Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

renaming sm identity and misc #2605

Merged
merged 4 commits into from
Sep 21, 2023
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@ create or update the following entities in Keycloak:

### Client scopes

| Name | Protocol | Description |
| ---------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| camunda-identity | openid-connect | A default client scope that contains mappers to augment the token generated with information required by the components of Camunda Platform. Contains the mappers described in the [mappers](#mappers) section. |
| Name | Protocol | Description |
| ---------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| camunda-identity | openid-connect | A default client scope that contains mappers to augment the token generated with information required by the components of Camunda. Contains the mappers described in the [mappers](#mappers) section. |

### Mappers

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ To configure an external identity provider like OpenID Connect, SAML, LDAP, or A
[Docker Compose](/self-managed/platform-deployment/docker.md#docker-compose) setup, Keycloak
is available at [http://localhost:18080/](http://localhost:18080/).
:::
2. Click **Administrator Console** and log in using the Keycloak administrator credentials. The default administrator username is `admin`. When deploying Camunda Platform 8 with [Helm charts](/self-managed/platform-deployment/helm-kubernetes/overview.md),
2. Click **Administrator Console** and log in using the Keycloak administrator credentials. The default administrator username is `admin`. When deploying Camunda 8 with [Helm charts](/self-managed/platform-deployment/helm-kubernetes/overview.md),
you can extract the password as described in
[secrets extraction](/self-managed/platform-deployment/helm-kubernetes/upgrade.md#secrets-extraction).
Using the example [Docker Compose](/self-managed/platform-deployment/docker.md#docker-compose)
setup, the password is set via `KEYCLOAK_ADMIN_PASSWORD` environment variable and is `admin` per default.
3. Select the realm you are using with Camunda Platform 8. By default, this is **Camunda-platform**.
3. Select the realm you are using with Camunda 8. By default, this is **Camunda-platform**.
![keycloak-realm-select](../img/keycloak-admin-realm-select.png)
4. Add an identity provider using one of the following methods:
1. To add an OpenID Connect or SAML provider, select **Identity Providers** in the main menu, click **Add provider...**, and fill in all required configuration settings.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ To connect Identity to an existing Keycloak instance, take the following steps:
![keycloak-admin-client-update-2](../img/keycloak-admin-client-update-2.png)
9. Select the `manage-clients`, `manage-realm`, and `manage-users` role from the list and click **Assign**.
:::note Why does Identity need these roles?
Identity is designed to allow users to manage the various entities related to the Camunda Platform. To achieve this, it requires specific access to the realm.
Identity is designed to allow users to manage the various entities related to Camunda. To achieve this, it requires specific access to the realm.
:::
10. Navigate to the **Credentials** tab and copy the client secret.
11. Set the `IDENTITY_CLIENT_SECRET` [environment variable](/docs/self-managed/identity/deployment/configuration-variables.md) with the value from **Step 9**.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ To ensure recovery is possible, we recommend regularly backing up the database s

#### Helm deployment

If you deployed Camunda Platform 8 using our [Helm charts](../../../platform-deployment/helm-kubernetes/overview.md),
If you deployed Camunda 8 using our [Helm charts](../../../platform-deployment/helm-kubernetes/overview.md),
by default there will be a Postgres database deployed with it. In this instance, we recommend reading the
[Postgres documentation](https://www.postgresql.org/docs/current/backup.html) for guidance on backing up.

Expand Down
4 changes: 2 additions & 2 deletions docs/self-managed/identity/what-is-identity.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@
id: what-is-identity
title: "What is Identity?"
sidebar_label: "What is Identity?"
description: "Identity is the component within the Camunda Platform 8 stack responsible for authentication and authorization."
description: "Identity is the component within the Camunda 8 stack responsible for authentication and authorization."
---

:::note Looking for IAM documentation?
From version 8.0.0+ the IAM component has been replaced with the Identity component.
:::

Identity is the component within the Camunda Platform 8 stack responsible for authentication and authorization. It allows you to manage:
Identity is the component within the Camunda 8 stack responsible for authentication and authorization. It allows you to manage:

- Applications
- APIs
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ Web Modeler Self-Managed is available to [enterprise customers](../../../../refe
The different components of Web Modeler Self-Managed can be configured using environment variables. Each component's variables are described below.

- For a working example configuration showing how the components are correctly wired together, see the [Docker Compose file for Web Modeler](../../../platform-deployment/docker#web-modeler-1).
- If you are using the Camunda Platform 8 [Helm chart](../../../platform-deployment/helm-kubernetes/deploy.md) to set up Web Modeler, read more about the different configuration options in the chart's [README file](https://github.com/camunda/camunda-platform-helm/blob/main/charts/camunda-platform/README.md#web-modeler).
- If you are using the Camunda 8 [Helm chart](../../../platform-deployment/helm-kubernetes/deploy.md) to set up Web Modeler, read more about the different configuration options in the chart's [README file](https://github.com/camunda/camunda-platform-helm/blob/main/charts/camunda-platform/README.md#web-modeler).

