oscerd opened a new pull request, #28689: URL: https://github.com/apache/camel/pull/28689
Jira: https://issues.apache.org/jira/browse/CAMEL-26404 ### Problem When `OAuthBearerTokenProcessor` authenticates incoming bearer access tokens on the Jakarta servlet backend (`ServletOAuth`), `UserProfile.verifyToken` evaluates the signature, issuer, not-before (`nbf`), and expiration (`exp`) claims, but only validates the audience (`aud`) and authorized party (`azp`) claims for ID tokens. Access tokens without an audience or tokens minted for a different client or audience in the same realm were accepted. ### Change - `UserProfile`: - Updated `verifyToken` to validate the audience claim on access tokens against configured expected audiences in `JWTOptions`. - When no explicit audience is configured on `JWTOptions`, default to the configured `clientId` on `OAuthConfig`. - Reject access tokens whose audience does not match or tokens without an audience claim. - `docs/user-manual`: - Added upgrade guide documentation in `camel-4x-upgrade-guide-4_24.adoc` explaining audience validation for access tokens in `ServletOAuth`. ### Tests - `UserProfileTest`: - Added unit tests verifying rejection of access tokens with mismatched audience. - Added unit tests verifying rejection of access tokens with missing audience. - Added unit tests verifying acceptance of access tokens matching configured expected audiences in `JWTOptions`. - Added unit tests verifying rejection when expected audience is unconfigured and client ID is missing. - `ServletOAuthTokenCredentialsTest`: - Updated existing bearer token tests to supply audience. - Added tests verifying rejection of bearer tokens with mismatched or missing audience. - Added tests verifying custom expected audience configuration on `JWTOptions`. - All 217 tests in `camel-oauth` pass cleanly (0 failures, 9 skipped Keycloak integration tests). _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
