davsclaus opened a new pull request, #29780: URL: https://github.com/apache/camel/pull/29780
[CAMEL-26902](https://issues.apache.org/jira/browse/CAMEL-26902): upgrades the Keycloak test container to 26.8.2 and fixes the two camel-keycloak ITs that the upgrade breaks. Supersedes #29443. ## Root cause Keycloak 26.8.2 enforces an audience check on the Admin REST API (RFC 9700). A bearer token must carry the new built-in `kc-admin-api` client scope, which adds the realm's Admin API URL as an audience. The Keycloak upgrade assigns that scope to `admin-cli` and `security-admin-console` only; tokens of any other client are rejected with `401 Unauthorized` ([Keycloak 26.8.2 upgrade notes](https://github.com/keycloak/keycloak/blob/release/26.8/docs/documentation/upgrading/topics/changes/changes-26_8_2.adoc)). `KeycloakProducerRevocationIT` runs the producer with `clientId`/`clientSecret` of a client it creates, so `testLogoutAllUsers` and `testPushNotBefore` failed with 401 on #29443. ## Change - test-infra: Keycloak container `26.8.1` -> `26.8.2` (and the generated test-infra metadata, as in #29443). - `KeycloakProducerRevocationIT` assigns `kc-admin-api` as a default client scope to its client when the scope exists, so the test still works against older Keycloak versions, which have no such scope. While touching the setup, two fully qualified class names are replaced by imports. - No change to the producer itself: username/password authentication uses `admin-cli`, which has the scope. Users who authenticate with their own client (`clientId`/`clientSecret`), or pass a pre-obtained `accessToken`, need to give that client the scope. This is documented in `keycloak-producer.adoc` (catalog copy synced) and in a 4.24 upgrade-guide entry. ## Tests In `components/camel-keycloak` against `mirror.gcr.io/keycloak/keycloak:26.8.2`: - `KeycloakProducerRevocationIT`: 4/4 pass (2 failed without the fix, see #29443). - Full module: `mvn verify` with 177 unit tests and 133 ITs (31 skipped), all pass. _Claude Code on behalf of davsclaus_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
