Claus Ibsen created CAMEL-26902:
-----------------------------------
Summary: camel-keycloak - Keycloak 26.8.2 requires the
kc-admin-api client scope for Admin REST API calls
Key: CAMEL-26902
URL: https://issues.apache.org/jira/browse/CAMEL-26902
Project: Camel
Issue Type: Task
Components: camel-keycloak
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0
Keycloak 26.8.2 enforces an audience check on the Admin REST API (RFC 9700): a
bearer token must carry the new built-in kc-admin-api client scope, which adds
the realm Admin API URL as audience. On upgrade the scope is assigned by
default only to admin-cli and security-admin-console; any other client or
service account used for Admin API calls gets 401 Unauthorized.
In Camel this shows up in KeycloakProducerRevocationIT (testLogoutAllUsers,
testPushNotBefore fail with HTTP 401 on the 26.8.2 container, see
https://github.com/apache/camel/pull/29443). Users whose camel-keycloak
producer authenticates with their own confidential client
(clientId/clientSecret) need to assign kc-admin-api to that client.
This upgrades the test container to 26.8.2, gives the IT client the
kc-admin-api scope when it exists, and documents the requirement in the
component page and the 4.24 upgrade guide.
Reference:
https://github.com/keycloak/keycloak/blob/release/26.8/docs/documentation/upgrading/topics/changes/changes-26_8_2.adoc
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
