oscerd opened a new pull request, #25259: URL: https://github.com/apache/camel/pull/25259
## What Adds two **opt-in** hardening settings to `KeycloakSecurityPolicy`, so a Camel-protected route can validate the token's **type (`typ`)** and **authorized party (`azp`)** in addition to the existing signature / issuer / active / (opt-in) audience checks: - **`expectedTokenTypes`** — comma-separated allow-list of accepted `typ` values (e.g. `"Bearer"`). Guards against **token-type confusion**, e.g. an ID token or refresh token being presented where an access token is expected. - **`expectedAuthorizedParty`** — expected `azp` value (e.g. `"my-client"`); ensures the token was issued for the expected client. Both checks are applied on **both** validation paths (local JWT verification and token introspection) and are **disabled by default for backward compatibility**, mirroring the existing `expectedAudience` opt-in (CAMEL-23875). ## Why `KeycloakSecurityPolicy` already verifies signature, issuer, active state and optionally audience, but never checked `typ`/`azp`. keycloak-core itself ships a `TokenTypeCheck`, and OAuth2 resource servers are expected to reject non-access-token types. This closes that gap without changing any default behaviour. ## Tests Four new unit tests in `KeycloakSecurityHelperTest` (accept/reject for both `typ` and `azp`); full `camel-keycloak` suite green (27 tests, 0 failures). ## Docs `keycloak-security.adoc` gains a "Token Type and Authorized Party Validation" section. No upgrade-guide entry — the change is opt-in and non-breaking. Jira: https://issues.apache.org/jira/browse/CAMEL-24319 --- _Authored by Claude Code on behalf of Andrea Cosentino._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
