This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 2931a16505eb CAMEL-26279: camel-cyberark-vault - apply verifySsl and
certificatePath to the client, URL-encode the secret version, and set the
secret only as the body on getSecret (#29210)
2931a16505eb is described below
commit 2931a16505eb18543e59a4e6cb381d7109712664
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Nov 5 13:01:33 2026 +0100
CAMEL-26279: camel-cyberark-vault - apply verifySsl and certificatePath to
the client, URL-encode the secret version, and set the secret only as the body
on getSecret (#29210)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
.../camel/catalog/components/cyberark-vault.json | 50 ++---
.../catalog/docs/cyberark-vault-component.adoc | 17 +-
.../component/cyberark/vault/cyberark-vault.json | 50 ++---
.../src/main/docs/cyberark-vault-component.adoc | 17 +-
.../cyberark/vault/CyberArkVaultConfiguration.java | 11 +-
.../cyberark/vault/CyberArkVaultEndpoint.java | 15 +-
.../cyberark/vault/CyberArkVaultProducer.java | 1 -
.../vault/CyberArkVaultPropertiesFunction.java | 13 +-
.../cyberark/vault/client/ConjurClientFactory.java | 152 +++++++++++++++
.../vault/client/impl/ConjurClientImpl.java | 24 ++-
.../cyberark/vault/CyberArkVaultProducerTest.java | 108 +++++++++++
.../cyberark/vault/CyberArkVaultSslTest.java | 214 +++++++++++++++++++++
.../client/impl/ConjurClientSecretVersionTest.java | 97 ++++++++++
.../vault/integration/CyberArkVaultProducerIT.java | 6 +-
.../component/cyberark/vault/ssl/conjur-server.p12 | Bin 0 -> 1028 bytes
.../component/cyberark/vault/ssl/conjur-server.pem | 10 +
.../java/org/apache/camel/util/SecurityUtils.java | 1 +
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 23 +++
.../dsl/CyberarkVaultComponentBuilderFactory.java | 74 +++----
.../dsl/CyberArkVaultEndpointBuilderFactory.java | 97 +++++-----
20 files changed, 821 insertions(+), 159 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cyberark-vault.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cyberark-vault.json
index da9744df5f43..73b3009aafb2 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cyberark-vault.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cyberark-vault.json
@@ -25,37 +25,37 @@
},
"componentProperties": {
"account": { "index": 0, "kind": "property", "displayName": "Account",
"group": "producer", "label": "", "required": true, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
account name" },
- "certificatePath": { "index": 1, "kind": "property", "displayName":
"Certificate Path", "group": "producer", "label": "", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path to the SSL
certificate for verification" },
- "configuration": { "index": 2, "kind": "property", "displayName":
"Configuration", "group": "producer", "label": "", "required": false, "type":
"object", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"deprecated": false, "autowired": false, "secret": false, "description":
"Component configuration" },
- "conjurClient": { "index": 3, "kind": "property", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
- "lazyStartProducer": { "index": 4, "kind": "property", "displayName":
"Lazy Start Producer", "group": "producer", "label": "producer", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": false, "description":
"Whether the producer should be started lazy (on the first message). By
starting lazy you can use this to allow CamelContext and routes to startup in
situations where a producer may otherwise fail [...]
- "operation": { "index": 5, "kind": "property", "displayName": "Operation",
"group": "producer", "label": "", "required": false, "type": "enum",
"javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "d [...]
- "secretId": { "index": 6, "kind": "property", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
- "url": { "index": 7, "kind": "property", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
- "verifySsl": { "index": 8, "kind": "property", "displayName": "Verify
Ssl", "group": "producer", "label": "", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify SSL
certificates when connecting to CyberArk Conjur" },
- "autowiredEnabled": { "index": 9, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching t [...]
- "apiKey": { "index": 10, "kind": "property", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
- "authToken": { "index": 11, "kind": "property", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
- "password": { "index": 12, "kind": "property", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
- "username": { "index": 13, "kind": "property", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" }
+ "configuration": { "index": 1, "kind": "property", "displayName":
"Configuration", "group": "producer", "label": "", "required": false, "type":
"object", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"deprecated": false, "autowired": false, "secret": false, "description":
"Component configuration" },
+ "conjurClient": { "index": 2, "kind": "property", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
+ "lazyStartProducer": { "index": 3, "kind": "property", "displayName":
"Lazy Start Producer", "group": "producer", "label": "producer", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": false, "description":
"Whether the producer should be started lazy (on the first message). By
starting lazy you can use this to allow CamelContext and routes to startup in
situations where a producer may otherwise fail [...]
+ "operation": { "index": 4, "kind": "property", "displayName": "Operation",
"group": "producer", "label": "", "required": false, "type": "enum",
"javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "d [...]
+ "secretId": { "index": 5, "kind": "property", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
+ "url": { "index": 6, "kind": "property", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
+ "autowiredEnabled": { "index": 7, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching t [...]
+ "apiKey": { "index": 8, "kind": "property", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
+ "authToken": { "index": 9, "kind": "property", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
+ "certificatePath": { "index": 10, "kind": "property", "displayName":
"Certificate Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path of a file with the
SSL certificate to trust when connecting to CyberArk Conj [...]
+ "password": { "index": 11, "kind": "property", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
+ "username": { "index": 12, "kind": "property", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" },
+ "verifySsl": { "index": 13, "kind": "property", "displayName": "Verify
Ssl", "group": "security", "label": "security", "required": false, "type":
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false,
"secret": false, "security": "insecure:ssl", "insecureValue": "false",
"defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify the
SSL [...]
},
"bodyTypes": {
"producerIn": { "carriers": [ "any" ], "byOption": [ { "option":
"operation", "value": "createSecret", "carriers": [ "text", "bytes", "stream",
"file" ] } ], "description": "getSecret, the default operation, does not read
the body. createSecret stores the body as text, unless the
CamelCyberArkVaultSecretValue header is set: bytes, a stream or a file are read
as text, a Map or a POJO is stored as its toString(), so marshal it first, and
no body fails" },
- "producerOut": { "carriers": [ "text" ], "javaType": "java.lang.String",
"byOption": [ { "option": "operation", "value": "createSecret", "carriers": [
"unchanged" ] } ], "description": "The value of the secret as text for
getSecret, also in the CamelCyberArkVaultSecretValue header: unmarshal a JSON
secret to read its fields. createSecret leaves the body unchanged" }
+ "producerOut": { "carriers": [ "text" ], "javaType": "java.lang.String",
"byOption": [ { "option": "operation", "value": "createSecret", "carriers": [
"unchanged" ] } ], "description": "The value of the secret as text for
getSecret: unmarshal a JSON secret to read its fields. createSecret leaves the
body unchanged" }
},
"properties": {
"label": { "index": 0, "kind": "path", "displayName": "Label", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Logical name" },
"account": { "index": 1, "kind": "parameter", "displayName": "Account",
"group": "producer", "label": "", "required": true, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
account name" },
- "certificatePath": { "index": 2, "kind": "parameter", "displayName":
"Certificate Path", "group": "producer", "label": "", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path to the SSL
certificate for verification" },
- "conjurClient": { "index": 3, "kind": "parameter", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
- "operation": { "index": 4, "kind": "parameter", "displayName":
"Operation", "group": "producer", "label": "", "required": false, "type":
"enum", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", " [...]
- "secretId": { "index": 5, "kind": "parameter", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
- "url": { "index": 6, "kind": "parameter", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
- "verifySsl": { "index": 7, "kind": "parameter", "displayName": "Verify
Ssl", "group": "producer", "label": "", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify SSL
certificates when connecting to CyberArk Conjur" },
- "lazyStartProducer": { "index": 8, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produc [...]
- "apiKey": { "index": 9, "kind": "parameter", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
- "authToken": { "index": 10, "kind": "parameter", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
- "password": { "index": 11, "kind": "parameter", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
- "username": { "index": 12, "kind": "parameter", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" }
+ "conjurClient": { "index": 2, "kind": "parameter", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
+ "operation": { "index": 3, "kind": "parameter", "displayName":
"Operation", "group": "producer", "label": "", "required": false, "type":
"enum", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", " [...]
