Custom authentication - OAuth/JWT for Optimize

Camunda 8 Topics Discussion & Questions
1

Hey,

Unlike the Tasklist, Cockpit & Admin which are distributed as one springboot starters and allow for custom security filters to be added to the encapsulating Springboot app, Optimize, which is distributed as a runnable JAR, thus we lose ability to add custom authentication filter.

Is there a recommended solution to solving this?

One possible solution was to proxy Optimize with Nginx, where Nginx does the OAuth redirection & JWT validation, but do not know how to pass a valid request’s username to Optimize from Nginx. We are stuck there.

Thanks
Tapan

2

Hey @Tapan,

Thanks for reaching out!

Before I can help you I need a bit more background to your issue:

  • Do you want add the additional security headers between user <-> Optimize communication?
  • What do you need those headers for? (e.g. SSO)

Best
Johannes

3

@JoHeinem,

We are trying to secure Optimize with OAuth/JWT, which is our organization’s SSO.
With Authorization being done by the SSO, and each request going forward containing the Bearer token(JWT).

How do we pass the userName from the bearer token to Optimize?
Or within Optimize, how do we parse a bearer token that was passed in to utilize the userName / roles / scopes associated with it?

We would like to create & config a custom security filter within Optimize - is there any way to do this?

Thanks
Tapan

4

Hey @Tapan,

Thank you for the additional information!

You should be able to implement your desired SSO login using the Optimize plugin mechanism:
https://docs.camunda.org/optimize/latest/technical-guide/plugins/single-sign-on/

There you can read the request information, e.g. bearer information, and the check if the user is entitled to access Optimize. Does that cover your user-case?

Best
Johannes

5