oscerd opened a new pull request, #25827: URL: https://github.com/apache/camel/pull/25827
Fixes [CAMEL-24448](https://issues.apache.org/jira/browse/CAMEL-24448). validateIssuerFromIntrospection() logged a warning and returned successfully when the introspection response had no "iss" claim, so the configured issuer was not checked at all in that case. Issuer validation runs only behind policy.isValidateIssuer(), so an operator who enabled it is asking for tokens from other issuers to be refused - and a response carrying no issuer is not evidence that the token came from the expected one. RFC 7662 makes "iss" optional in an introspection response, which makes this reachable wherever the introspection endpoint is a broker, a gateway, or a minimal implementation rather than the realm that issued the token. Reject it, the way the adjacent audience check already rejects a missing "aud". That check's javadoc drew the contrast ("Unlike issuer validation...") when it was added under CAMEL-23875 without giving a reason for the difference; the two are now consistent and the javadoc is updated to say so. The locally verified JWT path is unaffected - it delegates to Keycloak's own TokenVerifier.RealmUrlCheck. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> \n## Verification\n\n3 files changed, including 1 test file(s). Module build with \`-am\` is green on current main, no generated-file drift. Verified against the pre-fix code when the change was written. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
