Unauthorized You don’t have access to this resource

Camunda 8 Topics Discussion & Questions
1

  • I have been trying to run the camunda 8 development setup in a centralized development server using Keycloak Instance.

  • When I try to assign application operate permission. It shows Unauthorized
    You don’t have access to this resource    .

  • Underlying response to the post call is showing response of Invalid CORS request permissions

  • But in the local development server it is working perfectly without any issues.

2

Hi @Zoltan_Karolyi - depending on how you have it deployed, you may need a reverse proxy in front of the resources. We typically recommend using an API between your front-end client and Camunda to prevent accidentally allowing external users to call the Camunda API’s directly.

3

Hi Nathan,

Thank you for your answer.
I upgraded Camunda 7 on Camunda 8. I use Identity,tasklist,operate,optimize,connectors,zeebe components with Keycloak.
Everything run in Docker. I installed Camunda 8 with 8.5.0 version.
When I entered in the Identity (camunda-platform) I could not modify or delete anything because I get this error message:
for example:
https://domain/api/clients

Request Method:

POST
Status Code:
403 Forbidden (from service worker)
Invalid CORS request

but It seems that all GET request are work and get 200 OK. answer.
But in the local development server it is working perfectly without any issues.
I use default demo user. If I add permisson or remove one in Keycloak on camunda-platform client then I see the changes in Identity admin page.

Please help me. Thank you!

Screenshot 2024-04-12 234955
Screenshot 2024-04-12 2349551891×821 52.2 KB

services:

  zeebe:
    image: camunda/zeebe:8.5.0
    container_name: zeebe
    ports:
      - "26500:26500"
      - "9600:9600"
    expose:
      - "26500:26500"
      - "9600:9600"
    environment:
      - ZEEBE_BROKER_GATEWAY_SECURITY_AUTHENTICATION_MODE=identity
      - ZEEBE_BROKER_GATEWAY_SECURITY_AUTHENTICATION_IDENTITY_ISSUERBACKENDURL=http://keycloak:8080/auth/realms/camunda-platform
      - ZEEBE_BROKER_GATEWAY_SECURITY_AUTHENTICATION_IDENTITY_AUDIENCE=zeebe-api
      - ZEEBE_BROKER_GATEWAY_SECURITY_AUTHENTICATION_IDENTITY_BASEURL=http://identity:8084
      - ZEEBE_BROKER_GATEWAY_MULTITENANCY_ENABLED=false
      - ZEEBE_BROKER_EXPORTERS_ELASTICSEARCH_CLASSNAME=io.camunda.zeebe.exporter.ElasticsearchExporter
      - ZEEBE_BROKER_EXPORTERS_ELASTICSEARCH_ARGS_URL=http://elasticsearch:9200
      - ZEEBE_BROKER_EXPORTERS_ELASTICSEARCH_ARGS_BULK_SIZE=1
      - ZEEBE_BROKER_DATA_DISKUSAGECOMMANDWATERMARK=0.998
      - ZEEBE_BROKER_DATA_DISKUSAGEREPLICATIONWATERMARK=0.999
      - ZEEBE_LOG_LEVEL=debug
      - "JAVA_TOOL_OPTIONS=-Xms512m -Xmx512m"
    restart: always
    healthcheck:
      test: [ "CMD-SHELL", "timeout 10s bash -c ':> /dev/tcp/127.0.0.1/9600' || exit 1" ]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s
    volumes:
      - zeebe:/usr/local/zeebe/data
    networks:
      - interswarm
    depends_on:
      - elasticsearch
      - identity