+ "secretId": { "index": 4, "kind": "parameter", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
+ "url": { "index": 5, "kind": "parameter", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
+ "lazyStartProducer": { "index": 6, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produc [...]
+ "apiKey": { "index": 7, "kind": "parameter", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
+ "authToken": { "index": 8, "kind": "parameter", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
+ "certificatePath": { "index": 9, "kind": "parameter", "displayName":
"Certificate Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path of a file with the
SSL certificate to trust when connecting to CyberArk Conj [...]
+ "password": { "index": 10, "kind": "parameter", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
+ "username": { "index": 11, "kind": "parameter", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" },
+ "verifySsl": { "index": 12, "kind": "parameter", "displayName": "Verify
Ssl", "group": "security", "label": "security", "required": false, "type":
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false,
"secret": false, "security": "insecure:ssl", "insecureValue": "false",
"defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify the SS
[...]
}
}
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cyberark-vault-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cyberark-vault-component.adoc
index 7c8735d9c962..eb5a919ed294 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cyberark-vault-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cyberark-vault-component.adoc
@@ -577,20 +577,29 @@ YAML::
=== SSL Certificate Verification
-By default, SSL certificate verification is enabled. You can disable it for
testing purposes (not recommended for production):
+By default, the certificate and the host name of the CyberArk Conjur server
are verified with the default trust store
+of the JVM.
+
+When the server has a certificate of a private CA, or a self-signed
certificate, provide the path of a file with that
+certificate, in PEM or DER format. The certificates in the file are trusted
instead of the default trust store of the
+JVM:
[source,properties]
----
-camel.vault.cyberark.verifySsl=false
+camel.vault.cyberark.certificatePath=/path/to/cert.pem
----
-Or provide a custom certificate path:
+You can disable the verification for testing purposes, which trusts any server
(not recommended for production):
[source,properties]
----
-camel.vault.cyberark.certificatePath=/path/to/cert.pem
+camel.vault.cyberark.verifySsl=false
----
+The `camel.vault.cyberark` properties configure the CyberArk Conjur Vault
Property Function. An endpoint uses its own
+`certificatePath` and `verifySsl` options, which do not apply when the
endpoint has a `conjurClient`. The security
+policy (for example `camel.main.profile=prod`) reports `verifySsl` set to
`false` as an insecure SSL setting.
+
=== Setting Up CyberArk Conjur for Testing
Before you can use the component or run integration tests, you need to set up
a CyberArk Conjur instance and configure policies to define which secrets
(variables) are available.
diff --git
a/components/camel-cyberark-vault/src/generated/resources/META-INF/org/apache/camel/component/cyberark/vault/cyberark-vault.json
b/components/camel-cyberark-vault/src/generated/resources/META-INF/org/apache/camel/component/cyberark/vault/cyberark-vault.json
index da9744df5f43..73b3009aafb2 100644
---
a/components/camel-cyberark-vault/src/generated/resources/META-INF/org/apache/camel/component/cyberark/vault/cyberark-vault.json
+++
b/components/camel-cyberark-vault/src/generated/resources/META-INF/org/apache/camel/component/cyberark/vault/cyberark-vault.json
@@ -25,37 +25,37 @@
},
"componentProperties": {
"account": { "index": 0, "kind": "property", "displayName": "Account",
"group": "producer", "label": "", "required": true, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
account name" },
- "certificatePath": { "index": 1, "kind": "property", "displayName":
"Certificate Path", "group": "producer", "label": "", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path to the SSL
certificate for verification" },
- "configuration": { "index": 2, "kind": "property", "displayName":
"Configuration", "group": "producer", "label": "", "required": false, "type":
"object", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"deprecated": false, "autowired": false, "secret": false, "description":
"Component configuration" },
- "conjurClient": { "index": 3, "kind": "property", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
- "lazyStartProducer": { "index": 4, "kind": "property", "displayName":
"Lazy Start Producer", "group": "producer", "label": "producer", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": false, "description":
"Whether the producer should be started lazy (on the first message). By
starting lazy you can use this to allow CamelContext and routes to startup in
situations where a producer may otherwise fail [...]
- "operation": { "index": 5, "kind": "property", "displayName": "Operation",
"group": "producer", "label": "", "required": false, "type": "enum",
"javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "d [...]
- "secretId": { "index": 6, "kind": "property", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
- "url": { "index": 7, "kind": "property", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
- "verifySsl": { "index": 8, "kind": "property", "displayName": "Verify
Ssl", "group": "producer", "label": "", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify SSL
certificates when connecting to CyberArk Conjur" },
- "autowiredEnabled": { "index": 9, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching t [...]
- "apiKey": { "index": 10, "kind": "property", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
- "authToken": { "index": 11, "kind": "property", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
- "password": { "index": 12, "kind": "property", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
- "username": { "index": 13, "kind": "property", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" }
+ "configuration": { "index": 1, "kind": "property", "displayName":
"Configuration", "group": "producer", "label": "", "required": false, "type":
"object", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"deprecated": false, "autowired": false, "secret": false, "description":
"Component configuration" },
+ "conjurClient": { "index": 2, "kind": "property", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
+ "lazyStartProducer": { "index": 3, "kind": "property", "displayName":
"Lazy Start Producer", "group": "producer", "label": "producer", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": false, "description":
"Whether the producer should be started lazy (on the first message). By
starting lazy you can use this to allow CamelContext and routes to startup in
situations where a producer may otherwise fail [...]
+ "operation": { "index": 4, "kind": "property", "displayName": "Operation",
"group": "producer", "label": "", "required": false, "type": "enum",
"javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "d [...]
+ "secretId": { "index": 5, "kind": "property", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
+ "url": { "index": 6, "kind": "property", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
+ "autowiredEnabled": { "index": 7, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching t [...]
+ "apiKey": { "index": 8, "kind": "property", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
+ "authToken": { "index": 9, "kind": "property", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
+ "certificatePath": { "index": 10, "kind": "property", "displayName":
"Certificate Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path of a file with the
SSL certificate to trust when connecting to CyberArk Conj [...]
+ "password": { "index": 11, "kind": "property", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
+ "username": { "index": 12, "kind": "property", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" },
+ "verifySsl": { "index": 13, "kind": "property", "displayName": "Verify
Ssl", "group": "security", "label": "security", "required": false, "type":
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false,
"secret": false, "security": "insecure:ssl", "insecureValue": "false",
"defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify the
SSL [...]
},
"bodyTypes": {
"producerIn": { "carriers": [ "any" ], "byOption": [ { "option":
"operation", "value": "createSecret", "carriers": [ "text", "bytes", "stream",
"file" ] } ], "description": "getSecret, the default operation, does not read
the body. createSecret stores the body as text, unless the
CamelCyberArkVaultSecretValue header is set: bytes, a stream or a file are read
as text, a Map or a POJO is stored as its toString(), so marshal it first, and
no body fails" },
- "producerOut": { "carriers": [ "text" ], "javaType": "java.lang.String",
"byOption": [ { "option": "operation", "value": "createSecret", "carriers": [
"unchanged" ] } ], "description": "The value of the secret as text for
getSecret, also in the CamelCyberArkVaultSecretValue header: unmarshal a JSON
secret to read its fields. createSecret leaves the body unchanged" }
+ "producerOut": { "carriers": [ "text" ], "javaType": "java.lang.String",
"byOption": [ { "option": "operation", "value": "createSecret", "carriers": [
"unchanged" ] } ], "description": "The value of the secret as text for
getSecret: unmarshal a JSON secret to read its fields. createSecret leaves the
body unchanged" }
},
"properties": {
"label": { "index": 0, "kind": "path", "displayName": "Label", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Logical name" },
"account": { "index": 1, "kind": "parameter", "displayName": "Account",
"group": "producer", "label": "", "required": true, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "",
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
account name" },
- "certificatePath": { "index": 2, "kind": "parameter", "displayName":
"Certificate Path", "group": "producer", "label": "", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path to the SSL
certificate for verification" },
- "conjurClient": { "index": 3, "kind": "parameter", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
- "operation": { "index": 4, "kind": "parameter", "displayName":
"Operation", "group": "producer", "label": "", "required": false, "type":
"enum", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", " [...]
