ammachado opened a new pull request, #24477: URL: https://github.com/apache/camel/pull/24477
# Description Adds an opt-in `expectedAudience` option to `KeycloakSecurityPolicy` so that tokens whose `aud` claim does not contain every configured audience are rejected. Without this, a token issued for one client could be accepted by a route intended for a different client in a multi-client Keycloak realm. Audience validation is enforced on both token verification paths: - **Local JWT verification**: via Keycloak's own `TokenVerifier.audience(String...)` check (AND semantics: token must carry every configured audience). - **OAuth2 token introspection**: via a new `validateAudienceFromIntrospection` check against the introspection result's `aud` claim (handles both single-string and array/collection claim shapes). The feature is **disabled by default** (`expectedAudience` unset → empty list → no check performed), so existing behavior is unchanged for users who don't opt in. `expectedAudience` accepts a comma-separated list (e.g. `"my-client,my-other-client"`) when a token must carry several audiences at once, mirroring the existing `requiredRoles`/`requiredPermissions` convention on the same class. Documentation (`keycloak-security.adoc`) was updated with a new "Audience Validation" section including Java and YAML examples. # Target - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch) # Tracking - [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it). # Apache Camel coding standards and style - [x] I checked that each commit in the pull request has a meaningful subject line and body. - [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes. <!-- Full root build in progress; this checkbox and PR description will be updated once it completes. --> # AI-assisted contributions - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used. --- _Claude Code on behalf of Adriano Machado_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
