Adjust deployment field labels, hints and validation

[smbea]

What should we do?

• audience
  • find out if it's always cluster URL minus port (ask Zeebe team)
    • if so then we can omit field; if not give field description/hint
• contact point
  • remove default text, add placeholder
  • change label to "Cluster endpoint"
  • add validation for valid url/ip address with port

Why should we do it?

This is part of a bigger effort to improve the UX of the deployment journey (see #2707)

---

Child of #2707

[smbea]

After reaching out to the zeebe team, I have learned that although the recommendation for audience is to be the base address of the resource being accessed (url minus the port), we cannot guarantee users will follow this in self-managed instances. Therefore -> we will maintain the audience field, but let's consider what description or placeholder could be added. (cc @christian-konrad )

[christian-konrad]

Thanks for investigating!

Is there any documentation on OAuth in Self-Managed Camunda 8?
Or should we expect Self-Managed Users that implemented their OAuth to understand what to do in the Modeler Client? Is it the responsibility of the one installing Self-Managed to teach their users on it?

We could maybe print in the validation string “Please enter the audience your token issuer provided to you” or similar, but I am a total OAuth newbie and not sure what’s right here

[smbea]

@christian-konrad As far as I found no, all I found was this https://docs.camunda.io/docs/self-managed/optimize-deployment/setup/.

I'm not sure about that string because it basically says to enter the audience provided, and it seems a bit redundant. Maybe it would be more useful to have something along the lines of "Usually the base address of the cluster (without the port)"? But I'm not sure about this, since it may not always be true

[christian-konrad]

it seems a bit redundant

You're right!

We also have this https://docs.camunda.io/docs/self-managed/zeebe-deployment/security/client-authorization/#environment-variables

"The address for which the token should be valid"

but it is not 100% true as the audience could be like any string - it is just a good practice to provide a URL

You may reach out to the C8 engineers and ask them to provide you a good description?

[smbea]

After discussing and consulting the zeebe teamm, we decided to add a description that points to it usually being the base address of the cluster (aka without the port)