- "secretId": { "index": 5, "kind": "parameter", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
- "url": { "index": 6, "kind": "parameter", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
- "verifySsl": { "index": 7, "kind": "parameter", "displayName": "Verify
Ssl", "group": "producer", "label": "", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify SSL
certificates when connecting to CyberArk Conjur" },
- "lazyStartProducer": { "index": 8, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produc [...]
- "apiKey": { "index": 9, "kind": "parameter", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
- "authToken": { "index": 10, "kind": "parameter", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
- "password": { "index": 11, "kind": "parameter", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
- "username": { "index": 12, "kind": "parameter", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" }
+ "conjurClient": { "index": 2, "kind": "parameter", "displayName": "Conjur
Client", "group": "producer", "label": "", "required": false, "type": "object",
"javaType": "org.apache.camel.component.cyberark.vault.client.ConjurClient",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Reference to a
ConjurClient instance in the registry" },
+ "operation": { "index": 3, "kind": "parameter", "displayName":
"Operation", "group": "producer", "label": "", "required": false, "type":
"enum", "javaType":
"org.apache.camel.component.cyberark.vault.CyberArkVaultOperations", "enum": [
"getSecret", "createSecret" ], "deprecated": false, "autowired": false,
"secret": false, "defaultValue": "getSecret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", " [...]
+ "secretId": { "index": 4, "kind": "parameter", "displayName": "Secret Id",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The secret ID to
retrieve from CyberArk Conjur" },
+ "url": { "index": 5, "kind": "parameter", "displayName": "Url", "group":
"producer", "label": "", "required": true, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The CyberArk Conjur
instance URL" },
+ "lazyStartProducer": { "index": 6, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produc [...]
+ "apiKey": { "index": 7, "kind": "parameter", "displayName": "Api Key",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The API key for
authentication with CyberArk Conjur" },
+ "authToken": { "index": 8, "kind": "parameter", "displayName": "Auth
Token", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false, "autowired":
false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Pre-authenticated token
to use for CyberArk Conjur" },
+ "certificatePath": { "index": 9, "kind": "parameter", "displayName":
"Certificate Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Path of a file with the
SSL certificate to trust when connecting to CyberArk Conj [...]
+ "password": { "index": 10, "kind": "parameter", "displayName": "Password",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The password for
authentication with CyberArk Conjur" },
+ "username": { "index": 11, "kind": "parameter", "displayName": "Username",
"group": "security", "label": "security", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "The username for
authentication with CyberArk Conjur" },
+ "verifySsl": { "index": 12, "kind": "parameter", "displayName": "Verify
Ssl", "group": "security", "label": "security", "required": false, "type":
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false,
"secret": false, "security": "insecure:ssl", "insecureValue": "false",
"defaultValue": true, "configurationClass":
"org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration",
"configurationField": "configuration", "description": "Whether to verify the SS
[...]
}
}
diff --git
a/components/camel-cyberark-vault/src/main/docs/cyberark-vault-component.adoc
b/components/camel-cyberark-vault/src/main/docs/cyberark-vault-component.adoc
index 7c8735d9c962..eb5a919ed294 100644
---
a/components/camel-cyberark-vault/src/main/docs/cyberark-vault-component.adoc
+++
b/components/camel-cyberark-vault/src/main/docs/cyberark-vault-component.adoc
@@ -577,20 +577,29 @@ YAML::
=== SSL Certificate Verification
-By default, SSL certificate verification is enabled. You can disable it for
testing purposes (not recommended for production):
+By default, the certificate and the host name of the CyberArk Conjur server
are verified with the default trust store
+of the JVM.
+
+When the server has a certificate of a private CA, or a self-signed
certificate, provide the path of a file with that
+certificate, in PEM or DER format. The certificates in the file are trusted
instead of the default trust store of the
+JVM:
[source,properties]
----
-camel.vault.cyberark.verifySsl=false
+camel.vault.cyberark.certificatePath=/path/to/cert.pem
----
-Or provide a custom certificate path:
+You can disable the verification for testing purposes, which trusts any server
(not recommended for production):
[source,properties]
----
-camel.vault.cyberark.certificatePath=/path/to/cert.pem
+camel.vault.cyberark.verifySsl=false
----
+The `camel.vault.cyberark` properties configure the CyberArk Conjur Vault
Property Function. An endpoint uses its own
+`certificatePath` and `verifySsl` options, which do not apply when the
endpoint has a `conjurClient`. The security
+policy (for example `camel.main.profile=prod`) reports `verifySsl` set to
`false` as an insecure SSL setting.
+
=== Setting Up CyberArk Conjur for Testing
Before you can use the component or run integration tests, you need to set up
a CyberArk Conjur instance and configure policies to define which secrets
(variables) are available.
diff --git
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultConfiguration.java
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultConfiguration.java
index 82b7a54f0c0e..6fd85e961630 100644
---
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultConfiguration.java
+++
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultConfiguration.java
@@ -59,10 +59,10 @@ public class CyberArkVaultConfiguration implements
Cloneable {
@UriParam(label = "security", security = "secret")
private String authToken;
- @UriParam(defaultValue = "true")
+ @UriParam(label = "security", defaultValue = "true", security =
"insecure:ssl", insecureValue = "false")
private boolean verifySsl = true;
- @UriParam
+ @UriParam(label = "security")
private String certificatePath;
@UriParam
@@ -172,7 +172,8 @@ public class CyberArkVaultConfiguration implements
Cloneable {
}
/**
- * Whether to verify SSL certificates when connecting to CyberArk Conjur
+ * Whether to verify the SSL certificate and the host name of the CyberArk
Conjur server. Setting it to false trusts
+ * any server, so use it only for testing.
*/
public void setVerifySsl(boolean verifySsl) {
this.verifySsl = verifySsl;
@@ -183,7 +184,9 @@ public class CyberArkVaultConfiguration implements
Cloneable {
}
/**
- * Path to the SSL certificate for verification
+ * Path of a file with the SSL certificate to trust when connecting to
CyberArk Conjur, for example the certificate
+ * of a private CA, in PEM or DER format. The certificates in the file are
trusted instead of the default trust
+ * store of the JVM. Not used when verifySsl is false.
*/
public void setCertificatePath(String certificatePath) {
this.certificatePath = certificatePath;
diff --git
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultEndpoint.java
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultEndpoint.java
index 2a2b05e5b482..c17e97c78165 100644
---
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultEndpoint.java
+++
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultEndpoint.java
@@ -16,6 +16,8 @@
*/
package org.apache.camel.component.cyberark.vault;
+import javax.net.ssl.SSLContext;
+
import org.apache.camel.Category;
import org.apache.camel.Component;
import org.apache.camel.Consumer;
@@ -50,9 +52,8 @@ import org.apache.camel.util.ObjectHelper;
producerOut = @BodyType(value = Carrier.TEXT, javaType =
"java.lang.String",
byOption = @BodyType.When(option =
"operation", value = "createSecret",
carriers =
Carrier.UNCHANGED),
- description = "The value of the secret as
text for getSecret, also in the"
- + "
CamelCyberArkVaultSecretValue header: unmarshal a JSON secret to read its"
- + " fields. createSecret
leaves the body unchanged"))
+ description = "The value of the secret as
text for getSecret: unmarshal a JSON secret to"
+ + " read its fields.
