Authentication
Introduction​
Tasklist provides two ways for authentication:
- Authenticate with user information stored in Elasticsearch
- Authenticate via Camunda Cloud Single Sign-On
By default, user storage in Elasticsearch is enabled.
User in Elasticsearch​
In this mode the user authenticates with username and password, that are stored in Elasticsearch. username and password for one user may be set in application.yml:
camunda.tasklist:
username: anUser
password: aPassword
On Tasklist startup the user will be created if not existed before.
By default, one user with username/password demo/demo will be created.
More users can be added directly to Elasticsearch, to the index tasklist-user-<version>_. Password must be encoded with BCrypt strong hashing function.
Camunda Cloud Single Sign-On​
Currently, Tasklist supports Single Sign On in Camunda Cloud environment. Camunda Cloud takes care of the configuration of Tasklist for Single Sign On, so you don't need normally to adjust following subsections.
Enable Single Sign-On​
Single Sign-On may be enabled only by setting Spring profile: sso-auth
Example for setting spring profile as environmental variable:
export SPRING_PROFILES_ACTIVE=sso-auth
Configure Single Sign-On​
Single Sign-On needs following parameters (all are mandatory):
| Parametername | Description |
|---|---|
| camunda.tasklist.auth0.domain | Defines the domain which the user sees |
| camunda.tasklist.auth0.backendDomain | Defines the domain which provides user information |
| camunda.tasklist.auth0.clientId | It's like an user name for the application |
| camunda.tasklist.auth0.clientSecret | It's like a password for the application |
| camunda.tasklist.auth0.claimName | The claim that will be checked by Tasklist. It's like a permission name |
| camunda.tasklist.auth0.organization | The given organization should be contained in value of claim name |
Example for setting parameters as environment variables:
export CAMUNDA_TASKLIST_AUTH0_DOMAIN=A_DOMAIN
export CAMUNDA_TASKLIST_AUTH0_BACKENDDOMAIN=A_BACKEND_DDOMAIN
export CAMUNDA_TASKLIST_AUTH0_CLIENTID=A_CLIENT_ID
export CAMUNDA_TASKLIST_AUTH0_CLIENTSECRET=A_SECRET
export CAMUNDA_TASKLIST_AUTH0_CLAIMNAME=A_CLAIM
export CAMUNDA_TASKLIST_AUTH0_ORGANIZATION=AN_ORGANIZATION