Can't restrict admin access for users when using docker

Operating/Hosting Operaton
1

Hello,

I have set up a docker container via docker compose according to the documentation and have been quite happy so far. However there is one issue where I can’t find a solution for: In my installation, every created user has access to the Operaton Admin App with full privileges to every setting.

This is how my authorization settings look like:

grafik
grafik1480×229 15.3 KB

According to my understanding, users who are in the manager group (but not the operaton-admin group) should not be able to login to the Admin app, but they can. I’ve created a couple of test users and it is the case for all of them.

My docker-compose.yml:

services:
  operaton:
    image: operaton/operaton
    container_name: operaton
    environment:
      - DB_DRIVER=org.postgresql.Driver
      - DB_URL=jdbc:postgresql://postgres:5432/operaton
      - DB_USERNAME=postgres_admin
      - DB_PASSWORD=abc123
    ports:
      - "8080:8080"
    depends_on:
      - postgres
    restart: always
  postgres:
    image: postgres:16
    container_name: postgres
    environment:
      - POSTGRES_DB=operaton
      - POSTGRES_USER=postgres_admin
      - POSTGRES_PASSWORD=abc123
      - postgres-data:/var/lib/postgresql/data
    restart: always

volumes:
  postgres-data:
    driver: local

Is there anyone who encounters the same behaviour or has a solution for that?

Thank you in advance and have a nice weekend!

2

Alright, I’ve found the solution to my problem. Authorization is disabled by default and has to be manually enabled, either by switching to production mode (adding --production to the start command) or by changing the configuration files correspondandly.

For docker containers, the configuration is saved under /operaton/configuration. It is recommandable to copy this folder out of your docker container once, change the files and then mount it in.

Step 1: Copy Configuration Files to Local file System

  • Go to the folder where your docker-compose.yml is located.
  • Find the id of your operaton container with docker ps -a
  • Copy the folder /operaton/configuration out of the container into the folder of the docker compose configuration file.
 sudo docker cp <operaton docker container id>:/operaton/configuration .

Step 2: Edit Configuration File

Edit the configuration file in the configuration folder on your local file system (which you just extracted).

  • For default mode, the file would be configuration/default.yml
  • For production mode, the file would be configuration/production.yml (but here, authentication has been already enabled).

The following entries are important:

operaton.bpm:
  # other entries...
  authorization.enabled: true
  run:
    # other entries...
    auth.enabled: true

Make sure to add these two configuration settings and save the file.

Step 3: Adapt the docker-compose.yml

The docker-compose.yml needs to be changed to mount the local configuration directory into the docker container. In addition, you can manipulate the starting parameters.

My docker compose looks now like this:

services:
  operaton:
    image: operaton/operaton
    container_name: operaton
    environment:
      - DB_DRIVER=org.postgresql.Driver
      - DB_URL=jdbc:postgresql://postgres:5432/operaton
      - DB_USERNAME=postgres_admin
      - DB_PASSWORD=abc123
    command: ["./operaton.sh", "--webapps", "--rest"] # add "--production" to the array if you want to use the production mode
    volumes:
      - ./configuration:/operaton/configuration # this is the important line to mount the configuration into the docker container
    ports:
      - "8080:8080"
    depends_on:
      - postgres
    restart: always
  postgres:
    image: postgres:16
    container_name: postgres
    environment:
      - POSTGRES_DB=operaton
      - POSTGRES_USER=postgres_admin
      - POSTGRES_PASSWORD=abc123
    volumes:
      - postgres-data:/var/lib/postgresql/data
    restart: always

volumes:
  postgres-data:
    driver: local

Step 4: Rebuild and restart the container

Run the following commands:

sudo docker compose down
sudo docker compose up -d

Afterwards, authentication will work. Maybe for someone coming from the Camunda 7 world, that is all very obvious, but I had a hard time figuring that out. In my opinion, it would be helpful to add the mounting of the configuration into the docker container to the respective Operaton docker documentation.

Maybe that helps someone. Have a nice weekend y’all :slight_smile:

1 Like
3

Hi @reckeljm

welcome to the forum, and thanks for the detailed writup on how to solve this issue, this will be helpful to other people in the future!

Regards

Tim

1 Like