`ZEEBE_GATEWAY_SECURITY_AUTHENTICATION_MODE:none` does not disable Identity-based authentication

[nicpuppa]

Describe the bug

It should be possible to set the env var ZEEBE_GATEWAY_SECURITY_AUTHENTICATION_MODE=none, then use the Zeebe REST API without authenticating via Identity/Keycloak as mentioned in our docs

To Reproduce

• Install using separated-ingress-values.yaml and helm charts 10.0.5.
• Port forwarding the zeebe-gateway pod
• Try to execute the GET topology REST API with no bearer token: rest.zeebe.c8.dev.local/v1/topology.

The result is a 401 Unauthorized error.

Expected behavior

Setting ZEEBE_GATEWAY_SECURITY_AUTHENTICATION_MODE to none should disable Identity-based authentication.

Hint

Customer said that: If the spring.profiles.active: identity-auth in zeebe-gateway/configmap.yaml is commented-out/deactivated, then the Identity-based authentication is disabled.

Environment:

• Camunda version: 8.5
• Helm chart version: 10.0.4

Related to support case SUPPORT-22024