This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 442e440e43e6 CAMEL-25706: camel-elasticsearch - bind the basic
authentication credentials to the cluster nodes
442e440e43e6 is described below
commit 442e440e43e6a0ec45b4e9a29716069a6b78227d
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Oct 16 16:58:20 2026 +0200
CAMEL-25706: camel-elasticsearch - bind the basic authentication
credentials to the cluster nodes
[CAMEL-25706](https://issues.apache.org/jira/browse/CAMEL-25706):
`ElasticsearchProducer.createClient()` registered the configured `user` and
`password` with `AuthScope.ANY`, which matches any host.
- The credentials are now held by a `NodeScopedCredentialsProvider`, which
offers them only to the nodes the client talks to: the hosts of `hostAddresses`
and, when `enableSniffer` is set, the nodes the sniffer finds.
- A node matches on scheme, host name (in any case) and port. A node
without a port matches the default port of its scheme.
- The provider reads the nodes from the `RestClient` (`getNodes()`) on each
lookup, so it follows the nodes the sniffer adds or removes. Every configured
node keeps receiving the credentials.
- HttpClient 4's `BasicCredentialsProvider` matches an `AuthScope` on host
and port only, never on the scheme. The provider therefore checks the origin of
the scope that HttpClient looks the credentials up with, both preemptively and
after a challenge.
- `setCredentials` and `clear` do nothing, because the credentials come
from the endpoint configuration only. HttpClient calls `setCredentials` for the
user info of a request URI.
- A client set with the `client` option is not changed.
Closes #27946
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
.../camel/component/es/ElasticsearchProducer.java | 35 +++++--
.../es/NodeScopedCredentialsProvider.java | 81 ++++++++++++++++
.../es/ElasticsearchProducerCredentialsTest.java | 83 +++++++++++++++++
.../es/NodeScopedCredentialsProviderTest.java | 103 +++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 7 ++
5 files changed, 303 insertions(+), 6 deletions(-)
diff --git
a/components/camel-elasticsearch/src/main/java/org/apache/camel/component/es/ElasticsearchProducer.java
b/components/camel-elasticsearch/src/main/java/org/apache/camel/component/es/ElasticsearchProducer.java
index 20027487a64a..03a6dae53561 100644
---
a/components/camel-elasticsearch/src/main/java/org/apache/camel/component/es/ElasticsearchProducer.java
+++
b/components/camel-elasticsearch/src/main/java/org/apache/camel/component/es/ElasticsearchProducer.java
@@ -20,7 +20,11 @@ import java.io.InputStream;
import java.security.KeyStore;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
+import java.util.Collection;
+import java.util.List;
import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
@@ -59,10 +63,9 @@ import org.apache.camel.support.DefaultAsyncProducer;
import org.apache.camel.support.ResourceHelper;
import org.apache.camel.util.IOHelper;
import org.apache.http.HttpHost;
-import org.apache.http.auth.AuthScope;
import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.CredentialsProvider;
-import org.apache.http.impl.client.BasicCredentialsProvider;
+import org.elasticsearch.client.Node;
import org.elasticsearch.client.RequestOptions;
import org.elasticsearch.client.RestClient;
import org.elasticsearch.client.RestClientBuilder;
@@ -509,14 +512,14 @@ class ElasticsearchProducer extends DefaultAsyncProducer {
private RestClient createClient() {
final RestClientBuilder builder =
RestClient.builder(configuration.getHostAddressesList().toArray(new
HttpHost[0]));
+ // the credentials provider reads the nodes from the client, as the
sniffer can change them
+ final AtomicReference<RestClient> restClientRef = new
AtomicReference<>();
builder.setRequestConfigCallback(requestConfigBuilder ->
requestConfigBuilder
.setConnectTimeout(configuration.getConnectionTimeout()).setSocketTimeout(configuration.getSocketTimeout()));
builder.setHttpClientConfigCallback(httpClientBuilder -> {
- if (configuration.getUser() != null && configuration.getPassword()
!= null) {
- final CredentialsProvider credentialsProvider = new
BasicCredentialsProvider();
- credentialsProvider.setCredentials(AuthScope.ANY,
- new
UsernamePasswordCredentials(configuration.getUser(),
configuration.getPassword()));
+ CredentialsProvider credentialsProvider =
createCredentialsProvider(() -> nodeHosts(restClientRef.get()));
+ if (credentialsProvider != null) {
httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider);
}
if (configuration.getSslContextParameters() != null) {
@@ -534,6 +537,7 @@ class ElasticsearchProducer extends DefaultAsyncProducer {
return httpClientBuilder;
});
final RestClient restClient = builder.build();
+ restClientRef.set(restClient);
if (configuration.isEnableSniffer()) {
SnifferBuilder snifferBuilder = Sniffer.builder(restClient);
snifferBuilder.setSniffIntervalMillis(configuration.getSnifferInterval());
@@ -543,6 +547,25 @@ class ElasticsearchProducer extends DefaultAsyncProducer {
return restClient;
}
+ /**
+ * Creates the provider of the configured user and password, which offers
them only to the given nodes, or returns
+ * null when no credentials are configured.