## Configuration of the `restapi` component

Expand Down Expand Up @@ -98,7 +98,7 @@ Refer to the [Advanced Logging Configuration Guide](./logging.md#logging-configu
| `OAUTH2_TOKEN_ISSUER` | URL of the token issuer (used for JWT validation). | `https://keycloak.example.com/auth/realms/camunda-platform` | - |
| `KEYCLOAK_BASE_URL` | Base URL of the Keycloak instance. | `https://keycloak.example.com` | - |
| `KEYCLOAK_CONTEXT_PATH` | [optional]<br/>Context path Keycloak serves resources on.<br/>_Note_: With Keycloak 17, the default path was changed from `/auth` to `/`. | `/` | `/auth` |
| `KEYCLOAK_REALM` | Keycloak realm used for Camunda Platform. | `camunda-platform` | - |
| `KEYCLOAK_REALM` | Keycloak realm used for Camunda. | `camunda-platform` | - |
| `KEYCLOAK_JWKS_URL` | [Internal](#notes-on-host-names-and-port-numbers) URL used to request Keycloak's JSON Web Key Set (for JWT verification). | `http://keycloak:8080/auth/realms/camunda-platform/protocol/openid-connect/certs` | - |
| `IDENTITY_BASE_URL` | [Internal](#notes-on-host-names-and-port-numbers) base URL of the Identity API (used to fetch user data). | `http://identity:8080` | - |

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,13 @@ tags:
- Application Server
- Spring Boot
- Maven
description: "Camunda Platform 7 is very flexible and can be hooked into the architecture of your choice, giving you a number of important decisions to make."
description: " 7 is very flexible and can be hooked into the architecture of your choice, giving you a number of important decisions to make."
christinaausley marked this conversation as resolved.
Show resolved Hide resolved
---

Camunda Platform 7 is very flexible and can be hooked into the architecture of your choice, giving you a number of important decisions to make. If you don't have special architecture requirements, we recommend following the proposed greenfield stack. You can also check the decision criteria presented below to make more customized choices. Choosing the stack will have big influence on your overall architecture.
7 is very flexible and can be hooked into the architecture of your choice, giving you a number of important decisions to make. If you don't have special architecture requirements, we recommend following the proposed greenfield stack. You can also check the decision criteria presented below to make more customized choices. Choosing the stack will have big influence on your overall architecture.

:::caution Camunda Platform 7 only
This best practice targets Camunda Platform 7.x only! If you look for Camunda Cloud, please refer to [Deciding about your Camunda Cloud stack](../deciding-about-your-stack/).
:::caution 7 only
This best practice targets 7.x only! If you look for Camunda Cloud, please refer to [Deciding about your Camunda Cloud stack](../deciding-about-your-stack/).
:::

## The Java greenfield stack
Expand All @@ -22,7 +22,7 @@ The greenfield stack is pretty similar for various languages. This section descr

Use the following stack:

1. Leverage the [Camunda Run](https://docs.camunda.org/manual/latest/installation/camunda-bpm-run/) distribution to run Camunda Platform 7 using the [Enterprise Edition](http://camunda.com/bpm/), preferrably [via Docker](https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#starting-camunda-platform-run-using-docker).
1. Leverage the [Camunda Run](https://docs.camunda.org/manual/latest/installation/camunda-bpm-run/) distribution to run 7 using the [Enterprise Edition](http://camunda.com/bpm/), preferrably [via Docker](https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#starting-camunda-platform-run-using-docker).

1. Build your process solution project as a [Spring Boot](https://spring.io/projects/spring-boot) application, using the [Camunda 4 REST Client for Spring Boot](https://github.com/camunda-community-hub/camunda-engine-rest-client-java/).

Expand Down Expand Up @@ -186,7 +186,7 @@ When running an embedded engine, you may want to use a Camunda web application l

### Choosing a database

Camunda Platform 7 requires a *relational database* for persistence. Even if the persistence provider is in theory pluggable and can be exchanged by e.g. some *NoSQL* persistence this is neither recommended nor supported. Therefore, if you have use cases for this, discuss them with Camunda beforehand!
7 requires a *relational database* for persistence. Even if the persistence provider is in theory pluggable and can be exchanged by e.g. some *NoSQL* persistence this is neither recommended nor supported. Therefore, if you have use cases for this, discuss them with Camunda beforehand!

| | PostgreSQL | Oracle | H2 | Other databases |
| -- | -- | -- | -- | -- |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ tags:
If you don't have special architecture requirements, we recommend using SaaS following the proposed greenfield stack.

