This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 1771fc145712 CAMEL-25376: camel-netty-http - match security constraint
roles by exact role name (#27432)
1771fc145712 is described below
commit 1771fc145712a51a5ecfd68e33b192234e8a005d
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Oct 6 14:22:16 2026 +0200
CAMEL-25376: camel-netty-http - match security constraint roles by exact
role name (#27432)
Security constraint roles are matched as whole role names: the configured
roles and the user's roles are split on comma, trimmed and blank entries
dropped, matched case-sensitively as before, with `*` unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
---
.../camel/catalog/docs/netty-http-component.adoc | 5 +
.../src/main/docs/netty-http-component.adoc | 5 +
.../http/handlers/HttpServerChannelHandler.java | 21 +++-
.../NettyHttpBasicAuthConstraintRolesTest.java | 109 +++++++++++++++++++++
.../HttpServerChannelHandlerRolesTest.java | 65 ++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 7 ++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 7 ++
.../ROOT/pages/camel-4x-upgrade-guide-4_23.adoc | 7 ++
8 files changed, 224 insertions(+), 2 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/netty-http-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/netty-http-component.adoc
index 6023e539e6e8..4a8023084c2a 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/netty-http-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/netty-http-component.adoc
@@ -277,6 +277,11 @@ no roles)
* access to /public/* is an exclusion that means no authentication is
necessary, and is therefore public for everyone without logging in
+The roles of an inclusion are a comma-separated list of role names. A user
+is in role when one of the user roles is equal to one of the listed names.
+The comparison is case-sensitive, whitespace around each name and blank
+entries are ignored, and a value of `*` accepts any role.
+
To use this constraint, we just need to refer to the bean id as shown
below:
diff --git
a/components/camel-netty-http/src/main/docs/netty-http-component.adoc
b/components/camel-netty-http/src/main/docs/netty-http-component.adoc
index 6023e539e6e8..4a8023084c2a 100644
--- a/components/camel-netty-http/src/main/docs/netty-http-component.adoc
+++ b/components/camel-netty-http/src/main/docs/netty-http-component.adoc
@@ -277,6 +277,11 @@ no roles)
* access to /public/* is an exclusion that means no authentication is
necessary, and is therefore public for everyone without logging in
+The roles of an inclusion are a comma-separated list of role names. A user
+is in role when one of the user roles is equal to one of the listed names.
+The comparison is case-sensitive, whitespace around each name and blank
+entries are ignored, and a value of `*` accepts any role.
+
To use this constraint, we just need to refer to the bean id as shown
below:
diff --git
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/handlers/HttpServerChannelHandler.java
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/handlers/HttpServerChannelHandler.java
index 9720f9ab2521..b846213a6ebd 100644
---
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/handlers/HttpServerChannelHandler.java
+++
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/handlers/HttpServerChannelHandler.java
@@ -19,7 +19,9 @@ package org.apache.camel.component.netty.http.handlers;
import java.net.URI;
import java.nio.channels.ClosedChannelException;
import java.nio.charset.Charset;
+import java.util.HashSet;
import java.util.Locale;
+import java.util.Set;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginException;
@@ -235,9 +237,10 @@ public class HttpServerChannelHandler extends
ServerChannelHandler {
return true;
}
- // see if any of the user roles is contained in the roles list
+ // the user must have one of the roles, compared by the exact role name
+ Set<String> names = roleNames(roles);
for (String userRole : ObjectHelper.createIterable(userRoles)) {
- if (roles.contains(userRole)) {
+ if (names.contains(userRole.trim())) {
return true;
}
}
@@ -245,6 +248,20 @@ public class HttpServerChannelHandler extends
ServerChannelHandler {
return false;
}
+ /**
+ * The role names in the comma separated list of roles, trimmed and
without blank entries.
+ */
+ private static Set<String> roleNames(String roles) {
+ Set<String> names = new HashSet<>();
+ for (String role : ObjectHelper.createIterable(roles)) {
+ String name = role.trim();
+ if (!name.isEmpty()) {
+ names.add(name);
+ }
+ }
+ return names;
+ }
+
/**
* Extracts the username and password details from the HTTP basic header
Authorization.
