oscerd opened a new pull request, #28701: URL: https://github.com/apache/camel/pull/28701
## Backport of #28689 Cherry-pick of #28689 onto `camel-4.18.x`. **Original PR:** #28689 - CAMEL-26404: camel-oauth: validate audience for access tokens on ServletOAuth backend **Original author:** @oscerd **Target branch:** `camel-4.18.x` ### Original description Jira: https://issues.apache.org/jira/browse/CAMEL-26404 When `OAuthBearerTokenProcessor` authenticates incoming bearer access tokens on the Jakarta servlet backend (`ServletOAuth`), `UserProfile.verifyToken` evaluates the signature, issuer, not-before (`nbf`), and expiration (`exp`) claims, but only validates the audience (`aud`) and authorized party (`azp`) claims for ID tokens. Access tokens without an audience or tokens minted for a different client or audience in the same realm were accepted. This change: - Extracts expected audience resolution into a dedicated `resolveExpectedAudiences` helper in `UserProfile`. - Enforces audience validation for access tokens against configured expected audiences in `JWTOptions` (`addAudience` / `setAudience`), defaulting to `clientId`. - Rejects tokens missing `aud` or presenting a mismatched audience. - Adds comprehensive unit tests for bearer tokens and OpenID Connect code-exchange login flows. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
