oscerd opened a new pull request, #27946: URL: https://github.com/apache/camel/pull/27946
## Description [CAMEL-25706](https://issues.apache.org/jira/browse/CAMEL-25706): `ElasticsearchProducer.createClient()` registered the configured `user` and `password` with `AuthScope.ANY`, which matches any host. - The credentials are now held by a `NodeScopedCredentialsProvider`, which offers them only to the nodes the client talks to: the hosts of `hostAddresses` and, when `enableSniffer` is set, the nodes the sniffer finds. - A node matches on scheme, host name (in any case) and port. A node without a port matches the default port of its scheme. - The provider reads the nodes from the `RestClient` (`getNodes()`) on each lookup, so it follows the nodes the sniffer adds or removes. Every configured node keeps receiving the credentials. - HttpClient 4's `BasicCredentialsProvider` matches an `AuthScope` on host and port only, never on the scheme. The provider therefore checks the origin of the scope that HttpClient looks the credentials up with, both preemptively and after a challenge. - `setCredentials` and `clear` do nothing, because the credentials come from the endpoint configuration only. HttpClient calls `setCredentials` for the user info of a request URI. - A client set with the `client` option is not changed. Upgrade guide (4.24): a request to another host is sent without the credentials. This includes the host of a node with another scheme or port. ## Tests - New `NodeScopedCredentialsProviderTest` (8 tests): - every node gets the credentials, and a node without a port uses the default port of its scheme; - the host name matches in any case; - another host, or another port or scheme of a node, gets none; - nodes added or removed later are followed; - a scope without an origin gets none; - credentials set afterwards are ignored. - New `ElasticsearchProducerCredentialsTest` (2 tests): - the provider that the producer builds from the endpoint configuration offers the credentials to the configured hosts only; - without credentials there is no provider. - With the producer change reverted to `AuthScope.ANY`, `offersTheConfiguredCredentialsOnlyToTheConfiguredHosts` fails on the host that is not a node. - The integration tests authenticate against a secured Elasticsearch container through the new provider: `ElasticsearchTestSupport` sets `user`, `password` and the CA certificate. Run locally against the Elasticsearch 9.1.0 test container (TLS and basic authentication), `ElasticsearchGetSearchDeleteExistsUpdateIT` and `ElasticsearchPingIT` pass: 37 tests. | Module | Tests | |---|---| | camel-elasticsearch | 19 unit tests | Full reactor `mvn clean install -DskipTests -DskipITs`: green, no generated-file changes. The `createCredentialsProvider` extraction came after that run. It touches no options or metadata, and was built and tested at module level. ## Backports To be backported to camel-4.22.x and camel-4.18.x after the merge. - camel-4.22.x: `ElasticsearchProducer` is identical to main there, so it is a straight cherry-pick, without the upgrade-guide hunk. - camel-4.18.x: `createClient()` is structured differently there (the credentials block wraps the HTTP client callback), so the change is a port. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