  operate:
    image: camunda/operate:8.5.0
    container_name: operate
    ports:
      - "8081:8080"
    environment:
      - CAMUNDA_OPERATE_ZEEBE_GATEWAYADDRESS=zeebe:26500
      - ZEEBE_CLIENT_ID=zeebe
      - ZEEBE_CLIENT_SECRET=zeebe
      - ZEEBE_TOKEN_AUDIENCE=zeebe-api
      - ZEEBE_AUTHORIZATION_SERVER_URL=http://keycloak:8080/auth/realms/camunda-platform/protocol/openid-connect/token
      - CAMUNDA_OPERATE_ELASTICSEARCH_URL=http://elasticsearch:9200
      - CAMUNDA_OPERATE_ZEEBEELASTICSEARCH_URL=http://elasticsearch:9200
      - SPRING_PROFILES_ACTIVE=identity-auth
      - CAMUNDA_OPERATE_IDENTITY_BASEURL=http://identity:8084
      - CAMUNDA_OPERATE_IDENTITY_ISSUER_URL=http://readylocal:8080/auth/realms/camunda-platform
      - CAMUNDA_OPERATE_IDENTITY_ISSUER_BACKEND_URL=http://keycloak:8080/auth/realms/camunda-platform
      - CAMUNDA_OPERATE_IDENTITY_CLIENTID=operate
      - CAMUNDA_OPERATE_IDENTITY_CLIENTSECRET=fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      - CAMUNDA_OPERATE_IDENTITY_AUDIENCE=operate-api
      - CAMUNDA_OPERATE_MULTITENANCY_ENABLED=false
      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI=http://keycloak:8080/auth/realms/camunda-platform
      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI=http://keycloak:8080/auth/realms/camunda-platform/protocol/openid-connect/certs
      - CAMUNDA_OPERATE_IDENTITY_RESOURCEPERMISSIONSENABLED=false
      - management.endpoints.web.exposure.include=health
      - management.endpoint.health.probes.enabled=true
      - ZEEBE_CLIENT_CONFIG_PATH=/tmp/zeebe_auth_cache
    healthcheck:
      test: [ "CMD-SHELL", "wget -O - -q 'http://localhost:8080/actuator/health/readiness'" ]
      interval: 30s
      timeout: 1s
      retries: 5
      start_period: 30s
    volumes:
      - operate_tmp:/tmp
    networks:
      - interswarm
    depends_on:
      - zeebe
      - identity
      - elasticsearch

  tasklist:
    image: camunda/tasklist:8.5.0
    container_name: tasklist
    ports:
      - "8082:8080"
    environment:
      - CAMUNDA_TASKLIST_ZEEBE_GATEWAYADDRESS=zeebe:26500
      - ZEEBE_CLIENT_ID=zeebe
      - ZEEBE_CLIENT_SECRET=zeebe
      - ZEEBE_CLIENT_CONFIG_PATH=/tmp/zeebe_auth_cache
      - ZEEBE_TOKEN_AUDIENCE=zeebe-api
      - ZEEBE_AUTHORIZATION_SERVER_URL=http://keycloak:8080/auth/realms/camunda-platform/protocol/openid-connect/token
      - CAMUNDA_TASKLIST_ELASTICSEARCH_URL=http://elasticsearch:9200
      - CAMUNDA_TASKLIST_ZEEBEELASTICSEARCH_URL=http://elasticsearch:9200
      - SPRING_PROFILES_ACTIVE=identity-auth
      - CAMUNDA_TASKLIST_IDENTITY_BASEURL=http://identity:8084
      - CAMUNDA_TASKLIST_IDENTITY_ISSUER_URL=http://readylocal:8080/auth/realms/camunda-platform
      - CAMUNDA_TASKLIST_IDENTITY_ISSUER_BACKEND_URL=http://keycloak:8080/auth/realms/camunda-platform
      - CAMUNDA_TASKLIST_IDENTITY_CLIENTID=tasklist
      - CAMUNDA_TASKLIST_IDENTITY_CLIENTSECRET=fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      - CAMUNDA_TASKLIST_IDENTITY_AUDIENCE=tasklist-api
      - CAMUNDA_TASKLIST_MULTITENANCY_ENABLED=false
      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI=http://readylocal:8080/auth/realms/camunda-platform
      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI=http://readylocal:8080/auth/realms/camunda-platform/protocol/openid-connect/certs
      - CAMUNDA_TASKLIST_IDENTITY_RESOURCE_PERMISSIONS_ENABLED=false
      - management.endpoints.web.exposure.include=health
      - management.endpoint.health.probes.enabled=true
    healthcheck:
      test: [ "CMD-SHELL", "wget -O - -q 'http://localhost:8080/actuator/health/readiness'" ]
      interval: 30s
      timeout: 1s
      retries: 5
      start_period: 30s
    volumes:
      - tasklist_tmp:/tmp
    networks:
      - interswarm
    depends_on:
      zeebe:
        condition: service_started
      elasticsearch:
        condition: service_healthy
      identity:
        condition: service_healthy

