This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch backport/28351-to-camel-4.18.x in repository https://gitbox.apache.org/repos/asf/camel.git
commit e4526ca986f1939a952fa745c5afddb9e8a949d2 Author: Guillaume Nodet <[email protected]> AuthorDate: Fri Oct 23 17:28:48 2026 +0000 [backport camel-4.18.x] CAMEL-26068: camel-netty-http - Ensure NettyHttpSecurityConfiguration is copied per endpoint --- .../component/netty/http/NettyHttpComponent.java | 6 +- .../netty/http/NettyHttpSecurityConfiguration.java | 16 ++- .../NettyHttpSharedSecurityConfigurationTest.java | 116 +++++++++++++++++++++ .../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 4 + 4 files changed, 138 insertions(+), 4 deletions(-) diff --git a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java index 65a9506a82ac..c859148c2a2d 100644 --- a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java +++ b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java @@ -209,9 +209,9 @@ public class NettyHttpComponent extends NettyComponent } if (securityConfiguration != null) { - answer.setSecurityConfiguration(securityConfiguration); - } else if (answer.getSecurityConfiguration() == null) { - answer.setSecurityConfiguration(getSecurityConfiguration()); + answer.setSecurityConfiguration(securityConfiguration.copy()); + } else if (answer.getSecurityConfiguration() == null && getSecurityConfiguration() != null) { + answer.setSecurityConfiguration(getSecurityConfiguration().copy()); } // configure any security options diff --git a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java index 992228ff9eff..1e69ad93766d 100644 --- a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java +++ b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java @@ -17,12 +17,13 @@ package org.apache.camel.component.netty.http; import org.apache.camel.LoggingLevel; +import org.apache.camel.RuntimeCamelException; import org.apache.camel.spi.Metadata; /** * Security configuration for the {@link NettyHttpConsumer}. */ -public class NettyHttpSecurityConfiguration { +public class NettyHttpSecurityConfiguration implements Cloneable { @Metadata(label = "security", defaultValue = "true", description = "Whether to enable authentication") private boolean authenticate = true; @@ -113,4 +114,17 @@ public class NettyHttpSecurityConfiguration { this.loginDeniedLoggingLevel = loginDeniedLoggingLevel; } + /** + * Creates a shallow copy of this configuration, so an endpoint can change its own options without affecting the + * component or other endpoints. The {@link SecurityConstraint} and {@link SecurityAuthenticator} instances are + * shared with the original. + */ + public NettyHttpSecurityConfiguration copy() { + try { + return (NettyHttpSecurityConfiguration) clone(); + } catch (CloneNotSupportedException e) { + throw new RuntimeCamelException(e); + } + } + } diff --git a/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java new file mode 100644 index 000000000000..8464090fa0fb --- /dev/null +++ b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java @@ -0,0 +1,116 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.camel.component.netty.http; + +import org.apache.camel.CamelContext; +import org.apache.camel.CamelExecutionException; +import org.apache.camel.builder.RouteBuilder; +import org.junit.jupiter.api.Test; + +import static org.apache.camel.test.junit6.TestSupport.assertIsInstanceOf; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertNotSame; +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; + +class NettyHttpSharedSecurityConfigurationTest extends BaseNettyTestSupport { + + @Override + public void doPreSetup() { + System.setProperty("java.security.auth.login.config", "src/test/resources/myjaas.config"); + } + + @Override + public void doPostTearDown() { + System.clearProperty("java.security.auth.login.config"); + } + + @Override + protected CamelContext createCamelContext() throws Exception { + CamelContext context = super.createCamelContext(); + NettyHttpComponent component = context.getComponent("netty-http", NettyHttpComponent.class); + + NettyHttpSecurityConfiguration security = new NettyHttpSecurityConfiguration(); + security.setRealm("karaf"); + security.setAuthenticate(true); + SecurityAuthenticator auth = new JAASSecurityAuthenticator(); + auth.setName("karaf"); + security.setSecurityAuthenticator(auth); + + component.setSecurityConfiguration(security); + return context; + } + + @Test + void testSecurityConfigurationCopiedPerEndpoint() { + NettyHttpComponent component = context.getComponent("netty-http", NettyHttpComponent.class); + NettyHttpEndpoint adminEndpoint = context.getEndpoint("netty-http:http://0.0.0.0:"; + getPort() + "/admin", + NettyHttpEndpoint.class); + NettyHttpEndpoint publicEndpoint = context.getEndpoint( + "netty-http:http://0.0.0.0:"; + getPort() + "/public?securityConfiguration.authenticate=false", + NettyHttpEndpoint.class); + + // Component security configuration must remain authenticate = true + assertTrue(component.getSecurityConfiguration().isAuthenticate()); + + // Admin endpoint must remain authenticate = true + assertTrue(adminEndpoint.getSecurityConfiguration().isAuthenticate()); + + // Public endpoint must have authenticate = false + assertFalse(publicEndpoint.getSecurityConfiguration().isAuthenticate()); + + // Endpoints must have distinct configuration instances + assertNotSame(component.getSecurityConfiguration(), adminEndpoint.getSecurityConfiguration()); + assertNotSame(component.getSecurityConfiguration(), publicEndpoint.getSecurityConfiguration()); + assertNotSame(adminEndpoint.getSecurityConfiguration(), publicEndpoint.getSecurityConfiguration()); + } + + @Test + void testAuthenticationEnforcement() { + // Unauthenticated request to admin route should fail with 401 + CamelExecutionException e = assertThrows(CamelExecutionException.class, + () -> template.requestBody("netty-http:http://localhost:{{port}}/admin";, "Hello Admin", String.class)); + NettyHttpOperationFailedException cause = assertIsInstanceOf(NettyHttpOperationFailedException.class, e.getCause()); + assertEquals(401, cause.getStatusCode()); + + // Authenticated request to admin route should succeed + String auth = "Basic c2NvdHQ6c2VjcmV0"; + String adminResponse = template.requestBodyAndHeader("netty-http:http://localhost:{{port}}/admin";, "Hello Admin", + "Authorization", auth, String.class); + assertEquals("Admin OK", adminResponse); + + // Unauthenticated request to public route should succeed + String publicResponse + = template.requestBody("netty-http:http://localhost:{{port}}/public";, "Hello Public", String.class); + assertEquals("Public OK", publicResponse); + } + + @Override + protected RouteBuilder createRouteBuilder() { + return new RouteBuilder() { + @Override + public void configure() { + from("netty-http:http://0.0.0.0:{{port}}/admin";) + .transform().constant("Admin OK"); + + from("netty-http:http://0.0.0.0:{{port}}/public?securityConfiguration.authenticate=false";) + .transform().constant("Public OK"); + } + }; + } +} diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc index b6a7f2c348c5..1f8eb84c3563 100644 --- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc +++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc @@ -48,6 +48,10 @@ earlier in the route. Signatures created by earlier versions may not verify and need to be created again. +=== camel-netty-http - securityConfiguration is copied per endpoint + +When `securityConfiguration` is set on the `NettyHttpComponent`, each endpoint now receives an independent copy of the configuration. Modifying `securityConfiguration.*` options on an endpoint URI no longer alters the component-level configuration or other endpoints. + == Upgrading from 4.18.4 to 4.18.5 === camel-docling - output path handling