* <p/>
diff --git
a/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpBasicAuthConstraintRolesTest.java
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpBasicAuthConstraintRolesTest.java
new file mode 100644
index 000000000000..ddcfe36b0959
--- /dev/null
+++
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpBasicAuthConstraintRolesTest.java
@@ -0,0 +1,109 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.netty.http;
+
+import org.apache.camel.BindToRegistry;
+import org.apache.camel.CamelExecutionException;
+import org.apache.camel.builder.RouteBuilder;
+import org.junit.jupiter.api.Test;
+
+import static org.apache.camel.test.junit6.TestSupport.assertIsInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+/**
+ * The roles of a security constraint inclusion are matched by role name. The
JAAS test login gives scott the roles
+ * admin and guest, and gives guest the role guest.
+ */
+class NettyHttpBasicAuthConstraintRolesTest extends BaseNettyTestSupport {
+
+ // username:password is scott:secret
+ private static final String SCOTT = "Basic c2NvdHQ6c2VjcmV0";
+ // username:password is guest:secret
+ private static final String GUEST = "Basic Z3Vlc3Q6c2VjcmV0";
+
+ @Override
+ protected void doPreSetup() {
+ System.setProperty("java.security.auth.login.config",
"src/test/resources/myjaas.config");
+ }
+
+ @Override
+ protected void doPostTearDown() {
+ System.clearProperty("java.security.auth.login.config");
+ }
+
+ @BindToRegistry("mySecurityConfig")
+ public NettyHttpSecurityConfiguration loadSecConf() {
+ NettyHttpSecurityConfiguration security = new
NettyHttpSecurityConfiguration();
+ security.setRealm("karaf");
+ SecurityAuthenticator auth = new JAASSecurityAuthenticator();
+ auth.setName("karaf");
+ security.setSecurityAuthenticator(auth);
+
+ SecurityConstraintMapping matcher = new SecurityConstraintMapping();
+ matcher.addInclusion("/admin/*", "admin");
+ matcher.addInclusion("/admins/*", "admins");
+ matcher.addInclusion("/staff/*", "operator, guest");
+ security.setSecurityConstraint(matcher);
+
+ return security;
+ }
+
+ @Test
+ void userWithTheRoleIsAccepted() {
+ String out =
template.requestBodyAndHeader("netty-http:http://localhost:{{port}}/foo/admin/x";,
"Hello",
+ "Authorization", SCOTT, String.class);
+ assertEquals("Bye World", out);
+ }
+
+ @Test
+ void anyRoleOfTheListIsAccepted() {
+ String out =
template.requestBodyAndHeader("netty-http:http://localhost:{{port}}/foo/staff/x";,
"Hello",
+ "Authorization", GUEST, String.class);
+ assertEquals("Bye World", out);
+ }
+
+ @Test
+ void roleIsMatchedByTheWholeName() {
+ // scott has the role admin, which is not the role admins
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () ->
template.requestBodyAndHeader("netty-http:http://localhost:{{port}}/foo/admins/x";,
"Hello",
+ "Authorization", SCOTT, String.class));
+ NettyHttpOperationFailedException cause =
assertIsInstanceOf(NettyHttpOperationFailedException.class, e.getCause());
+ assertEquals(401, cause.getStatusCode());
+ }
+
+ @Test
+ void userWithoutTheRoleIsRejected() {
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () ->
template.requestBodyAndHeader("netty-http:http://localhost:{{port}}/foo/admin/x";,
"Hello",
+ "Authorization", GUEST, String.class));
+ NettyHttpOperationFailedException cause =
assertIsInstanceOf(NettyHttpOperationFailedException.class, e.getCause());
+ assertEquals(401, cause.getStatusCode());
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+
from("netty-http:http://0.0.0.0:{{port}}/foo?matchOnUriPrefix=true&securityConfiguration=#mySecurityConfig";)
+ .transform().constant("Bye World");
+ }
+ };
+ }
+}
diff --git
a/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/handlers/HttpServerChannelHandlerRolesTest.java
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/handlers/HttpServerChannelHandlerRolesTest.java
new file mode 100644
index 000000000000..b42132844f92
--- /dev/null
+++
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/handlers/HttpServerChannelHandlerRolesTest.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.netty.http.handlers;
+
+import org.apache.camel.component.netty.http.NettyHttpConsumer;
+import org.apache.camel.component.netty.http.NettyHttpEndpoint;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * The roles of a security constraint are a comma separated list of role
names, and the user is in role when one of the
+ * user roles is equal to one of those names.
