This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new e478912bb358 CAMEL-26404: upgrade guide - camel-oauth notes for 4.22.3
and 4.18.6 (#28702)
e478912bb358 is described below
commit e478912bb35828ab1d1c97b32bd6d4e7b066bf10
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Oct 29 21:10:23 2026 +0100
CAMEL-26404: upgrade guide - camel-oauth notes for 4.22.3 and 4.18.6
(#28702)
Add upgrade guide entries for camel-oauth in
camel-4x-upgrade-guide-4_22.adoc (4.22.3) and camel-4x-upgrade-guide-4_18.adoc
(4.18.6) following backports of #28689 to camel-4.22.x (#28700) and
camel-4.18.x (#28701).
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>
---
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 11 +++++++++++
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 11 +++++++++++
2 files changed, 22 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index a5e787ab3582..93412a5d10b2 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -519,6 +519,17 @@ identifier upon successful authentication, replacing the
pre-login session ident
and emitting an updated session cookie. The default `rotateSession` method of
`OAuthSessionStore` keeps the session
unchanged, so a custom `OAuthSessionStore` must override it to rotate the
session identifier on login.
+The Jakarta servlet backend (`ServletOAuth`) now validates the `aud`
(audience) claim of access tokens evaluated by
+`UserProfile` and `OAuthBearerTokenProcessor`. Tokens are validated against
configured expected audiences on
+`JWTOptions` (via `config.getJWTOptions().addAudience(String)` or
`config.getJWTOptions().setAudience(List<String>)`),
+falling back to the configured `camel.oauth.client-id` when no custom audience
is configured. Tokens whose audience does
+not match or tokens without an audience claim are rejected with
`OAuthException`.
+
+For OpenID Connect / Keycloak login flows, Keycloak access tokens commonly
carry `aud=account` by default unless an
+audience protocol mapper is configured on the client. Applications upgrading
that use Keycloak for authorization code
+login flows should configure an audience mapper on the client in Keycloak or
configure the expected audience on `JWTOptions`
+(for example, `config.getJWTOptions().addAudience("account")`).
+
=== camel-google-storage - object names are checked, and an expression in
downloadFileName is confined
The remote object name is untrusted input, so the consumer now also checks it
whatever `downloadFileName`
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 422f0a8ce19e..941da0e918c3 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -356,6 +356,17 @@ identifier upon successful authentication, replacing the
pre-login session ident
and emitting an updated session cookie. The default `rotateSession` method of
`OAuthSessionStore` keeps the session
unchanged, so a custom `OAuthSessionStore` must override it to rotate the
session identifier on login.
+The Jakarta servlet backend (`ServletOAuth`) now validates the `aud`
(audience) claim of access tokens evaluated by
+`UserProfile` and `OAuthBearerTokenProcessor`. Tokens are validated against
configured expected audiences on
+`JWTOptions` (via `config.getJWTOptions().addAudience(String)` or
`config.getJWTOptions().setAudience(List<String>)`),
+falling back to the configured `camel.oauth.client-id` when no custom audience
is configured. Tokens whose audience does
+not match or tokens without an audience claim are rejected with
`OAuthException`.
+
+For OpenID Connect / Keycloak login flows, Keycloak access tokens commonly
carry `aud=account` by default unless an
+audience protocol mapper is configured on the client. Applications upgrading
that use Keycloak for authorization code
+login flows should configure an audience mapper on the client in Keycloak or
configure the expected audience on `JWTOptions`
+(for example, `config.getJWTOptions().addAudience("account")`).
+
=== camel-jbang - camel plugin add selects the plugin release built for the CLI
`camel plugin add <name>` no longer registers a community plugin (such as
`forage` or `kit`) with the Maven `LATEST`
