oscerd opened a new pull request, #27948: URL: https://github.com/apache/camel/pull/27948
## Description [CAMEL-25708](https://issues.apache.org/jira/browse/CAMEL-25708): `OpensearchProducer.createClient()` registered the configured `user` and `password` with `new AuthScope(null, null, -1, null, null)`, which matches any host. [CAMEL-24815](https://issues.apache.org/jira/browse/CAMEL-24815) switched to it so that every node of a multi-host cluster receives the credentials, not only the first configured host. - The credentials are now held by a `NodeScopedCredentialsProvider`, which offers them only to the nodes the client talks to: the hosts of `hostAddresses` and, when `enableSniffer` is set, the nodes the sniffer finds. Every configured node keeps receiving them, as CAMEL-24815 intended. - A node matches on scheme, host name (in any case) and port. A node without a port matches the default port of its scheme. - The provider reads the nodes from the `RestClient` (`getNodes()`) on each lookup, so it follows the nodes the sniffer adds or removes. - A client set with the `client` or `openSearchClient` option is not changed. This is the same change as #27946 (CAMEL-25706) for camel-elasticsearch. Here it is written against HttpClient 5, whose `CredentialsProvider` only looks credentials up, and whose `AuthScope` carries the scheme (`getProtocol()`). Upgrade guide (4.24): a request to another host is sent without the credentials. This includes the host of a node with another scheme or port. ## Tests - New `NodeScopedCredentialsProviderTest` (7 tests): - every node gets the credentials, and a node without a port uses the default port of its scheme; - the host name matches in any case; - another host, or another port or scheme of a node, gets none; - nodes added or removed later are followed; - a scope without a protocol or host gets none. - New `OpensearchProducerCredentialsTest` (2 tests): - the provider that the producer builds from the endpoint configuration offers the credentials to every configured host, and only to them; - without credentials there is no provider. - With the producer change reverted to the match-all scope, `offersTheConfiguredCredentialsToEveryConfiguredHostOnly` fails on the host that is not a node. With the first-host scope from before CAMEL-24815, it fails on the second host, and `OpensearchBasicAuthenticationTest` fails on the second ping. - New `OpensearchBasicAuthenticationTest`: two local servers that require basic authentication are configured as `hostAddresses`. Two pings go to them in turn, and each one receives the configured credentials on its first request. The integration tests run against an OpenSearch container without its security plugin, so they do not exercise authentication. | Module | Tests | |---|---| | camel-opensearch | 19 unit tests | Full reactor `mvn clean install -DskipTests -DskipITs`: green, no generated-file changes. ## Backports To be backported to camel-4.22.x and camel-4.18.x after the merge. Both branches carry the CAMEL-24815 change (#26711, #26712). - camel-4.22.x: `OpensearchProducer` is identical to main there, so it is a straight cherry-pick, without the upgrade-guide hunk. - camel-4.18.x: the producer differs from main around the client creation, so the change is a port. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