createSecret leaves the body unchanged"))
public class CyberArkVaultEndpoint extends DefaultEndpoint implements
EndpointServiceLocation {
@UriParam
@@ -96,13 +97,15 @@ public class CyberArkVaultEndpoint extends DefaultEndpoint
implements EndpointSe
String apiKey = configuration.getApiKey();
String username = configuration.getUsername();
String password = configuration.getPassword();
+ SSLContext sslContext
+ =
ConjurClientFactory.createSslContext(configuration.isVerifySsl(),
configuration.getCertificatePath());
if (ObjectHelper.isNotEmpty(authToken)) {
- conjurClient = ConjurClientFactory.createWithToken(url,
account, authToken);
+ conjurClient = ConjurClientFactory.createWithToken(url,
account, authToken, sslContext);
} else if (ObjectHelper.isNotEmpty(apiKey)) {
- conjurClient = ConjurClientFactory.createWithApiKey(url,
account, username, apiKey);
+ conjurClient = ConjurClientFactory.createWithApiKey(url,
account, username, apiKey, sslContext);
} else if (ObjectHelper.isNotEmpty(username) &&
ObjectHelper.isNotEmpty(password)) {
- conjurClient = ConjurClientFactory.createWithCredentials(url,
account, username, password);
+ conjurClient = ConjurClientFactory.createWithCredentials(url,
account, username, password, sslContext);
}
}
}
diff --git
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultProducer.java
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultProducer.java
index badd6041711a..98cae310c4ac 100644
---
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultProducer.java
+++
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultProducer.java
@@ -67,7 +67,6 @@ public class CyberArkVaultProducer extends DefaultProducer {
String secretValue = client.retrieveSecret(secretId, version);
message.setBody(secretValue);
message.setHeader(CyberArkVaultConstants.SECRET_ID, secretId);
- message.setHeader(CyberArkVaultConstants.SECRET_VALUE,
secretValue);
if (version != null) {
message.setHeader(CyberArkVaultConstants.SECRET_VERSION,
version);
}
diff --git
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultPropertiesFunction.java
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultPropertiesFunction.java
index 7ba9f35bdfba..87074b4c9a2a 100644
---
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultPropertiesFunction.java
+++
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/CyberArkVaultPropertiesFunction.java
@@ -20,6 +20,8 @@ import java.util.Collections;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;
+import javax.net.ssl.SSLContext;
+
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -125,16 +127,21 @@ public class CyberArkVaultPropertiesFunction extends
ServiceSupport implements P
this.account = account;
if (ObjectHelper.isNotEmpty(url) && ObjectHelper.isNotEmpty(account)) {
+ // the SSL settings are only in the vault configuration
(camel.vault.cyberark.verifySsl and certificatePath)
+ CyberArkVaultConfiguration sslConfiguration =
getCamelContext().getVaultConfiguration().cyberark();
+ SSLContext sslContext =
ConjurClientFactory.createSslContext(sslConfiguration.isVerifySsl(),
+ sslConfiguration.getCertificatePath());
+
// Create Conjur client based on authentication method
if (ObjectHelper.isNotEmpty(authToken)) {
// Use pre-authenticated token
- client = ConjurClientFactory.createWithToken(url, account,
authToken);
+ client = ConjurClientFactory.createWithToken(url, account,
authToken, sslContext);
} else if (ObjectHelper.isNotEmpty(apiKey)) {
// Use API key authentication
- client = ConjurClientFactory.createWithApiKey(url, account,
username, apiKey);
+ client = ConjurClientFactory.createWithApiKey(url, account,
username, apiKey, sslContext);
} else if (ObjectHelper.isNotEmpty(username) &&
ObjectHelper.isNotEmpty(password)) {
// Use username/password authentication
- client = ConjurClientFactory.createWithCredentials(url,
account, username, password);
+ client = ConjurClientFactory.createWithCredentials(url,
account, username, password, sslContext);
} else {
throw new RuntimeCamelException(
"Using the CyberArk Conjur Vault Properties Function
requires authentication credentials (authToken, apiKey, or username/password)");
diff --git
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/ConjurClientFactory.java
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/ConjurClientFactory.java
index 4f46c054547a..2eff03439576 100644
---
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/ConjurClientFactory.java
+++
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/ConjurClientFactory.java
@@ -16,13 +16,36 @@
*/
package org.apache.camel.component.cyberark.vault.client;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.Socket;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Collection;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509ExtendedTrustManager;
+
import org.apache.camel.component.cyberark.vault.client.impl.ConjurClientImpl;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/**
* Factory for creating CyberArk Conjur clients
*/
public final class ConjurClientFactory {
+ private static final Logger LOG =
LoggerFactory.getLogger(ConjurClientFactory.class);
+
private ConjurClientFactory() {
}
@@ -39,6 +62,21 @@ public final class ConjurClientFactory {
return new ConjurClientImpl(url, account, username, password, null,
null);
}
+ /**
+ * Create a Conjur client using username and password authentication
+ *
+ * @param url the Conjur server URL
+ * @param account the Conjur account name
+ * @param username the username for authentication
+ * @param password the password for authentication
+ * @param sslContext the SSL context for HTTPS connections, or null to
use the default SSL context of the JVM
+ * @return a configured ConjurClient instance
+ */
+ public static ConjurClient createWithCredentials(
+ String url, String account, String username, String password,
SSLContext sslContext) {
+ return new ConjurClientImpl(url, account, username, password, null,
null, sslContext);
+ }
+
/**
* Create a Conjur client using API key authentication
*
@@ -52,6 +90,21 @@ public final class ConjurClientFactory {
return new ConjurClientImpl(url, account, username, null, apiKey,
null);
}
+ /**
+ * Create a Conjur client using API key authentication
+ *
+ * @param url the Conjur server URL
+ * @param account the Conjur account name
+ * @param username the username (login) for the API key
+ * @param apiKey the API key for authentication
+ * @param sslContext the SSL context for HTTPS connections, or null to
use the default SSL context of the JVM
+ * @return a configured ConjurClient instance
+ */
+ public static ConjurClient createWithApiKey(
+ String url, String account, String username, String apiKey,
SSLContext sslContext) {
+ return new ConjurClientImpl(url, account, username, null, apiKey,
null, sslContext);
+ }
+
/**
* Create a Conjur client using a pre-authenticated token
*
@@ -63,4 +116,103 @@ public final class ConjurClientFactory {
public static ConjurClient createWithToken(String url, String account,
String authToken) {
return new ConjurClientImpl(url, account, null, null, null, authToken);
}
+
+ /**
+ * Create a Conjur client using a pre-authenticated token
+ *
+ * @param url the Conjur server URL
+ * @param account the Conjur account name
+ * @param authToken the pre-authenticated access token
+ * @param sslContext the SSL context for HTTPS connections, or null to
use the default SSL context of the JVM
+ * @return a configured ConjurClient instance
+ */
+ public static ConjurClient createWithToken(String url, String account,
String authToken, SSLContext sslContext) {
+ return new ConjurClientImpl(url, account, null, null, null, authToken,
sslContext);
+ }
+
+ /**
+ * Create the SSL context for the HTTPS connections to Conjur, from the
verifySsl and certificatePath options.
+ *
+ * @param verifySsl whether to verify the certificate and
the host name of the server. When false,
+ * any server is trusted and the
certificate path is not used.