  connectors:
    image: camunda/connectors-bundle:8.5.0
    container_name: connectors
    ports:
      - "8085:8080"
    environment:
      - ZEEBE_CLIENT_BROKER_GATEWAY-ADDRESS=zeebe:26500
      - ZEEBE_CLIENT_SECURITY_PLAINTEXT=true
      - ZEEBE_CLIENT_ID=zeebe
      - ZEEBE_CLIENT_SECRET=zeebe
      - ZEEBE_CLIENT_CONFIG_PATH=/tmp/zeebe_auth_cache
      - ZEEBE_TOKEN_AUDIENCE=zeebe-api
      - ZEEBE_AUTHORIZATION_SERVER_URL=http://keycloak:8080/auth/realms/camunda-platform/protocol/openid-connect/token
      - CAMUNDA_OPERATE_CLIENT_URL=http://operate:8080
      - CAMUNDA_OPERATE_CLIENT_CLIENT-ID=operate
      - CAMUNDA_OPERATE_CLIENT_CLIENT-SECRET=fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      - CAMUNDA_IDENTITY_BASE_URL=http://identity:8084
      - CAMUNDA_IDENTITY_ISSUER=http://readylocal:8080/auth/realms/camunda-platform
      - CAMUNDA_IDENTITY_ISSUER_BACKEND_URL=http://keycloak:8080/auth/realms/camunda-platform
      - CAMUNDA_IDENTITY_CLIENT_ID=connectors
      - CAMUNDA_IDENTITY_CLIENT_SECRET=fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      - CAMUNDA_IDENTITY_TYPE=KEYCLOAK
      - CAMUNDA_IDENTITY_AUDIENCE=connectors
      - management.endpoints.web.exposure.include=health
      - management.endpoint.health.probes.enabled=true
      - "JAVA_TOOL_OPTIONS=-Dlogging.level.io.camunda.zeebe.client.impl.ZeebeCallCredentials=ERROR"
    env_file: connector-secrets.txt
    healthcheck:
      test: [ "CMD-SHELL", "curl -f http://localhost:8080/actuator/health/readiness" ]
      interval: 30s
      timeout: 1s
      retries: 5
      start_period: 30s
    networks:
      - interswarm
    depends_on:
      - zeebe
      - operate
      - identity

  optimize:
    image: camunda/optimize:8.5.0
    container_name: optimize
    ports:
      - "8086:8090"
    environment:
      - OPTIMIZE_ELASTICSEARCH_HOST=elasticsearch
      - OPTIMIZE_ELASTICSEARCH_HTTP_PORT=9200
      - SPRING_PROFILES_ACTIVE=ccsm
      - CAMUNDA_OPTIMIZE_ZEEBE_ENABLED=true
      - CAMUNDA_OPTIMIZE_ENTERPRISE=false
      - CAMUNDA_OPTIMIZE_IDENTITY_ISSUER_URL=http://readylocal:8080/auth/realms/camunda-platform
      - CAMUNDA_OPTIMIZE_IDENTITY_ISSUER_BACKEND_URL=http://keycloak:8080/auth/realms/camunda-platform
      - CAMUNDA_OPTIMIZE_IDENTITY_CLIENTID=optimize
      - CAMUNDA_OPTIMIZE_IDENTITY_CLIENTSECRET=fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      - CAMUNDA_OPTIMIZE_IDENTITY_AUDIENCE=optimize-api
      - CAMUNDA_OPTIMIZE_IDENTITY_BASE_URL=http://identity:8084
      - CAMUNDA_OPTIMIZE_MULTITENANCY_ENABLED=false
      - CAMUNDA_OPTIMIZE_SECURITY_AUTH_COOKIE_SAME_SITE_ENABLED=false
      - CAMUNDA_OPTIMIZE_UI_LOGOUT_HIDDEN=true  2
      - management.endpoints.web.exposure.include=health
      - management.endpoint.health.probes.enabled=true
    healthcheck:
      test: [ "CMD-SHELL", "curl -f http://localhost:8090/api/readyz" ]
      interval: 30s
      timeout: 1s
      retries: 5
      start_period: 30s
    volumes:
      - "./.optimize/environment-config.yaml:/optimize/config/environment-config.yaml"
    restart: on-failure
    networks:
      - interswarm
    depends_on:
      - identity
      - elasticsearch

