oscerd opened a new pull request, #26747:
URL: https://github.com/apache/camel/pull/26747
## What
The Keycloak security policy supports OAuth 2.0 token introspection (RFC
7662) with a pluggable result
cache (`introspectionCacheEnabled`, default `true`; `introspectionCacheTtl`,
default 60s). Both cache
implementations (`CaffeineTokenCache` and `ConcurrentMapTokenCache`) expired
entries purely by
insertion-time TTL and did not take the token's own expiry (`exp`) into
account, even though it is
available on the introspection result. As a result a cached result could be
reused until the TTL elapsed,
even after the token's `exp` had passed. The introspection paths in
`KeycloakSecurityProcessor` relied
solely on the cached `active` flag, unlike the local JWT verification path
which already enforces expiry.
## Changes
- `KeycloakTokenIntrospector.IntrospectionResult#isExpired()` — reports
whether the token's `exp` lies in
the past (a result without an `exp` claim is treated as not expired).
- `ConcurrentMapTokenCache` / `CaffeineTokenCache` — bound each entry's
lifetime by
`min(configuredTtl, remaining validity)` and never cache an
already-expired result, so a cached result
is never returned after the token's `exp`.
- `KeycloakSecurityProcessor` — reject an expired result on the
authentication, role and permission
introspection paths, consistent with the local JWT verification path.
- Documentation updated to describe the `exp`-bounded cache behavior.
## Tests
- `ConcurrentMapTokenCacheTest` / `CaffeineTokenCacheTest` — an
already-expired result is not served; a
result with a future `exp` is served.
- `KeycloakSecurityProcessorTest` — an active result whose `exp` has passed
is rejected on the
introspection path.
Results without an `exp` claim keep the previous TTL-only behavior, so
existing behavior is preserved.
JIRA: https://issues.apache.org/jira/browse/CAMEL-24902
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
