davsclaus commented on code in PR #1910:
URL:
https://github.com/apache/camel-spring-boot/pull/1910#discussion_r3880149556
##########
components-starter/camel-undertow-spring-security-starter/src/main/java/org/apache/camel/undertow/spring/boot/providers/AbstractProviderConfiguration.java:
##########
@@ -32,12 +32,31 @@ public enum TYPE {
keycloak
}
+ /**
+ * Whether an incoming token must carry the configured client id in its
aud or azp claim. Every client of a realm
+ * shares the signing key, so with this disabled a token minted for any
other client of the same realm is accepted.
+ */
+ private boolean validateAudience = true;
+
abstract TYPE getType();
public abstract ClientRegistration getClientRegistration() throws
URISyntaxException;
public abstract String getUserNameAttribute();
+ /**
+ * The issuer the provider stamps into the {@code iss} claim of the tokens
it mints.
+ */
+ public abstract String getIssuerUri() throws URISyntaxException;
Review Comment:
Making `getIssuerUri()` `abstract` on this public class is source-breaking
for any external subclass of `AbstractProviderConfiguration` — it won't compile
against the new starter version until it implements this method. This class
already has a precedent for avoiding exactly that:
`getJwtAuthenticationConverter()` below (line 60) is deliberately non-abstract
with a default `throw new IllegalArgumentException("Not implemented")`. Was
making this one abstract intentional, or would following the existing
default-throw pattern be safer for backwards compatibility? (Impact is likely
low today since only `KeycloakProviderConfiguration` exists and
`UndertowSpringSecurityCustomizer` only wires up `keycloak`, but flagging per
this project's "maintain backwards compatibility for public APIs" standard.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
