Unable to configure Camunda C8run 8.8.0-alpha8 with External Identity Provider

devmsaleh · September 28, 2025, 6:24am

I am trying to configure Camunda C8run 8.8.0-alpha8 to work with External Identity Provider (External keycloak)

1- Keycloak configuration:

Created a realm for Camunda
Created a client for Camunda
Added Valid redirect URIs:
http://localhost:8080/auth/login-callback
http://localhost:8081/identity-callback
http://localhost:8082/identity-callback
http://localhost:8083/api/authentication/callback

2- Camunda c8run configuration in .env file:

ELASTICSEARCH_VERSION=8.17.3
CAMUNDA_VERSION=8.8.0-alpha8
CONNECTORS_VERSION=8.8.0-alpha8
COMPOSE_TAG=8.8
COMPOSE_EXTRACTED_FOLDER=docker-compose-8.8
CAMUNDA_IDENTITY_TYPE=GENERIC
CAMUNDA_IDENTITY_BASEURL=http://localhost:8080
CAMUNDA_IDENTITY_ISSUER=http://localhost:9999/realms/camunda-realm
CAMUNDA_IDENTITY_ISSUERBACKENDURL=http://localhost:9999/realms/camunda-realm
CAMUNDA_IDENTITY_CLIENTID=camundaClient
CAMUNDA_IDENTITY_CLIENTSECRET=zWORlgc8c63xVokfHjU0BXV5t693abcd
CAMUNDA_IDENTITY_AUDIENCE=account
IDENTITY_INITIAL_CLAIM_NAME=preferred_username
IDENTITY_INITIAL_CLAIM_VALUE=demo
SPRING_PROFILES_ACTIVE=oidc

When starting c8run using c8run.exe start I can’t see any errors in cmd or in camunda.log and when trying to access /operate it gives whitelable error page but I can see lots of errros in connectors.log file as follows:

2025-09-28T09:16:15.284+03:00  WARN 21448 --- [pool-2-thread-9] io.camunda.client.job.worker             : Failed to stream jobs of type 'io.camunda.agenticai:mcpremoteclient:0' to worker 'MCP Remote Client'

io.grpc.StatusRuntimeException: UNAVAILABLE: io exception
	at io.grpc.Status.asRuntimeException(Status.java:532)
	at io.grpc.stub.ClientCalls$StreamObserverToCallListenerAdapter.onClose(ClientCalls.java:581)
	at io.grpc.internal.ClientCallImpl.closeObserver(ClientCallImpl.java:565)
	at io.grpc.internal.ClientCallImpl.access$100(ClientCallImpl.java:72)
	at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInternal(ClientCallImpl.java:733)
	at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInContext(ClientCallImpl.java:714)
	at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37)
	at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:133)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1575)
Caused by: io.netty.channel.AbstractChannel$AnnotatedConnectException: Connection refused: getsockopt: /127.0.0.1:26500
Caused by: java.net.ConnectException: Connection refused: getsockopt
	at java.base/sun.nio.ch.Net.pollConnect(Native Method)
	at java.base/sun.nio.ch.Net.pollConnectNow(Net.java:682)
	at java.base/sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:1062)
	at io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:336)
	at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:339)
	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:784)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:732)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:658)
	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:1575)

Please advise how to fix this issue

zee-bot · September 29, 2025, 6:28am

Hi @devmsaleh,

Looking at your configuration and the error logs, I can see you’re encountering a connection refused error on port 26500, which is the Zeebe gateway port. This suggests that the Connectors service cannot establish a connection to the Zeebe gateway. Let me help you troubleshoot this issue.

Issues I’ve Identified

1. Environment Variable Naming

I notice some inconsistencies in your environment variable names. Based on the documentation, you should use:

# Correct variable names
CAMUNDA_IDENTITY_BASEURL=http://localhost:8080          # ✅ This looks correct
CAMUNDA_IDENTITY_ISSUER=http://localhost:9999/realms/camunda-realm  # ✅ This looks correct  
CAMUNDA_IDENTITY_ISSUERBACKENDURL=http://localhost:9999/realms/camunda-realm  # ✅ This looks correct
CAMUNDA_IDENTITY_CLIENTID=camundaClient                 # ✅ This looks correct
CAMUNDA_IDENTITY_CLIENTSECRET=zWORlgc8c63xVokfHjU0BXV5t693NaJD  # ✅ This looks correct
CAMUNDA_IDENTITY_AUDIENCE=account                       # ✅ This looks correct

2. Zeebe Gateway Connectivity Issue

The main problem appears to be that the Connectors service cannot reach the Zeebe gateway on port 26500. Here’s how to troubleshoot:

Step 1: Verify Zeebe Gateway is Running

# Test if port 26500 is accessible
netstat -an | findstr :26500
# Or use PowerShell
Test-NetConnection -ComputerName localhost -Port 26500

Step 2: Check Service Startup Order
Make sure all services are starting in the correct order:

Keycloak should be fully started first
Then Zeebe gateway
Finally, other services like Connectors

3. Keycloak Configuration Verification

Ensure your Keycloak client configuration includes:

Client ID: camundaClient
Client Secret: zWORlgc8c63xVokfHjU0BXV5t693NaJD
Valid Redirect URIs: Your list looks comprehensive
Access Type: Should be set to “confidential”
Service Accounts Enabled: Should be enabled

4. Network Configuration

Since you’re using localhost in your configuration, ensure:

All services are running on the same machine
No firewall is blocking port 26500
If using Docker, all containers are on the same network

Recommended Troubleshooting Steps

Check if Zeebe is accessible:
```
c8run status
```

Verify Keycloak connectivity:
Test if your Keycloak endpoint is accessible:

curl http://localhost:9999/realms/camunda-realm/.well-known/openid-configuration

Review all service logs:
- Check camunda.log for Zeebe gateway startup messages
- Check if Identity service is connecting to Keycloak successfully
- Look for authentication-related errors
Try starting services individually:
Sometimes starting services step by step can help identify where the issue occurs.

Additional Configuration Notes

For C8run with external OIDC, you might also want to verify these settings:

Ensure your Keycloak realm has the correct issuer URL
Verify that the account audience is properly configured in Keycloak
Check that the preferred_username claim is available in your tokens

Could you please:

Run the connectivity tests above and share the results?
Check if Zeebe gateway is actually running and listening on port 26500?
Share any relevant logs from camunda.log around the startup time?

This will help us pinpoint whether the issue is with the Zeebe gateway not starting, network connectivity, or authentication configuration.

References:

thorben · September 29, 2025, 12:22pm

Hi,

You can follow this guide for configuring the Orchestration Cluster (Zeebe, Operate, Tasklist, Identity) against an external OIDC provider: Connect Identity to an identity provider | Camunda 8 Docs

Cheers, Thorben

system · December 28, 2025, 12:22pm

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.