gnodet-bot commented on PR #29443: URL: https://github.com/apache/camel/pull/29443#issuecomment-6734563073
## ❌ Local IT results for `fcb67f92b887` **2 integration tests failed** with Keycloak **26.8.2** due to a **breaking API change** in this release. **Test-infra module**: `camel-test-infra-keycloak` **Components tested**: `camel-keycloak` ### Failure summary | Test | Result | |------|--------| | `KeycloakProducerRevocationIT.testLogoutAllUsers` | ❌ 401 Unauthorized | | `KeycloakProducerRevocationIT.testPushNotBefore` | ❌ 401 Unauthorized | | All other ITs (131 tests) | ✅ Passed | ### Root cause Keycloak 26.8.2 introduced a **breaking change** in the Admin REST API: it now enforces an audience check per [RFC 9700](https://www.rfc-editor.org/rfc/rfc9700). Bearer tokens must carry the `kc-admin-api` scope and have the Admin REST API base URL in their `aud` claim. The upgrade creates the new built-in `kc-admin-api` scope in every realm and assigns it as a default scope for `admin-cli` and `security-admin-console`, but **not for other confidential clients** (such as the service account created in `KeycloakProducerRevocationIT`). As a result, the service account token used by the `logoutAllUsers` and `pushNotBefore` Camel operations (which go through the Admin REST API) is now rejected with HTTP 401 on Keycloak 26.8.2. Reference: https://github.com/keycloak/keycloak/blob/release/26.8/docs/documentation/upgrading/topics/changes/changes-26_8_2.adoc ### Fix required (not pushed — needs human review) The `@BeforeAll` in `KeycloakProducerRevocationIT` should assign the `kc-admin-api` default client scope to the test client after it is created: ```java // After client creation, assign kc-admin-api scope (required from Keycloak 26.8.2) ClientScopeRepresentation adminApiScope = realmResource.clientScopes().findAll().stream() .filter(s -> "kc-admin-api".equals(s.getName())) .findFirst().orElse(null); if (adminApiScope != null) { realmResource.clients().get(clientUuid).addDefaultClientScope(adminApiScope.getId()); } ``` This is not pushed because: 1. The fix needs backward-compatibility testing on Keycloak < 26.8.2 (the `kc-admin-api` scope does not exist there, so the `orElse(null)` guard handles it, but the IT will also fail on old versions without the scope being assigned) 2. It may require a broader review to understand if the operations `logoutAllUsers` and `pushNotBefore` are correct to call via a service account token vs. the admin-cli credentials <details><summary>Test output</summary> ``` [INFO] Running org.apache.camel.component.keycloak.KeycloakProducerRevocationIT [ERROR] Tests run: 4, Failures: 0, Errors: 2, Skipped: 0, Time elapsed: 6.324 s <<< FAILURE! [ERROR] KeycloakProducerRevocationIT.testLogoutAllUsers -- Time elapsed: 0.254 s <<< ERROR! Caused by: jakarta.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized at KeycloakProducer.logoutAllUsers(KeycloakProducer.java:1371) [ERROR] KeycloakProducerRevocationIT.testPushNotBefore -- Time elapsed: 0.616 s <<< ERROR! Caused by: jakarta.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized at KeycloakProducer.pushNotBefore(KeycloakProducer.java:1478) [ERROR] Tests run: 133, Failures: 0, Errors: 2, Skipped: 31 [INFO] BUILD FAILURE [INFO] Total time: 08:46 min ``` </details> > _Local integration tests run by Hermes on behalf of @gnodet_ > _Tests run without `-Dci.env.name` to include ITs disabled on GitHub Actions CI_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
