Enabling global.identity.auth without a resolvable issuer renders empty issuer values chart-wide

[eamonnmoloney]

Description

global.identity.auth.enabled=true with no resolvable issuer renders an authenticated
release whose issuer values are all empty strings, with no error and no warning. The chart
bundles no Keycloak, so nothing fills them in: global.identity.auth.issuer is empty by
default and camundaPlatform.authIssuerBackendUrl only resolves once
global.identity.auth.issuerBackendUrl or global.identity.keycloak.url.host is set.

Every component that reads those helpers is affected — Management Identity, the
Orchestration Cluster, Connectors — so a release can come up "with authentication enabled"
while no component can validate a token.

Expected vs Actual Behavior

Expected: enabling authentication without naming an issuer or an issuer backend URL fails
the render with a message naming the missing key, the way the other
templates/common/constraints.tpl checks do.

Actual: it renders. On chart 15.x (8.10):

$ helm template t . \
    --set global.identity.auth.enabled=true \
    --set identity.enabled=true \
    --set orchestration.data.secondaryStorage.type=elasticsearch

# ConfigMap <release>-identity-env-vars
CAMUNDA_IDENTITY_TYPE: "KEYCLOAK"
CAMUNDA_IDENTITY_ISSUER: ""
CAMUNDA_IDENTITY_ISSUER_BACKEND_URL: ""

# ConfigMap <release>-orchestration-configuration, application.yaml
authProvider:
  issuer-url: ""
  backend-url: ""

Derived endpoints inherit the emptiness: with type: KEYCLOAK,
camundaPlatform.authIssuerBackendUrlEndpointCerts renders the relative path
/protocol/openid-connect/certs, which is not a URL any component can fetch a JWKS from.

Motivation / Use Case

This is a silent misconfiguration that surfaces only at runtime, as token validation
failures across several components at once, with nothing in the rendered manifests
obviously wrong other than a few empty strings. templates/common/constraints.tpl already
fails fast on comparable states (global.topology.mode=orchestration without
global.identity.service.url, mode=optimize without a database backend), so the pattern
and the place for the check both exist.

Optimize has since gained a check of its own: PR #6884 fails the render when Optimize
authenticates and neither an issuer nor an issuer backend URL resolves. That check is
deliberately scoped to Optimize, because widening it was out of that PR's scope — five
pre-existing unit test cases in test/unit/common, test/unit/identity and
test/unit/optimize enable global auth incidentally, without ever naming an issuer, and
would have needed changing. Generalising the guard means deciding whether to accept that
blast radius chart-wide.

Acceptance Criteria

• Decide whether the empty-issuer state should fail the render chart-wide, or only
  warn (camundaPlatform.warning), given that it changes rendering for existing
  values files that enable global auth before configuring a provider.
• If it should fail: one constraint in templates/common/constraints.tpl, gated on
  global.identity.auth.enabled and an unresolvable issuer, replacing the
  Optimize-only check from feat(8.10): add an optimize release role that owns its OIDC identity #6884 so there is a single rule.
• Unit tests on both sides of the boundary: rejected with nothing resolvable, accepted
  with an External Keycloak that resolves through global.identity.keycloak.url.host
  and leaves issuer empty (a supported shape — do not break it).
• Update the pre-existing test cases that rely on the current permissiveness.
• Decide whether this needs an upgrade note in camunda-docs for anyone whose values
  file currently renders and would then fail.

Additional Context

The External Keycloak shape must keep working: global.identity.auth.issuer empty with
global.identity.keycloak.url.host set is documented in values.yaml
("External Keycloak: leave empty") and derives every endpoint from the host. So the
condition is "no issuer and no resolvable issuer backend URL", not "no issuer".

References

• PR feat(8.10): add an optimize release role that owns its OIDC identity #6884 — the Optimize-scoped version of this check
  (templates/common/constraints.tpl, optimize.effectiveAuthIssuer /
  optimize.effectiveAuthIssuerBackendUrl)
• templates/common/_helpers.tpl — camundaPlatform.authIssuerBackendUrl,
  camundaPlatform.authIssuerUrlWithFallback,
  camundaPlatform.authIssuerBackendUrlEndpointCerts

Environment

• Platform: any (render-time only)
• Helm CLI version: 4.2.4
• Chart version: camunda-platform-8.10 (15.x); the helpers are unchanged in earlier
  supported versions, so it likely reproduces there too

[distro-ci]

🧭 Triage Assessment

Field	Value
Work type	BUG
Kind	bug
Severity	⚠️ Mid
Likelihood	🔶 Mid
Confidence	0.94

📝 Rationale

Within SM Platform Distribution scope because the team boundaries assign Helm Charts, camunda/camunda-platform-helm, Self-Managed Helm configuration issues, and OIDC-provider integration to Distribution. This is a BUG with kind=bug: authentication is enabled but the chart silently renders empty issuer and backend URLs, causing token validation to fail across Identity, Orchestration, and Connectors. That is incorrect existing behavior under the Distro definition of a bug, not maintenance, documentation-only work, refactoring, research, or a new capability. Severity is mid because the affected release's authentication flows are functionally unusable and the blast radius is cross-component, but there is no evidence of data loss, security exposure, or a stop-the-world condition; a straightforward configuration workaround exists by setting a valid issuer/backend URL or external Keycloak host. Likelihood is mid because the failure is deterministic for authentication-enabled configurations lacking both resolution paths, but remains configuration-specific rather than universal. The report is complete: it includes expected versus actual behavior, reproduction steps, rendered output, affected components, versions, and acceptance criteria. No exact duplicate was found. Related issues include #4652 for an OIDC issuer mismatch, #4857 and #5507 for adjacent auth-URL templating defects, #5604 for external Keycloak host resolution, and #5174 for broader Keycloak URL/helper alignment; these address related issuer or URL-resolution problems but not this exact empty-issuer validation gap. PR #6884 is the closest implementation precedent because it added an Optimize-scoped issuer constraint and explicitly identified the remaining chart-wide validation as a separate concern.

🔍 Similar Issues

#4652, #4857, #5507, #5604, #5174

---

🤖 This issue was automatically triaged by an AI-based system.
✋ If you believe this assessment is incorrect, update the labels or add the triage:manual label for human review.