oscerd opened a new pull request, #27949: URL: https://github.com/apache/camel/pull/27949
## Description [CAMEL-25707](https://issues.apache.org/jira/browse/CAMEL-25707): `ElasticsearchRestClientProducer.createClient()` registered the configured `user` and `password` with `AuthScope.ANY`, which matches any host. - The credentials are now held by a `NodeScopedCredentialsProvider`, which offers them only to the nodes the client talks to: the hosts of `hostAddressesList` and, when `enableSniffer` is set, the nodes the sniffer finds. - A node matches on scheme, host name (in any case) and port. A node without a port matches the default port of its scheme. - The provider reads the nodes from the `RestClient` (`getNodes()`) on each lookup, so it follows the nodes the sniffer adds or removes. Every configured node keeps receiving the credentials. - HttpClient 4's `BasicCredentialsProvider` matches an `AuthScope` on host and port only, never on the scheme. The provider therefore checks the origin of the scope that HttpClient looks the credentials up with, both preemptively and after a challenge. - `setCredentials` and `clear` do nothing, because the credentials come from the endpoint configuration only. HttpClient calls `setCredentials` for the user info of a request URI. - A client set with the `restClient` option is not changed. This is the same change as #27946 (CAMEL-25706) for camel-elasticsearch. The provider class is duplicated because the two components are separate modules. Upgrade guide (4.24): a request to another host is sent without the credentials. This includes the host of a node with another scheme or port. ## Tests - New `NodeScopedCredentialsProviderTest` (8 tests), the same cases as in camel-elasticsearch: - every node gets the credentials, and a node without a port uses the default port of its scheme; - the host name matches in any case; - another host, or another port or scheme of a node, gets none; - nodes added or removed later are followed; - a scope without an origin gets none; - credentials set afterwards are ignored. - New `ElasticsearchRestClientProducerCredentialsTest` (2 tests): - the provider that the producer builds from the endpoint configuration offers the credentials to the nodes only; - without credentials there is no provider. - With the producer change reverted to `AuthScope.ANY`, `offersTheConfiguredCredentialsOnlyToTheNodes` fails on the host that is not a node. - New `ElasticsearchRestClientBasicAuthenticationTest`: against a local server that requires basic authentication, a `CREATE_INDEX` request sends the configured credentials on its first attempt and is acknowledged. The existing integration tests set their own `restClient`, so they do not go through the client the producer creates. | Module | Tests | |---|---| | camel-elasticsearch-rest-client | 16 unit tests | Full reactor `mvn clean install -DskipTests -DskipITs`: green, no generated-file changes. The run stopped once at camel-elasticsearch-rest-client on a compile error in the new test (an ambiguous `requestBody` call); after the fix it was resumed from that module with `-rf`. ## Backports To be backported to camel-4.22.x and camel-4.18.x after the merge. - camel-4.22.x: `ElasticsearchRestClientProducer` is identical to main there, so it is a straight cherry-pick, without the upgrade-guide hunk. - camel-4.18.x: the producer differs from main around the client creation, so the change is a port. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