+ * @param certificatePath the path of a file with the
certificates (PEM or DER) to trust instead of the
+ * default trust store of the JVM, for
example the certificate of a private CA, or
+ * null
+ * @return the SSL context, or null to use the
default SSL context of the JVM
+ * @throws IOException if the certificate file cannot be read
+ * @throws GeneralSecurityException if the file has no certificate, or the
SSL context cannot be created
+ */
+ public static SSLContext createSslContext(boolean verifySsl, String
certificatePath)
+ throws IOException, GeneralSecurityException {
+ if (!verifySsl) {
+ LOG.warn("SSL verification is disabled (verifySsl=false): the
certificate and the host name of the"
+ + " CyberArk Conjur server are not checked");
+ SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
+ sslContext.init(null, new TrustManager[] { new
InsecureTrustManager() }, null);
+ return sslContext;
+ }
+ if (certificatePath == null || certificatePath.isBlank()) {
+ return null;
+ }
+
+ Collection<? extends Certificate> certificates;
+ try (InputStream in = Files.newInputStream(Path.of(certificatePath))) {
+ certificates =
CertificateFactory.getInstance("X.509").generateCertificates(in);
+ }
+ if (certificates.isEmpty()) {
+ throw new CertificateException("No certificate in the file of the
certificatePath option: " + certificatePath);
+ }
+ KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
+ trustStore.load(null, null);
+ int index = 0;
+ for (Certificate certificate : certificates) {
+ trustStore.setCertificateEntry("conjur-" + index++, certificate);
+ }
+ TrustManagerFactory trustManagerFactory =
TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+ trustManagerFactory.init(trustStore);
+ SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
+ sslContext.init(null, trustManagerFactory.getTrustManagers(), null);
+ return sslContext;
+ }
+
+ /**
+ * Trusts any server without checking its certificate or its host name.
Only used when verifySsl is false.
+ */
+ private static final class InsecureTrustManager extends
X509ExtendedTrustManager {
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String
authType) {
+ // verifySsl is false
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String
authType) {
+ // verifySsl is false
+ }
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String
authType, Socket socket) {
+ // verifySsl is false
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String
authType, Socket socket) {
+ // verifySsl is false
+ }
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String
authType, SSLEngine engine) {
+ // verifySsl is false
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String
authType, SSLEngine engine) {
+ // verifySsl is false
+ }
+
+ @Override
+ public X509Certificate[] getAcceptedIssuers() {
+ return new X509Certificate[0];
+ }
+ }
}
diff --git
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/impl/ConjurClientImpl.java
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/impl/ConjurClientImpl.java
index d0d4af414f43..4d30e9eb9875 100644
---
a/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/impl/ConjurClientImpl.java
+++
b/components/camel-cyberark-vault/src/main/java/org/apache/camel/component/cyberark/vault/client/impl/ConjurClientImpl.java
@@ -26,6 +26,8 @@ import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.util.Base64;
+import javax.net.ssl.SSLContext;
+
import org.apache.camel.component.cyberark.vault.client.ConjurClient;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -48,15 +50,29 @@ public class ConjurClientImpl implements ConjurClient {
public ConjurClientImpl(
String url, String account, String username,
String password, String apiKey, String authToken) {
+ this(url, account, username, password, apiKey, authToken, null);
+ }
+
+ /**
+ * Creates a client that uses the given SSL context for HTTPS connections.
+ *
+ * @param sslContext the SSL context, or null to use the default SSL
context of the JVM
+ */
+ public ConjurClientImpl(
+ String url, String account, String username,
+ String password, String apiKey, String authToken,
SSLContext sslContext) {
this.url = url.endsWith("/") ? url.substring(0, url.length() - 1) :
url;
this.account = account;
this.username = username;
this.password = password;
this.apiKey = apiKey;
this.authToken = authToken;
- this.httpClient = HttpClient.newBuilder()
- .connectTimeout(Duration.ofSeconds(10))
- .build();
+ HttpClient.Builder builder = HttpClient.newBuilder()
+ .connectTimeout(Duration.ofSeconds(10));
+ if (sslContext != null) {
+ builder.sslContext(sslContext);
+ }
+ this.httpClient = builder.build();
}
@Override
@@ -84,7 +100,7 @@ public class ConjurClientImpl implements ConjurClient {
url, account, encodedSecretId);
if (version != null && !version.isEmpty()) {
- secretsUrl += "?version=" + version;
+ secretsUrl += "?version=" + URLEncoder.encode(version,
StandardCharsets.UTF_8);
}
HttpRequest request = HttpRequest.newBuilder()
diff --git
a/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/CyberArkVaultProducerTest.java
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/CyberArkVaultProducerTest.java
new file mode 100644
index 000000000000..ac104297cc97
--- /dev/null
+++
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/CyberArkVaultProducerTest.java
@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.cyberark.vault;
+
+import org.apache.camel.Exchange;
+import org.apache.camel.RoutesBuilder;
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.component.cyberark.vault.client.ConjurClient;
+import org.apache.camel.component.mock.MockEndpoint;
+import org.apache.camel.spi.Registry;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+/**
+ * getSecret sets the secret only as the body, so a createSecret later in the
same exchange stores its own body.
+ */
+class CyberArkVaultProducerTest extends CamelTestSupport {
+
+ private static final String SECRET_ID = "db/password";
+
+ private final ConjurClient client = mock(ConjurClient.class);
+
+ @Override
+ protected void bindToRegistry(Registry registry) throws Exception {
+ when(client.retrieveSecret(SECRET_ID, null)).thenReturn("old-value");
+ registry.bind("conjurClient", client);
+ }
+
+ @Override
+ protected RoutesBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ from("direct:get")
+ .to("cyberark-vault:secret?secretId=" + SECRET_ID +
"&conjurClient=#conjurClient")
+ .to("mock:result");
+
+ from("direct:getThenCreate")
+ .to("cyberark-vault:secret?secretId=" + SECRET_ID +
"&conjurClient=#conjurClient")
+ .setBody(constant("new-value"))
+
.to("cyberark-vault:secret?operation=createSecret&secretId=" + SECRET_ID
+ + "&conjurClient=#conjurClient")
+ .to("mock:result");
+
+ from("direct:createFromHeader")
+ .setHeader(CyberArkVaultConstants.SECRET_VALUE,
constant("header-value"))
+
.to("cyberark-vault:secret?operation=createSecret&secretId=" + SECRET_ID
+ + "&conjurClient=#conjurClient")
+ .to("mock:result");
+ }
+ };
+ }
+
+ @Test
+ void getSecretSetsTheSecretOnlyAsTheBody() throws Exception {
+ MockEndpoint result = getMockEndpoint("mock:result");
+ result.expectedBodiesReceived("old-value");
+
+ template.sendBody("direct:get", null);
+
+ result.assertIsSatisfied();
+ Exchange exchange = result.getExchanges().get(0);
+
assertNull(exchange.getMessage().getHeader(CyberArkVaultConstants.SECRET_VALUE));
+ assertEquals(SECRET_ID,
exchange.getMessage().getHeader(CyberArkVaultConstants.SECRET_ID));
+ }
+
+ @Test
+ void createSecretAfterGetSecretStoresTheNewBody() throws Exception {
+ MockEndpoint result = getMockEndpoint("mock:result");
+ result.expectedBodiesReceived("new-value");
+
+ template.sendBody("direct:getThenCreate", null);
+
+ result.assertIsSatisfied();
+ verify(client).createSecret(SECRET_ID, "new-value");
+ }
+
+ @Test
+ void createSecretStoresTheSecretValueHeader() throws Exception {
+ MockEndpoint result = getMockEndpoint("mock:result");
+ result.expectedMessageCount(1);
+
+ template.sendBody("direct:createFromHeader", "body-value");
+
+ result.assertIsSatisfied();
+ verify(client).createSecret(SECRET_ID, "header-value");
+ }
+}
diff --git
a/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/CyberArkVaultSslTest.java
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/CyberArkVaultSslTest.java
new file mode 100644
index 000000000000..df48ac3dcaf8
--- /dev/null
+++
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/CyberArkVaultSslTest.java
@@ -0,0 +1,214 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.cyberark.vault;
+
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.security.KeyStore;
+import java.security.cert.X509Certificate;
+import java.util.Base64;
+
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
+
+import com.sun.net.httpserver.HttpsConfigurator;
+import com.sun.net.httpserver.HttpsServer;
+import org.apache.camel.CamelExecutionException;
+import org.apache.camel.Endpoint;
+import org.apache.camel.RuntimeCamelException;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * The verifySsl and certificatePath options, of an endpoint and of the vault
configuration, against an HTTPS server
+ * with a self-signed certificate for localhost (conjur-server.p12, and its
certificate in conjur-server.pem).