  identity:
    container_name: identity
    image: camunda/identity:8.5.0
    ports:
      - "8084:8084"
    expose:
      - "8084:8084"
    environment:
      SERVER_PORT: 8084
      IDENTITY_RETRY_DELAY_SECONDS: 30
      KEYCLOAK_URL: http://readylocal:8080/auth
      IDENTITY_AUTH_PROVIDER_BACKEND_URL: http://keycloak:8080/auth/realms/camunda-platform
      IDENTITY_AUTH_PROVIDER_ISSUER_URL: http://readylocal:8080/auth/realms/camunda-platform
      KEYCLOAK_INIT_OPERATE_SECRET: fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      KEYCLOAK_INIT_OPERATE_ROOT_URL: http://localhost:8081
      KEYCLOAK_INIT_TASKLIST_SECRET: fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      KEYCLOAK_INIT_TASKLIST_ROOT_URL: http://localhost:8082
      KEYCLOAK_INIT_OPTIMIZE_SECRET: fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      KEYCLOAK_INIT_OPTIMIZE_ROOT_URL: http://localhost:8083
      KEYCLOAK_INIT_CONNECTORS_SECRET: fETczEXF7Uuk3QMkt4y36KLEcvIkngV8
      KEYCLOAK_INIT_CONNECTORS_ROOT_URL: http://localhost:8085
      KEYCLOAK_INIT_ZEEBE_NAME: zeebe
      KEYCLOAK_USERS_0_USERNAME: demo
      KEYCLOAK_USERS_0_PASSWORD: demo
      KEYCLOAK_USERS_0_FIRST_NAME: demo
      KEYCLOAK_USERS_0_EMAIL: demo@demo.hu
      KEYCLOAK_USERS_0_ROLES_0: Identity
      KEYCLOAK_USERS_0_ROLES_1: Optimize
      KEYCLOAK_USERS_0_ROLES_2: Operate
      KEYCLOAK_USERS_0_ROLES_3: Tasklist
      KEYCLOAK_SETUP_USER: voszportadmin
      KEYCLOAK_SETUP_PASSWORD: reparetekmogyoro
      IDENTITY_URL: http://localhost:8084
      IDENTITY_LOG_LEVEL: TRACE
      #      IDENTITY_CLIENT_ID: camunda-identity
#      IDENTITY_CLIENT_SECRET: y0uVq8FKYj3HKVs24mfDRy014d7JUWOE
#      KEYCLOAK_REALM: camunda-platform
      KEYCLOAK_CLIENTS_0_NAME: zeebe
      KEYCLOAK_CLIENTS_0_ID: zeebe
      KEYCLOAK_CLIENTS_0_SECRET: zeebe
      KEYCLOAK_CLIENTS_0_TYPE: M2M
      KEYCLOAK_CLIENTS_0_PERMISSIONS_0_RESOURCE_SERVER_ID: zeebe-api
      KEYCLOAK_CLIENTS_0_PERMISSIONS_0_DEFINITION: write:*
      MULTITENANCY_ENABLED: false
      RESOURCE_PERMISSIONS_ENABLED: false
    healthcheck:
      test: [ "CMD", "wget", "-q", "--tries=1", "--spider", "http://localhost:8082/actuator/health" ]
      interval: 5s
      timeout: 15s
      retries: 30
      start_period: 60s
    restart: on-failure
    networks:
      - interswarm

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.1
    container_name: elasticsearch
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      - bootstrap.memory_lock=true
      - discovery.type=single-node
      - xpack.security.enabled=false
      # allow running with low disk space
      - cluster.routing.allocation.disk.threshold_enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    restart: always
    healthcheck:
      test: [ "CMD-SHELL", "curl -f http://localhost:9200/_cat/health | grep -q green" ]
      interval: 30s
      timeout: 5s
      retries: 3
    volumes:
      - elastic:/usr/share/elasticsearch/data
    networks:
      - interswarm

volumes:
  zeebe:
  elastic:
  operate_tmp:
  tasklist_tmp:

networks:
  interswarm:
    name: interswarm
    external: true

Keycloak:

image
image1376×908 69.7 KB

4

Hi @Zoltan_Karolyi - apologies for a late reply, I was on holiday for a short time. I am not a Docker networking expert, but I’m confused why you have both readylocal and keycloak used as hosts for Identity and/or Keycloak. That would be the first thing I would investigate. A domain name mismatch could lead to CORS errors.

      IDENTITY_AUTH_PROVIDER_BACKEND_URL: http://keycloak:8080/auth/realms/camunda-platform
      IDENTITY_AUTH_PROVIDER_ISSUER_URL: http://readylocal:8080/auth/realms/camunda-platform