Context:
In SUPPORT-7070 we ran into the situation that the decision instance import got stuck because the actual decision definition was not imported as the import user was not authorized for the tenant this definitions belongs to. This blocked the decision instance import indefinitely.

In such situation you cannot distinguish between a not yet imported definition or the case of a lack of authorizations. We thus should make it distinguishable by trying to directly fetch such a definition from the engine api on cache miss and log any error that might occur for that call.

In the support case example the error returned from the api would have been helpful in first place:

# Response
{"type":"RestException","message":"org.camunda.bpm.engine.ProcessEngineException: ENGINE-13034 Cannot get the decision definition 'some id' because it belongs to no authenticated tenant."}

AT:

• definition resolver services try to fetch definitions from the engine on cache miss
  • any subsequent error is logged on ERROR level for transparency

Hint:

• applies to processDefinitionResolver as well
• once we are certain the definition does not exist in the engine we may consider just skipping the related data, still logging and error though to raise awareness about the orphaned data in the engine