Claus Ibsen created CAMEL-26275:
-----------------------------------
Summary: camel-keycloak - the CamelKeycloakOperation header should
only override the configured operation when allowOperationHeader is set
Key: CAMEL-26275
URL: https://issues.apache.org/jira/browse/CAMEL-26275
Project: Camel
Issue Type: Improvement
Components: camel-keycloak
Reporter: Claus Ibsen
Fix For: 4.24.0
Found while adding the catalog body types of keycloak (CAMEL-24961, PR #28416).
{{KeycloakProducer}} (main 2a465aa4814c, line 421) takes the operation from the
{{CamelKeycloakOperation}} header whenever it is set, over the {{operation}} of
the endpoint. So a message with the header turns an endpoint configured for
{{getUser}} into, for example, {{deleteRealm}}, run with the admin client of
the endpoint.
camel-spiffe has an {{allowOperationHeader}} option (default false) for this,
so that the header only picks the operation when the route asks for it.
Proposed: add {{allowOperationHeader}} to camel-keycloak, default false, and
use the header only when it is true; with an entry in the upgrade guide, as
routes that pick the operation by header need to set it.
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