+ */
+ CredentialsProvider createCredentialsProvider(Supplier<? extends
Collection<HttpHost>> nodes) {
+ if (configuration.getUser() == null || configuration.getPassword() ==
null) {
+ return null;
+ }
+ return new NodeScopedCredentialsProvider(
+ new UsernamePasswordCredentials(configuration.getUser(),
configuration.getPassword()), nodes);
+ }
+
+ private List<HttpHost> nodeHosts(RestClient restClient) {
+ if (restClient == null) {
+ return configuration.getHostAddressesList();
+ }
+ return restClient.getNodes().stream().map(Node::getHost).toList();
+ }
+
@Override
protected void doStop() throws Exception {
if (client != null) {
diff --git
a/components/camel-elasticsearch/src/main/java/org/apache/camel/component/es/NodeScopedCredentialsProvider.java
b/components/camel-elasticsearch/src/main/java/org/apache/camel/component/es/NodeScopedCredentialsProvider.java
new file mode 100644
index 000000000000..d4a2fac52a04
--- /dev/null
+++
b/components/camel-elasticsearch/src/main/java/org/apache/camel/component/es/NodeScopedCredentialsProvider.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.es;
+
+import java.util.Collection;
+import java.util.function.Supplier;
+
+import org.apache.http.HttpHost;
+import org.apache.http.auth.AuthScope;
+import org.apache.http.auth.Credentials;
+import org.apache.http.client.CredentialsProvider;
+
+/**
+ * Offers the configured credentials only to the nodes of the cluster the
client talks to: the configured hosts, and the
+ * nodes found by the sniffer when it is enabled. A node matches when the
scheme, the host name and the port are the
+ * same, the default port of the scheme standing in for a missing one.
+ */
+final class NodeScopedCredentialsProvider implements CredentialsProvider {
+
+ private final Credentials credentials;
+ private final Supplier<? extends Collection<HttpHost>> nodes;
+
+ NodeScopedCredentialsProvider(Credentials credentials, Supplier<? extends
Collection<HttpHost>> nodes) {
+ this.credentials = credentials;
+ this.nodes = nodes;
+ }
+
+ @Override
+ public Credentials getCredentials(AuthScope authScope) {
+ HttpHost origin = authScope != null ? authScope.getOrigin() : null;
+ if (origin != null) {
+ for (HttpHost node : nodes.get()) {
+ if (sameAuthority(node, origin)) {
+ return credentials;
+ }
+ }
+ }
+ return null;
+ }
+
+ /**
+ * Ignored: the credentials come from the endpoint configuration only.
HttpClient calls this for the user info of a
+ * request URI.
