oscerd opened a new pull request, #27435: URL: https://github.com/apache/camel/pull/27435
## Description [CAMEL-25375](https://issues.apache.org/jira/browse/CAMEL-25375) The undertow component applied the `UndertowSecurityProvider` (`securityConfiguration` / `securityProvider`), the `allowedRoles` option and the `handlers` / `accessLog` options only on the HTTP request path: `UndertowConsumer.handleRequest()` and the handler chain built in `UndertowConsumer.doStart()`. WebSocket endpoints (`ws://`, `wss://`) are served by `CamelWebSocketHandler`, which does not go through that path, so these options had no effect on them. On HTTP endpoints the same configuration is applied, including the 403 returned when `allowedRoles` is set without a provider (CAMEL-14987). ## Changes - `CamelWebSocketHandler` applies the security settings of the path to the upgrade request: the `oauthProfile` validation as before, then the provider's `authenticate()` with the endpoint's allowed roles, or a 403 for `allowedRoles` without a provider. The provider/roles logic is shared with the HTTP path through the new `UndertowEndpoint.authenticate()`, so both behave the same. - All the endpoints of a WebSocket path share one `CamelWebSocketHandler` and its connections. The settings of the consumer apply to the path, and keep applying while the consumer is stopped; a path that only has producers applies the settings of its producers (producers now register their endpoint on the shared handler). - The outcome of the checks is recorded on the channel, as was already done for `oauthProfile` (CAMEL-23723). A channel that did not pass the checks in force (for example one opened while the path only had producers without security settings) is closed when it sends a message, and is now also skipped when producers send. - `handlers` and `accessLog` run before the upgrade on WebSocket consumers. - A component security provider that overrides `wrapHttpHandler()` wraps the shared WebSocket handler from the inside. Previously the WebSocket route failed to start with a `ClassCastException`, because the handler registered for the path must stay a `CamelWebSocketHandler`. - The values the provider adds with `addHeader()` (for example `SpringSecurityProvider_principal`) are set on WebSocket exchanges, as on HTTP exchanges. - `DefaultUndertowHost`: - uses the security provider of the component to decide on the servlet context when the first endpoint registered on a port is a WebSocket producer. That is the case for any `from("undertow:ws:...").to("undertow:ws:...")` route, and `camel-undertow-spring-security` needs the servlet context; - undeploys the servlet deployment only when the server stops. It was undeployed on every unregistration (since CAMEL-14977), so with two endpoints on a port the second undeploy failed with a `NullPointerException` and the server was left running. ## Behaviour change WebSocket clients that do not satisfy the configured security provider or allowed roles are now refused at the upgrade. While a consumer with `oauthProfile` is stopped, upgrade requests to its path are now validated too. Upgrade-guide entries are added for 4.23, and for 4.22.2 and 4.18.5 (they live on `main`, per the backport policy). ## Tests - New: `SecurityProviderWebSocketTest`, `SecurityProviderWebSocketWrapTest`, `ProviderWithServletWebSocketTest`, `UndertowWsSecurityWithoutProviderTest`, and `SpringSecurityWebSocketTest` in `camel-undertow-spring-security`. - Updated: `UndertowWsOAuthProfileConsumerWindowTest`. While the consumer is stopped, its settings keep applying, so the unvalidated channel case is now covered before the consumer's first start, and the test also checks that such a channel gets no broadcast. - Every new or updated test method fails without the change (checked by reverting the production code). - `camel-undertow`: 212 tests, 0 failures. `camel-undertow-spring-security`: 5 tests, 0 failures. Full reactor build with `-DskipTests` OK. ## Docs - `undertow-component.adoc`: a "WebSocket endpoints" part in the "Security provider" section, and a note in the OAuth section. - Upgrade guides 4.23, 4.22 (4.22.1 to 4.22.2) and 4.18 (4.18.4 to 4.18.5). Backports to `camel-4.22.x` and `camel-4.18.x` will follow. _Claude Code on behalf of Andrea Cosentino (oscerd)_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
