oscerd opened a new pull request, #25091: URL: https://github.com/apache/camel/pull/25091
### Motivation [CAMEL-23453](https://issues.apache.org/jira/browse/CAMEL-23453). The component exposed user CRUD but no federated-identity (IdP) link management. Those links are what connect a Keycloak user to an external identity-provider account (Google, GitHub, a SAML provider), so they matter for SSO scenarios and for provisioning users with pre-linked accounts during a migration. ### Changes Three new operations, implemented against the admin client's `UserResource` and following the existing producer pattern (header validation, then the admin-client call, then the response on the out-message): | Operation | Admin client call | Required headers | |---|---|---| | `addFederatedIdentity` | `addFederatedIdentity(alias, rep)` | realm, userId, `CamelKeycloakIdentityProvider`, `CamelKeycloakFederatedUserId` | | `removeFederatedIdentity` | `removeFederatedIdentity(alias)` | realm, userId, `CamelKeycloakIdentityProvider` | | `getFederatedIdentities` | `getFederatedIdentity()` | realm, userId | New header constants, as proposed on the issue: `CamelKeycloakIdentityProvider`, `CamelKeycloakFederatedUserId`, `CamelKeycloakFederatedUsername`. `getFederatedIdentities` sets the body to the `List<FederatedIdentityRepresentation>`. Two behaviours worth calling out for review: - **Username fallback.** `CamelKeycloakFederatedUsername` is optional; when it is absent the external user id is used as the username rather than creating the link with a blank one, since Keycloak surfaces that field in the admin console. A test pins this — happy to switch it to leaving the field null if you'd prefer. - **Status checking.** `addFederatedIdentity` returns a JAX-RS `Response`; the producer checks it and fails with the status code on a non-2xx (e.g. a 409 when the link already exists) instead of reporting success. The response is closed via try-with-resources. ### Testing `KeycloakProducerFederatedIdentityTest` — **9 tests, all passing** — using the same mocked-admin-client approach as the existing `KeycloakProducerTest`: - add: the captured `FederatedIdentityRepresentation` carries the right provider/userId/username - add: username falls back to the external user id when not supplied - add: a non-2xx status fails the exchange and reports the code - remove: verifies `removeFederatedIdentity` is called with the alias - list: the body is the list of links - validation: missing realm, userId, identity provider, and federated user id each produce the documented error Full reactor `mvn clean install -DskipTests` from root: success, with catalog and endpoint-DSL metadata regenerated. Docs: a *Federated Identity Operations* section in `keycloak-component.adoc` with the header contract and Java/YAML examples. Main-only (4.22.0), additive — no backport. _Claude Code on behalf of Andrea Cosentino (@oscerd)._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