+ */
+ @Override
+ public void setCredentials(AuthScope authScope, Credentials credentials) {
+ // read-only
+ }
+
+ @Override
+ public void clear() {
+ // read-only
+ }
+
+ private static boolean sameAuthority(HttpHost node, HttpHost origin) {
+ return node.getSchemeName().equalsIgnoreCase(origin.getSchemeName())
+ && node.getHostName().equalsIgnoreCase(origin.getHostName())
+ && effectivePort(node) == effectivePort(origin);
+ }
+
+ private static int effectivePort(HttpHost host) {
+ if (host.getPort() >= 0) {
+ return host.getPort();
+ }
+ return "https".equalsIgnoreCase(host.getSchemeName()) ? 443 : 80;
+ }
+}
diff --git
a/components/camel-elasticsearch/src/test/java/org/apache/camel/component/es/ElasticsearchProducerCredentialsTest.java
b/components/camel-elasticsearch/src/test/java/org/apache/camel/component/es/ElasticsearchProducerCredentialsTest.java
new file mode 100644
index 000000000000..3f619e96bd0b
--- /dev/null
+++
b/components/camel-elasticsearch/src/test/java/org/apache/camel/component/es/ElasticsearchProducerCredentialsTest.java
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.es;
+
+import org.apache.camel.CamelContext;
+import org.apache.camel.impl.DefaultCamelContext;
+import org.apache.http.HttpHost;
+import org.apache.http.auth.AuthScope;
+import org.apache.http.auth.Credentials;
+import org.apache.http.client.CredentialsProvider;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+class ElasticsearchProducerCredentialsTest {
+
+ @Test
+ void offersTheConfiguredCredentialsOnlyToTheConfiguredHosts() throws
Exception {
+ try (CamelContext context = new DefaultCamelContext()) {
+ context.start();
+ ElasticsearchConfiguration configuration
+ = configuration(context,
"es1.example.com:9200,es2.example.com:9201", "elastic", "secret");
+
+ CredentialsProvider provider = new
ElasticsearchProducer(endpoint(context), configuration)
+
.createCredentialsProvider(configuration::getHostAddressesList);
+
+ Credentials credentials = provider.getCredentials(scope("http",
"es1.example.com", 9200));
+ assertNotNull(credentials);
+ assertEquals("elastic", credentials.getUserPrincipal().getName());
+ assertEquals("secret", credentials.getPassword());
+ assertNotNull(provider.getCredentials(scope("http",
"es2.example.com", 9201)));
+
+ assertNull(provider.getCredentials(scope("http",
"other.example.com", 9200)));
+ assertNull(provider.getCredentials(scope("http",
"es1.example.com", 9201)));
+ assertNull(provider.getCredentials(scope("https",
"es1.example.com", 9200)));
+ }
+ }
+
+ @Test
+ void createsNoProviderWithoutCredentials() throws Exception {
+ try (CamelContext context = new DefaultCamelContext()) {
+ context.start();
+ ElasticsearchConfiguration configuration = configuration(context,
"es1.example.com:9200", null, null);
+
+ assertNull(new ElasticsearchProducer(endpoint(context),
configuration)
+
.createCredentialsProvider(configuration::getHostAddressesList));
+ }
+ }
+
+ private static ElasticsearchConfiguration configuration(
+ CamelContext context, String hostAddresses, String user, String
password) {
+ ElasticsearchComponent component = new ElasticsearchComponent(context);
+ component.setHostAddresses(hostAddresses);
+ component.setUser(user);
+ component.setPassword(password);
+ context.addComponent("elasticsearch", component);
+ return endpoint(context).getConfiguration();
+ }
+
+ private static ElasticsearchEndpoint endpoint(CamelContext context) {
+ return context.getEndpoint("elasticsearch:test-cluster",
ElasticsearchEndpoint.class);
+ }
+
+ private static AuthScope scope(String scheme, String host, int port) {
+ return new AuthScope(new HttpHost(host, port, scheme), "realm",
"basic");
+ }
+}
diff --git
a/components/camel-elasticsearch/src/test/java/org/apache/camel/component/es/NodeScopedCredentialsProviderTest.java
b/components/camel-elasticsearch/src/test/java/org/apache/camel/component/es/NodeScopedCredentialsProviderTest.java
new file mode 100644
index 000000000000..b23e2e10ef79
--- /dev/null
+++
b/components/camel-elasticsearch/src/test/java/org/apache/camel/component/es/NodeScopedCredentialsProviderTest.java
@@ -0,0 +1,103 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.es;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.http.HttpHost;