+ * <p>
+ * The files were made with: {@code keytool -genkeypair -alias conjur -keyalg
EC -groupname secp256r1 -validity 36500
+ * -dname CN=localhost -ext SAN=dns:localhost -keystore conjur-server.p12
-storetype PKCS12 -storepass changeit} and
+ * {@code keytool -exportcert -rfc -alias conjur -keystore conjur-server.p12
-storepass changeit -file conjur-server.pem}
+ */
+class CyberArkVaultSslTest extends CamelTestSupport {
+
+ private static final String SSL_RESOURCES =
"/org/apache/camel/component/cyberark/vault/ssl/";
+
+ @TempDir
+ Path tempDir;
+
+ private HttpsServer server;
+ private String certificatePath;
+
+ @BeforeEach
+ void startConjur() throws Exception {
+ KeyStore keyStore = KeyStore.getInstance("PKCS12");
+ try (InputStream in = getClass().getResourceAsStream(SSL_RESOURCES +
"conjur-server.p12")) {
+ keyStore.load(in, "changeit".toCharArray());
+ }
+ KeyManagerFactory keyManagerFactory =
KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+ keyManagerFactory.init(keyStore, "changeit".toCharArray());
+ SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
+ sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
+
+ server = HttpsServer.create(new
InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 0);
+ server.setHttpsConfigurator(new HttpsConfigurator(sslContext));
+ server.createContext("/secrets/", exchange -> {
+ byte[] body = "secret-value".getBytes(StandardCharsets.UTF_8);
+ exchange.sendResponseHeaders(200, body.length);
+ try (OutputStream out = exchange.getResponseBody()) {
+ out.write(body);
+ }
+ });
+ server.start();
+
+ certificatePath = Path.of(getClass().getResource(SSL_RESOURCES +
"conjur-server.pem").toURI()).toString();
+ }
+
+ @AfterEach
+ void stopConjur() {
+ server.stop(0);
+ }
+
+ @Test
+ void defaultTrustRejectsTheServer() {
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () -> getSecret("localhost", ""));
+ assertSslFailure(e);
+ }
+
+ @Test
+ void certificatePathTrustsTheServer() {
+ assertEquals("secret-value", getSecret("localhost",
"&certificatePath=RAW(" + certificatePath + ")"));
+ }
+
+ @Test
+ void certificatePathStillChecksTheHostName() {
+ // the certificate is for localhost only
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () -> getSecret("127.0.0.1", "&certificatePath=RAW(" +
certificatePath + ")"));
+ assertSslFailure(e);
+ }
+
+ @Test
+ void certificatePathTrustsOnlyItsCertificates() throws Exception {
+ String otherCertificatePath = writeAnotherCertificate();
+
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () -> getSecret("localhost", "&certificatePath=RAW(" +
otherCertificatePath + ")"));
+ assertSslFailure(e);
+ }
+
+ @Test
+ void verifySslFalseTrustsAnyServer() {
+ // neither the certificate nor the host name is checked
+ assertEquals("secret-value", getSecret("127.0.0.1",
"&verifySsl=false"));
+ }
+
+ @Test
+ void missingCertificateFileFailsAtStart() throws Exception {
+ Endpoint endpoint =
context.getComponent("cyberark-vault").createEndpoint(
+
"cyberark-vault:secret?secretId=db/password&url=https://localhost:1&account=myaccount&authToken=my-token";
+
+ "&certificatePath=RAW("
+
+ tempDir.resolve("missing.pem") + ")");
+
+ RuntimeCamelException e = assertThrows(RuntimeCamelException.class,
endpoint::start);
+ assertInstanceOf(NoSuchFileException.class, e.getCause());
+ }
+
+ @Test
+ void propertiesFunctionUsesTheCertificatePathOfTheVaultConfiguration()
throws Exception {
+ var vault = context.getVaultConfiguration().cyberark();
+ vault.setCertificatePath(certificatePath);
+
+ assertEquals("secret-value",
resolveWithPropertiesFunction("localhost"));
+ }
+
+ @Test
+ void propertiesFunctionUsesTheVerifySslOfTheVaultConfiguration() throws
Exception {
+ var vault = context.getVaultConfiguration().cyberark();
+ vault.setVerifySsl(false);
+
+ assertEquals("secret-value",
resolveWithPropertiesFunction("127.0.0.1"));
+ }
+
+ private String getSecret(String host, String options) {
+ return template.requestBody(
+ "cyberark-vault:secret?secretId=db/password&url=" +
conjurUrl(host)
+ + "&account=myaccount&authToken=my-token"
+ options,
+ null, String.class);
+ }
+
+ private String resolveWithPropertiesFunction(String host) throws Exception
{
+ var vault = context.getVaultConfiguration().cyberark();
+ vault.setUrl(conjurUrl(host));
+ vault.setAccount("myaccount");
+ vault.setAuthToken("my-token");
+
+ CyberArkVaultPropertiesFunction function = new
CyberArkVaultPropertiesFunction();
+ function.setCamelContext(context);
+ function.start();
+ try {
+ return function.apply("db/password");
+ } finally {
+ function.stop();
+ }
+ }
+
+ private String conjurUrl(String host) {
+ return "https://"; + host + ":" + server.getAddress().getPort();
+ }
+
+ /**
+ * Writes a certificate trusted by the JVM, which is not the certificate
of the server, to a PEM file.
+ */
+ private String writeAnotherCertificate() throws Exception {
+ TrustManagerFactory trustManagerFactory =
TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+ trustManagerFactory.init((KeyStore) null);
+ X509TrustManager trustManager = (X509TrustManager)
trustManagerFactory.getTrustManagers()[0];
+ X509Certificate other = trustManager.getAcceptedIssuers()[0];
+
+ Path file = tempDir.resolve("other.pem");
+ Files.writeString(file, "-----BEGIN CERTIFICATE-----\n"
+ + Base64.getMimeEncoder(64,
"\n".getBytes(StandardCharsets.US_ASCII))
+ .encodeToString(other.getEncoded())
+ + "\n-----END CERTIFICATE-----\n");
+ return file.toString();
+ }
+
+ private static void assertSslFailure(Exception e) {
+ Throwable cause = e;
+ while (cause != null && !(cause instanceof SSLException)) {
+ cause = cause.getCause();
+ }
+ assertTrue(cause instanceof SSLException, "Expected an SSL failure,
but was: " + e);
+ }
+}
diff --git
a/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/client/impl/ConjurClientSecretVersionTest.java
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/client/impl/ConjurClientSecretVersionTest.java
new file mode 100644
index 000000000000..2762bd3b0320
--- /dev/null
+++
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/client/impl/ConjurClientSecretVersionTest.java
@@ -0,0 +1,97 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.cyberark.vault.client.impl;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+import java.util.concurrent.CopyOnWriteArrayList;
+
+import com.sun.net.httpserver.HttpServer;
+import org.apache.camel.component.cyberark.vault.client.ConjurClient;
+import org.apache.camel.component.cyberark.vault.client.ConjurClientFactory;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * The version of the secret is sent as one encoded query parameter.
