oscerd commented on PR #28689:
URL: https://github.com/apache/camel/pull/28689#issuecomment-6499306965
Thanks @davsclaus and @gnodet for the reviews and feedback!
I have addressed all the comments in commit 4e7cf3a2a667:
1. **Login flow impact & Keycloak:**
- In OpenID Connect code exchange login flows
(`authenticateAuthCodeCredentials`), the token endpoint response is processed
by `UserProfile.fromJson`.
- As noted, Keycloak access tokens commonly carry `aud=account` by
default unless an audience protocol mapper is configured on the client.
- Updated the upgrade guide in `camel-4x-upgrade-guide-4_24.adoc` to
explicitly document this behavior, advising operators upgrading with Keycloak
to either configure an audience mapper on the client in Keycloak or specify the
expected audience via `JWTOptions` (e.g.
`config.getJWTOptions().addAudience("account")`).
- Added unit tests in `UserProfileTest` specifically verifying the
code-exchange login flow with matching audience, with custom Keycloak audience
on `JWTOptions`, and rejection on mismatched audience.
2. **Scope:**
- Validating the audience claim in `UserProfile.verifyToken` for all
access tokens ensures consistent token verification across `ServletOAuth`.
Because `UserProfile` extracts claims (`sub`, `exp`, `iat`, `nbf`) from access
tokens for identity/authorization, enforcing that the token was minted for the
intended audience/resource server prevents cross-client token misuse.
3. **Helper & JWTOptions API:**
- Extracted expected-audience resolution into a small
`resolveExpectedAudiences(OAuthConfig, JWTOptions)` helper method in
`UserProfile`.
- Updated the upgrade guide to mention both `addAudience(String)` and
`setAudience(List<String>)`.
4. **Multi-valued audience arrays:**
- Added unit tests in both `UserProfileTest` and
`ServletOAuthTokenCredentialsTest` covering access tokens whose `aud` claim is
a JSON array with multiple audiences.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