:::caution Camunda Cloud
This best practice targets Camunda Cloud only! If you look for Camunda Platform 7, please refer to [Deciding about your Camunda 7 stack](../deciding-about-your-stack-c7/).
This best practice targets Camunda Cloud only! If you look for 7, please refer to [Deciding about your Camunda 7 stack](../deciding-about-your-stack-c7/).
:::

## The greenfield stack
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ tags:

---

:::caution Camunda Platform 7 only
This best practice targets Camunda Platform 7.x only and is an appendum to [understanding human task management](../understanding-human-tasks-management/).
:::caution 7 only
This best practice targets 7.x only and is an appendum to [understanding human task management](../understanding-human-tasks-management/).
:::

## The Camunda 7 task lifecyle
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@ tags:
- Sizing
---

Size your environment for Camunda Platform 7 appropriately, including sufficient hardware and database space.
Size your environment for 7 appropriately, including sufficient hardware and database space.

:::caution Camunda Platform 7 only
This best practice targets Camunda Platform 7.x only! If you are using Camunda Cloud, visit [Sizing your Camunda Cloud Environment](../sizing-your-environment/).
:::caution 7 only
This best practice targets 7.x only! If you are using Camunda Cloud, visit [Sizing your Camunda Cloud Environment](../sizing-your-environment/).
:::

## Understanding the influencing factors
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Best Practices represent the current state of our practical project experience a
Note that Camunda give the same guarantee as the core product for best practices. In order to present as much experiences as possible, we cannot accept any responsibility for the accuracy or timeliness of the statements made. If examples of source code are shown, a total absence of errors in the provided source code cannot be guaranteed. Liability for any damage resulting from the application of the recommendations presented here, is excluded.

:::caution Camunda Cloud
In general, best practices apply to Camunda Cloud, but there are also some specific Camunda Platform 7 practices in their own section below.
In general, best practices apply to Camunda Cloud, but there are also some specific 7 practices in their own section below.
:::

## Project management best practices
Expand Down Expand Up @@ -53,8 +53,8 @@ In general, best practices apply to Camunda Cloud, but there are also some speci

## Camunda 7 specific best practices

:::caution Camunda Platform 7
The best practices in this section apply to Camunda Platform 7 only
:::caution 7
The best practices in this section apply to 7 only
:::

* Architecture
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,9 @@ create or update the following entities in Keycloak:

### Client scopes

| Name | Protocol | Description |
| ---------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| camunda-identity | openid-connect | A default client scope that contains mappers to augment the token generated with information required by the components of Camunda Platform. Contains the mappers described in the [mappers](#mappers) section |
| Name | Protocol | Description |
| ---------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| camunda-identity | openid-connect | A default client scope that contains mappers to augment the token generated with information required by the components of Camunda. Contains the mappers described in the [mappers](#mappers) section |

### Mappers

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ To configure an external identity provider like OpenID Connect, SAML, LDAP, or A
[Docker Compose](/self-managed/platform-deployment/docker.md#docker-compose) setup, Keycloak
is available at [http://localhost:18080/](http://localhost:18080/).
:::
2. Click **Administrator Console** and log in using the Keycloak administrator credentials. The default administrator username is `admin`. When deploying Camunda Platform 8 with [Helm charts](/self-managed/platform-deployment/helm-kubernetes/overview.md),
2. Click **Administrator Console** and log in using the Keycloak administrator credentials. The default administrator username is `admin`. When deploying Camunda 8 with [Helm charts](/self-managed/platform-deployment/helm-kubernetes/overview.md),
you can extract the password as described in
[secrets extraction](/self-managed/platform-deployment/helm-kubernetes/upgrade.md#secrets-extraction).
Using the example [Docker Compose](/self-managed/platform-deployment/docker.md#docker-compose)
setup, the password is set via `KEYCLOAK_ADMIN_PASSWORD` environment variable and is `admin` per default.
3. Select the realm you are using with Camunda Platform 8. By default, this is **Camunda-platform**.
3. Select the realm you are using with Camunda 8. By default, this is **Camunda-platform**.
![keycloak-realm-select](img/keycloak-realm-select.png)
4. Add an identity provider using one of the following methods:
1. To add an OpenID Connect or SAML provider, select **Identity Providers** in the main menu, click **Add provider...**, and fill in all required configuration settings.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ To connect Identity to an existing Keycloak instance, take the following steps:
8. Assign the `manage-clients`, `manage-realm`, and `manage-users` role from the **Available Roles** list.
![keycloak-admin-update-client-4](img/keycloak-admin-update-client-4.png)
:::note Why does Identity need these roles?
Identity is designed to allow users to manage the various entities related to the Camunda Platform. To achieve this, it requires specific access to the realm.
Identity is designed to allow users to manage the various entities related to Camunda. To achieve this, it requires specific access to the realm.
:::
9. Navigate to the **Credentials** tab and copy the client secret.
![keycloak-admin-copy-client-credentials.png](img/keycloak-admin-copy-client-credentials.png)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ sidebar_label: "What is Identity?"
From version 8.0.0+ the IAM component has been replaced with the Identity component.
:::

Identity is the component within the Camunda Platform 8 stack responsible for authentication and authorization. It allows you to manage:
Identity is the component within the Camunda 8 stack responsible for authentication and authorization. It allows you to manage:

- Applications
- APIs
Expand Down
Loading
Loading