[
https://issues.apache.org/jira/browse/CAMEL-26902?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26902 started by Claus Ibsen.
-------------------------------------------
> camel-keycloak - Keycloak 26.8.2 requires the kc-admin-api client scope for
> Admin REST API calls
> ------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26902
> URL: https://issues.apache.org/jira/browse/CAMEL-26902
> Project: Camel
> Issue Type: Task
> Components: camel-keycloak
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.24.0
>
>
> Keycloak 26.8.2 enforces an audience check on the Admin REST API (RFC 9700):
> a bearer token must carry the new built-in kc-admin-api client scope, which
> adds the realm Admin API URL as audience. On upgrade the scope is assigned by
> default only to admin-cli and security-admin-console; any other client or
> service account used for Admin API calls gets 401 Unauthorized.
> In Camel this shows up in KeycloakProducerRevocationIT (testLogoutAllUsers,
> testPushNotBefore fail with HTTP 401 on the 26.8.2 container, see
> https://github.com/apache/camel/pull/29443). Users whose camel-keycloak
> producer authenticates with their own confidential client
> (clientId/clientSecret) need to assign kc-admin-api to that client.
> This upgrades the test container to 26.8.2, gives the IT client the
> kc-admin-api scope when it exists, and documents the requirement in the
> component page and the 4.24 upgrade guide.
> Reference:
> https://github.com/keycloak/keycloak/blob/release/26.8/docs/documentation/upgrading/topics/changes/changes-26_8_2.adoc
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