+import org.apache.http.auth.AuthScope;
+import org.apache.http.auth.Credentials;
+import org.apache.http.auth.UsernamePasswordCredentials;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+
+class NodeScopedCredentialsProviderTest {
+
+ private static final Credentials CREDENTIALS = new
UsernamePasswordCredentials("elastic", "secret");
+
+ private final List<HttpHost> nodes = new ArrayList<>(
+ List.of(new HttpHost("es1.example.com", 9200, "http"),
+ new HttpHost("es2.example.com", 9243, "https"),
+ new HttpHost("es3.example.com", -1, "https")));
+
+ private final NodeScopedCredentialsProvider provider = new
NodeScopedCredentialsProvider(CREDENTIALS, () -> nodes);
+
+ @Test
+ void offersTheCredentialsToEveryNode() {
+ assertSame(CREDENTIALS, provider.getCredentials(scope("http",
"es1.example.com", 9200)));
+ assertSame(CREDENTIALS, provider.getCredentials(scope("https",
"es2.example.com", 9243)));
+ }
+
+ @Test
+ void usesTheDefaultPortOfTheSchemeWhenTheNodeHasNone() {
+ assertSame(CREDENTIALS, provider.getCredentials(scope("https",
"es3.example.com", 443)));
+ assertNull(provider.getCredentials(scope("https", "es3.example.com",
9200)));
+ }
+
+ @Test
+ void matchesTheHostNameRegardlessOfCase() {
+ assertSame(CREDENTIALS, provider.getCredentials(scope("HTTP",
"ES1.Example.COM", 9200)));
+ }
+
+ @Test
+ void offersNoCredentialsToAHostThatIsNotANode() {
+ assertNull(provider.getCredentials(scope("http", "other.example.com",
9200)));
+ }
+
+ @Test
+ void offersNoCredentialsToAnotherPortOrSchemeOfANode() {
+ assertNull(provider.getCredentials(scope("http", "es1.example.com",
9300)));
+ assertNull(provider.getCredentials(scope("https", "es1.example.com",
9200)));
+ assertNull(provider.getCredentials(scope("http", "es2.example.com",
9243)));
+ }
+
+ @Test
+ void followsTheCurrentNodes() {
+ HttpHost sniffed = new HttpHost("es4.example.com", 9200, "http");
+ assertNull(provider.getCredentials(scope("http", "es4.example.com",
9200)));
+
+ nodes.add(sniffed);
+ assertSame(CREDENTIALS, provider.getCredentials(scope("http",
"es4.example.com", 9200)));
+
+ nodes.remove(sniffed);
+ assertNull(provider.getCredentials(scope("http", "es4.example.com",
9200)));
+ }
+
+ @Test
+ void offersNoCredentialsToAScopeWithoutAnOrigin() {
+ assertNull(provider.getCredentials(AuthScope.ANY));
+ assertNull(provider.getCredentials(new AuthScope("es1.example.com",
9200)));
+ assertNull(provider.getCredentials(null));
+ }
+
+ @Test
+ void ignoresCredentialsSetAfterwards() {
+ provider.setCredentials(scope("http", "other.example.com", 9200), new
UsernamePasswordCredentials("user", "pass"));
+ assertNull(provider.getCredentials(scope("http", "other.example.com",
9200)));
+
+ provider.clear();
+ assertSame(CREDENTIALS, provider.getCredentials(scope("http",
"es1.example.com", 9200)));
+ }
+
+ private static AuthScope scope(String scheme, String host, int port) {
+ // the shape of the scope HttpClient looks the credentials up with,
preemptively or after a challenge
+ return new AuthScope(new HttpHost(host, port, scheme), "realm",
"basic");
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index f24b85469360..5378b42f4628 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -878,6 +878,13 @@ camel-http control headers of the message. It did so since
Camel 4.19, when the
request now always goes to `httpUri`, as it did before. For the same reason
the `CamelHttpMethod` and
`CamelHttpProtocolVersion` headers no longer apply, and the request is always
a POST.
+=== camel-elasticsearch - the credentials are only sent to the nodes of the
cluster
+
+The `user` and `password` are now offered only to the nodes the client talks
to: the hosts of `hostAddresses` and,
+when `enableSniffer` is set, the nodes the sniffer finds, matching the scheme,
host and port. Previously they were
+registered for any host. A request to another host, including the host of a
node with another scheme or port, is now
+sent without them. A client set with the `client` option is not changed.
+
=== camel-jetty - a multipart text field that occurs several times
A text field of a `multipart/form-data` request that occurs several times (for
example a group of checkboxes) is now
