oscerd opened a new pull request, #25567: URL: https://github.com/apache/camel/pull/25567
Fixes [CAMEL-24411](https://issues.apache.org/jira/browse/CAMEL-24411). ## Problem The camel-oauth processors return normally from `process()` on the paths where they do **not** authenticate the caller, so the remaining steps of the route still run — and overwrite the response the processor had just prepared. The component's own test routes have exactly that shape: ```java from("platform-http:/bearer") .process(new OAuthBearerTokenProcessor()) .setBody(simple("${body} - OAuthBearerToken")); ``` Three call sites are affected: | Processor | Path | Before | |---|---|---| | `OAuthBearerTokenProcessor` | no `Authorization` header, or one that does not parse as `Bearer <token>` | `400` + return | | `OAuthCodeFlowProcessor` | no authenticated session ⇒ redirect to the IdP | `302` + return | | `OAuthCodeFlowCallback` | callback without the `code` parameter | `400` + return | There is no `setRouteStop`, `CamelAuthorizationException` or `RoutePolicy` anywhere in camel-oauth `src/main`, so nothing halts the exchange on any of them. Note the enforcement was also **inverted** in the bearer processor: a present-but-invalid token fails closed (the exception from `OAuth.authenticate()` propagates), while an *absent* credential did not. ## Change Adds `reject()` and `rejectUnauthorized()` to `AbstractOAuthProcessor` and applies them at the three denial points. The bearer processor now answers `401` with a `WWW-Authenticate: Bearer` challenge (RFC 6750) rather than `400`. **Deliberately left alone:** `sendRedirect()` itself, and `OAuthLogoutProcessor`. Making `sendRedirect` stop the route would have been the tidier change, but the shipped logout route ```java from("servlet:/logout") .process(new OAuthLogoutProcessor()) .process(exc -> exc.getContext().getGlobalOptions().put("OAuthLogout", "ok")); ``` relies on the step after the redirect running. Only the **denial** paths stop; authenticated requests continue through the rest of the route exactly as before. ## Testing New `OAuthProcessorFailClosedTest` covers the three paths that return before any identity provider is contacted, so it needs no Keycloak container. Verified it catches the regression: **all 3 tests fail against the pre-fix code**, all 3 pass after. ``` mvn test -Dtest=OAuthProcessorFailClosedTest # 3 passed mvn clean install -DskipTests # full reactor, BUILD SUCCESS ``` Adds a test-scoped `assertj-core` to camel-oauth, which the module was missing (project convention is AssertJ for new test code). ## Backport Intended for **camel-4.22.x, camel-4.18.x and camel-4.14.x**. It is a behaviour change, but it is the behaviour of an authentication gate, and camel-oauth is a Preview-support component. The upgrade-guide entry stays on `main` per the project's guide policy. --- _Claude Code on behalf of -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