+ */
+class ConjurClientSecretVersionTest {
+
+ private final List<String> rawQueries = new CopyOnWriteArrayList<>();
+
+ private HttpServer server;
+ private String url;
+
+ @BeforeEach
+ void startConjur() throws IOException {
+ server = HttpServer.create(new
InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 0);
+ server.createContext("/secrets/", exchange -> {
+
rawQueries.add(String.valueOf(exchange.getRequestURI().getRawQuery()));
+ byte[] body = "secret-value".getBytes(StandardCharsets.UTF_8);
+ exchange.sendResponseHeaders(200, body.length);
+ try (OutputStream out = exchange.getResponseBody()) {
+ out.write(body);
+ }
+ });
+ server.start();
+ url = "http://localhost:"; + server.getAddress().getPort();
+ }
+
+ @AfterEach
+ void stopConjur() {
+ server.stop(0);
+ }
+
+ @Test
+ void numericVersion() throws Exception {
+ try (ConjurClient client = ConjurClientFactory.createWithToken(url,
"myaccount", "my-token")) {
+ assertEquals("secret-value", client.retrieveSecret("db/password",
"3"));
+ }
+ assertEquals(List.of("version=3"), rawQueries);
+ }
+
+ @Test
+ void versionWithReservedCharactersIsEncoded() throws Exception {
+ try (ConjurClient client = ConjurClientFactory.createWithToken(url,
"myaccount", "my-token")) {
+ assertEquals("secret-value", client.retrieveSecret("db/password",
"1&other=2"));
+ }
+ assertEquals(List.of("version=1%26other%3D2"), rawQueries);
+ }
+
+ @Test
+ void versionWithSpaceIsEncoded() throws Exception {
+ try (ConjurClient client = ConjurClientFactory.createWithToken(url,
"myaccount", "my-token")) {
+ assertEquals("secret-value", client.retrieveSecret("db/password",
"1 2"));
+ }
+ assertEquals(List.of("version=1+2"), rawQueries);
+ }
+
+ @Test
+ void noVersion() throws Exception {
+ try (ConjurClient client = ConjurClientFactory.createWithToken(url,
"myaccount", "my-token")) {
+ assertEquals("secret-value", client.retrieveSecret("db/password"));
+ }
+ assertEquals(List.of("null"), rawQueries);
+ }
+}
diff --git
a/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/integration/CyberArkVaultProducerIT.java
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/integration/CyberArkVaultProducerIT.java
index bc747cc145fc..61a9fcf6646f 100644
---
a/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/integration/CyberArkVaultProducerIT.java
+++
b/components/camel-cyberark-vault/src/test/java/org/apache/camel/component/cyberark/vault/integration/CyberArkVaultProducerIT.java
@@ -24,6 +24,7 @@ import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
class CyberArkVaultProducerIT extends CyberArkTestSupport {
@@ -86,8 +87,9 @@ class CyberArkVaultProducerIT extends CyberArkTestSupport {
String secretId =
exchange.getMessage().getHeader(CyberArkVaultConstants.SECRET_ID, String.class);
assertEquals("test/secret", secretId);
- String secretValue =
exchange.getMessage().getHeader(CyberArkVaultConstants.SECRET_VALUE,
String.class);
- assertEquals("mySecretValue", secretValue);
+ // the secret is only in the body
+ assertEquals("mySecretValue",
exchange.getMessage().getBody(String.class));
+
assertNull(exchange.getMessage().getHeader(CyberArkVaultConstants.SECRET_VALUE));
}
@Override
diff --git
a/components/camel-cyberark-vault/src/test/resources/org/apache/camel/component/cyberark/vault/ssl/conjur-server.p12
b/components/camel-cyberark-vault/src/test/resources/org/apache/camel/component/cyberark/vault/ssl/conjur-server.p12
new file mode 100644
index 000000000000..245ed2d8cf1d
Binary files /dev/null and
b/components/camel-cyberark-vault/src/test/resources/org/apache/camel/component/cyberark/vault/ssl/conjur-server.p12
differ
diff --git
a/components/camel-cyberark-vault/src/test/resources/org/apache/camel/component/cyberark/vault/ssl/conjur-server.pem
b/components/camel-cyberark-vault/src/test/resources/org/apache/camel/component/cyberark/vault/ssl/conjur-server.pem
new file mode 100644
index 000000000000..dd40117ad98c
--- /dev/null
+++
b/components/camel-cyberark-vault/src/test/resources/org/apache/camel/component/cyberark/vault/ssl/conjur-server.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBVzCB/qADAgECAgkAzlopBjf9kIUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ
+bG9jYWxob3N0MCAXDTI2MTEwNDE0MDIzNVoYDzIxMjYxMDExMTQwMjM1WjAUMRIw
+EAYDVQQDEwlsb2NhbGhvc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASbwt7S
+8pRy6U60/9XK+Gq0Z0icLJHys4Esj/t/7CusGr8vz5Qh1FqW1K7j9gTvpgrWy8Ug
+jVdletmRxd7guYbPozcwNTAdBgNVHQ4EFgQUjhKjcDAVcuxjPvFRnr5lg5EFJS4w
+FAYDVR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMCA0gAMEUCIQCSLjcDJ7hD
+EC4SNfegniuyLffag7ejyCKgGqSjF/XzwgIgRLgCsfmZ0nytsIoLJjBUes/kmzdw
+sB1L90g7ZdM2x/4=
+-----END CERTIFICATE-----
diff --git
a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
index bdfb91b88856..c3cb84bab65f 100644
--- a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
+++ b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
@@ -328,6 +328,7 @@ public final class SecurityUtils {
owners.put("validateauth", Set.of(
"component:a2a"));
owners.put("verifyssl", Set.of(
+ "component:cyberarkvault",
"component:ibmwatsonxai"));
owners.put("webhooksecrettokenenabled", Set.of(
"component:telegram"));
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index c2bea3562783..3f1183dd7b32 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -1240,6 +1240,29 @@ default). It fails with a
`java.util.concurrent.TimeoutException` when RabbitMQ
and with an `org.springframework.amqp.AmqpTimeoutException` when RabbitMQ does
not confirm it within `confirmTimeout`.
Set `confirm=disabled` to send without waiting, as before.
+=== camel-cyberark-vault - verifySsl and certificatePath are applied, and
getSecret no longer sets the CamelCyberArkVaultSecretValue header
+
+The `verifySsl` and `certificatePath` options of the `cyberark-vault`
endpoint, and the
+`camel.vault.cyberark.verifySsl` and `camel.vault.cyberark.certificatePath`
properties of the CyberArk Conjur Vault
+Property Function, now apply to the HTTPS connections to CyberArk Conjur.
Before, they were ignored, and the default
+trust store of the JVM was always used.
+
+* With `certificatePath`, the certificates in that file (PEM or DER) are
trusted instead of the default trust store of
+ the JVM, and the endpoint or the function fails to start when the file
cannot be read. Remove `certificatePath` to
+ keep the default trust store of the JVM.
+* With `verifySsl=false`, neither the certificate nor the host name of the
server is checked. The option is now marked
+ as an insecure SSL setting, so the security policy reports
`camel.component.cyberark-vault.verifySsl=false`, which
+ fails the startup with `camel.main.profile=prod`. Set `certificatePath` to
the certificate of the server or of its
+ CA instead.
+
+The `getSecret` operation now sets the secret only as the message body, and no
longer sets the
+`CamelCyberArkVaultSecretValue` header. Before, a `createSecret` later in the
same exchange stored the value of that
+header instead of its own body. A route that reads the secret from the
`CamelCyberArkVaultSecretValue` header after
+`getSecret` has to read the body instead, or copy the body into a variable
right after `getSecret`, for example with
+`.setVariable("mySecret", body())`, and read it later with
`${variable.mySecret}`. A variable stays in the exchange,
+while producers such as HTTP, JMS or Kafka send the headers on to the next
system. The `createSecret` operation still
+stores the `CamelCyberArkVaultSecretValue` header when the route sets it.
+
=== camel-rocketmq - the headers are named CamelRocketMQ, and
waitForSendResult is true by default
The header names of `camel-rocketmq` were misspelled `CamelRockerMQ...`; they
are now `CamelRocketMQ...`. The Java
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/CyberarkVaultComponentBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/CyberarkVaultComponentBuilderFactory.java
index 9b956fec3ab2..7f37a0374666 100644
---
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/CyberarkVaultComponentBuilderFactory.java
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/CyberarkVaultComponentBuilderFactory.java
@@ -65,21 +65,6 @@ public interface CyberarkVaultComponentBuilderFactory {
return this;
}
- /**
- * Path to the SSL certificate for verification.
- *
- * The option is a: <code>java.lang.String</code> type.
- *
- * Group: producer
- *
- * @param certificatePath the value to set
- * @return the dsl builder
- */
- default CyberarkVaultComponentBuilder certificatePath(java.lang.String
certificatePath) {
- doSetProperty("certificatePath", certificatePath);
- return this;
- }
-
/**
* Component configuration.
