Security for Camunda rest-api

[Gabor_Sandor]

Hello

I would like to use the Camunda rest API-s. Do you have any idea how can I set the permission of the REST services?
At the moment everybody who knows the API can call the service without any limitation.
Is there any JWT token like solution for the rest-API-s?

Thanks in advance: Gábor

[aakhmerov]

Hi @Gabor_Sandor,

you can configure authentication in securityFilterRules.json. If you would like to implement extra measures.

Does that help?
Askar.

[menski]

Hi Gabor,

Camunda provides a Basic Auth filter for the REST API (see docs). I’m not aware of a JWT solution but you could implement an own authentication provider and use it instead of the Basic Auth provider.

Cheers,
Sebastian

[Gabor_Sandor]

Thank you very much the quick answer.

[Pieter_Vincken]

Hi Gabor,

We are implementing a JWT base solution for Camunda as well. In this post you can find a few pointers to where you can start the implementation.

Single-Sign-On in Camunda

Hi all, I think I might have found a (relative) simple solution to this problem. It does require custom implementation but I expect I will work (did not have time to test it yet). As per the documentation here you can easily change the authentication mechanism (for the engine-rest app). By implementing a class that implements the org.camunda.bpm.engine.rest.security.auth.AuthenticationProvider interface, you should be able to provide authentication details. An example implementation is provide…

Kind regards

Pieter