasticsearch:
      className: "io.camunda.zeebe.exporter.ElasticsearchExporter"
      args:
        url: "http://elasticsearch:9200"
        index:
          prefix: "zeebe-record"
    CamundaExporter:
      className: "io.camunda.exporter.CamundaExporter"
      args:
        connect:
          type: elasticsearch
          url: "http://elasticsearch:9200"
        createSchema: true

camunda:
  persistent:
    sessions:
      enabled: true
  identity:
    type: KEYCLOAK
    baseUrl: http://localhost:8080
    issuer: http://localhost:9999/realms/camunda-realm
    issuerBackendUrl: http://localhost:9999/realms/camunda-realm
    clientId: camundaClient
    clientSecret: zWORlgc8c63xVokfHjU0BXV5t693NaJD
    audience: camundaClient
    initialClaimName: preferred_username
    initialClaimValue: demo

rest:
  query:
    enabled: true

Next Steps:

  1. Update your configuration as shown above
  2. Verify your Keycloak client configuration matches the clientId and clientSecret
  3. Ensure Keycloak is running and accessible at http://localhost:9999
  4. Check both c8run and Keycloak logs for more detailed error messages

If you continue to see 401 errors after making these changes, please share:

  • Your Keycloak client configuration
  • Any relevant log entries from both c8run and Keycloak
  • Confirmation that you can access the Keycloak issuer URL directly

References:

Let me know how this works for you!

3

@zee-bot can you please refer to engineering team to tell them add more details to this exception in next release, so that we should know what client_id is facing the errror, and what permissions is missing ?
because when I monitor my keycloak logs in the same time, I can’t see any unauthorized requests coming !!!