+ */
+class HttpServerChannelHandlerRolesTest extends CamelTestSupport {
+
+ private HttpServerChannelHandler handler;
+
+ @BeforeEach
+ void createHandler() {
+ NettyHttpEndpoint endpoint =
context.getEndpoint("netty-http:http://localhost:8080/roles";,
NettyHttpEndpoint.class);
+ handler = new HttpServerChannelHandler(new NettyHttpConsumer(endpoint,
exchange -> {
+ }, endpoint.getConfiguration()));
+ }
+
+ @ParameterizedTest
+ @CsvSource(delimiter = '|', nullValues = "null", textBlock = """
+ # roles | user roles | in role
+ * | guest | true
+ * | null | true
+ admin | admin,guest | true
+ admin,guest | guest | true
+ 'admin, guest' | guest | true
+ ' admin , guest ' | 'guest ' | true
+ admins | admin | false
+ readwrite | read | false
+ admin,guest | dmin | false
+ Admin | admin | false
+ admin;guest | guest | false
+ admin | 'guest,,viewer' | false
+ 'admin, ops' | 'guest, ,viewer' | false
+ 'admin,,ops' | 'guest,,viewer' | false
+ admin | null | false
+ """)
+ void matchesRoles(String roles, String userRoles, boolean inRole) {
+ assertEquals(inRole, handler.matchesRoles(roles, userRoles), () ->
"roles " + roles + ", user roles " + userRoles);
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 1d2427cb6eb5..fc154e506cf0 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -13,6 +13,13 @@ See the xref:camel-upgrade-recipes-tool.adoc[documentation]
page for details.
== Upgrading from 4.18.4 to 4.18.5
+=== camel-netty-http - the roles of a security constraint are matched by role
name
+
+The roles of a `SecurityConstraintMapping` inclusion are a comma-separated
list of role names, and an authenticated
+user is now accepted only when one of their roles is equal to one of those
names. The comparison is case-sensitive,
+whitespace around each name and blank entries are ignored, and a value of `*`
still accepts any role. A roles value
+that uses another separator, such as `admin;guest` or `admin guest`, must be
changed to `admin,guest`.
+
=== camel-azure-eventhubs
The producer now leaves the Camel-internal headers (`Camel*`) out of the
`EventData` application properties by
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 12fa8331d909..0815e0b92241 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -13,6 +13,13 @@ See the xref:camel-upgrade-recipes-tool.adoc[documentation]
page for details.
== Upgrading from 4.22.1 to 4.22.2
+=== camel-netty-http - the roles of a security constraint are matched by role
name
+
+The roles of a `SecurityConstraintMapping` inclusion are a comma-separated
list of role names, and an authenticated
+user is now accepted only when one of their roles is equal to one of those
names. The comparison is case-sensitive,
+whitespace around each name and blank entries are ignored, and a value of `*`
still accepts any role. A roles value
+that uses another separator, such as `admin;guest` or `admin guest`, must be
changed to `admin,guest`.
+
=== camel-azure-eventhubs
The producer now leaves the Camel-internal headers (`Camel*`) out of the
`EventData` application properties by
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
index d14da98a6000..0f26c36525e3 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
@@ -908,6 +908,13 @@ recognized whatever its case (`Charset=ISO-8859-1`). A
peer that ignored the dec
message as UTF-8 must now use the declared charset, and characters that the
declared charset cannot represent are
written as `?`.
+=== camel-netty-http - the roles of a security constraint are matched by role
name
+
+The roles of a `SecurityConstraintMapping` inclusion are a comma-separated
list of role names, and an authenticated
+user is now accepted only when one of their roles is equal to one of those
names. The comparison is case-sensitive,
+whitespace around each name and blank entries are ignored, and a value of `*`
still accepts any role. A roles value
+that uses another separator, such as `admin;guest` or `admin guest`, must be
changed to `admin,guest`.
+
=== camel-snmp - GET_NEXT (walk)
A `GET_NEXT` walk now ends at the end of the agent's MIB view (`endOfMibView`,
or `noSuchName` for SNMPv1) and at