*
@@ -186,24 +171,6 @@ public interface CyberarkVaultComponentBuilderFactory {
}
- /**
- * Whether to verify SSL certificates when connecting to CyberArk
- * Conjur.
- *
- * The option is a: <code>boolean</code> type.
- *
- * Default: true
- * Group: producer
- *
- * @param verifySsl the value to set
- * @return the dsl builder
- */
- default CyberarkVaultComponentBuilder verifySsl(boolean verifySsl) {
- doSetProperty("verifySsl", verifySsl);
- return this;
- }
-
-
/**
* Whether autowiring is enabled. This is used for automatic autowiring
* options (the option must be marked as autowired) by looking up in
the
@@ -255,6 +222,24 @@ public interface CyberarkVaultComponentBuilderFactory {
return this;
}
+ /**
+ * Path of a file with the SSL certificate to trust when connecting to
+ * CyberArk Conjur, for example the certificate of a private CA, in PEM
+ * or DER format. The certificates in the file are trusted instead of
+ * the default trust store of the JVM. Not used when verifySsl is
false.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param certificatePath the value to set
+ * @return the dsl builder
+ */
+ default CyberarkVaultComponentBuilder certificatePath(java.lang.String
certificatePath) {
+ doSetProperty("certificatePath", certificatePath);
+ return this;
+ }
+
/**
* The password for authentication with CyberArk Conjur.
*
@@ -284,6 +269,25 @@ public interface CyberarkVaultComponentBuilderFactory {
doSetProperty("username", username);
return this;
}
+
+
+ /**
+ * Whether to verify the SSL certificate and the host name of the
+ * CyberArk Conjur server. Setting it to false trusts any server, so
use
+ * it only for testing.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param verifySsl the value to set
+ * @return the dsl builder
+ */
+ default CyberarkVaultComponentBuilder verifySsl(boolean verifySsl) {
+ doSetProperty("verifySsl", verifySsl);
+ return this;
+ }
}
class CyberarkVaultComponentBuilderImpl
@@ -306,19 +310,19 @@ public interface CyberarkVaultComponentBuilderFactory {
Object value) {
switch (name) {
case "account": getOrCreateConfiguration((CyberArkVaultComponent)
component).setAccount((java.lang.String) value); return true;
- case "certificatePath":
getOrCreateConfiguration((CyberArkVaultComponent)
component).setCertificatePath((java.lang.String) value); return true;
case "configuration": ((CyberArkVaultComponent)
component).setConfiguration((org.apache.camel.component.cyberark.vault.CyberArkVaultConfiguration)
value); return true;
case "conjurClient":
getOrCreateConfiguration((CyberArkVaultComponent)
component).setConjurClient((org.apache.camel.component.cyberark.vault.client.ConjurClient)
value); return true;
case "lazyStartProducer": ((CyberArkVaultComponent)
component).setLazyStartProducer((boolean) value); return true;
case "operation":
getOrCreateConfiguration((CyberArkVaultComponent)
component).setOperation((org.apache.camel.component.cyberark.vault.CyberArkVaultOperations)
value); return true;
case "secretId": getOrCreateConfiguration((CyberArkVaultComponent)
component).setSecretId((java.lang.String) value); return true;
case "url": getOrCreateConfiguration((CyberArkVaultComponent)
component).setUrl((java.lang.String) value); return true;
- case "verifySsl":
getOrCreateConfiguration((CyberArkVaultComponent)
component).setVerifySsl((boolean) value); return true;
case "autowiredEnabled": ((CyberArkVaultComponent)
component).setAutowiredEnabled((boolean) value); return true;
case "apiKey": getOrCreateConfiguration((CyberArkVaultComponent)
component).setApiKey((java.lang.String) value); return true;
case "authToken":
getOrCreateConfiguration((CyberArkVaultComponent)
component).setAuthToken((java.lang.String) value); return true;
+ case "certificatePath":
getOrCreateConfiguration((CyberArkVaultComponent)
component).setCertificatePath((java.lang.String) value); return true;
case "password": getOrCreateConfiguration((CyberArkVaultComponent)
component).setPassword((java.lang.String) value); return true;
case "username": getOrCreateConfiguration((CyberArkVaultComponent)
component).setUsername((java.lang.String) value); return true;
+ case "verifySsl":
getOrCreateConfiguration((CyberArkVaultComponent)
component).setVerifySsl((boolean) value); return true;
default: return false;
}
}
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CyberArkVaultEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CyberArkVaultEndpointBuilderFactory.java
index b9a35f973e9f..ccadf867b0b8 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CyberArkVaultEndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CyberArkVaultEndpointBuilderFactory.java
@@ -59,20 +59,6 @@ public interface CyberArkVaultEndpointBuilderFactory {
doSetProperty("account", account);
return this;
}
- /**
- * Path to the SSL certificate for verification.
- *
- * The option is a: <code>java.lang.String</code> type.
- *
- * Group: producer
- *
- * @param certificatePath the value to set
- * @return the dsl builder
- */
- default CyberArkVaultEndpointBuilder certificatePath(String
certificatePath) {
- doSetProperty("certificatePath", certificatePath);
- return this;
- }
/**
* Reference to a ConjurClient instance in the registry.
*
@@ -164,38 +150,6 @@ public interface CyberArkVaultEndpointBuilderFactory {
doSetProperty("url", url);
return this;
}
- /**
- * Whether to verify SSL certificates when connecting to CyberArk
- * Conjur.
- *
- * The option is a: <code>boolean</code> type.
- *
- * Default: true
- * Group: producer
- *
- * @param verifySsl the value to set
- * @return the dsl builder
- */
- default CyberArkVaultEndpointBuilder verifySsl(boolean verifySsl) {
- doSetProperty("verifySsl", verifySsl);
- return this;
- }
- /**
- * Whether to verify SSL certificates when connecting to CyberArk
- * Conjur.
- *
- * The option will be converted to a <code>boolean</code> type.
- *
- * Default: true
- * Group: producer
- *
- * @param verifySsl the value to set
- * @return the dsl builder
- */
- default CyberArkVaultEndpointBuilder verifySsl(String verifySsl) {
- doSetProperty("verifySsl", verifySsl);
- return this;
- }
/**
* The API key for authentication with CyberArk Conjur.
*
@@ -224,6 +178,23 @@ public interface CyberArkVaultEndpointBuilderFactory {
doSetProperty("authToken", authToken);
return this;
}
+ /**
+ * Path of a file with the SSL certificate to trust when connecting to
+ * CyberArk Conjur, for example the certificate of a private CA, in PEM
+ * or DER format. The certificates in the file are trusted instead of
+ * the default trust store of the JVM. Not used when verifySsl is
false.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param certificatePath the value to set
+ * @return the dsl builder
+ */
+ default CyberArkVaultEndpointBuilder certificatePath(String
certificatePath) {
+ doSetProperty("certificatePath", certificatePath);
+ return this;
+ }
/**
* The password for authentication with CyberArk Conjur.
*
@@ -252,6 +223,40 @@ public interface CyberArkVaultEndpointBuilderFactory {
doSetProperty("username", username);
return this;
}
+ /**
+ * Whether to verify the SSL certificate and the host name of the
+ * CyberArk Conjur server. Setting it to false trusts any server, so
use
+ * it only for testing.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param verifySsl the value to set
+ * @return the dsl builder
+ */
+ default CyberArkVaultEndpointBuilder verifySsl(boolean verifySsl) {
+ doSetProperty("verifySsl", verifySsl);
+ return this;
+ }
+ /**
+ * Whether to verify the SSL certificate and the host name of the
+ * CyberArk Conjur server. Setting it to false trusts any server, so
use
+ * it only for testing.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param verifySsl the value to set
+ * @return the dsl builder
+ */
+ default CyberArkVaultEndpointBuilder verifySsl(String verifySsl) {
+ doSetProperty("verifySsl", verifySsl);
+ return this;
+ }
}
/**
