[
https://issues.apache.org/jira/browse/CAMEL-24448?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109071#comment-18109071
]
Andrea Cosentino commented on CAMEL-24448:
------------------------------------------
Merged to main: https://github.com/apache/camel/pull/25827
Backports open for camel-4.22.x and camel-4.18.x.
_Claude Code on behalf of oscerd_
> camel-keycloak - introspection issuer validation is skipped when the iss
> claim is absent
> ----------------------------------------------------------------------------------------
>
> Key: CAMEL-24448
> URL: https://issues.apache.org/jira/browse/CAMEL-24448
> Project: Camel
> Issue Type: Bug
> Components: camel-keycloak
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{KeycloakSecurityProcessor.validateIssuerFromIntrospection()}} logs a WARN
> and returns successfully when the introspection response carries no {{iss}}
> claim, so the configured issuer is not checked at all in that case.
> The audience check right next to it was deliberately made fail-closed, with a
> Javadoc explaining why, so the asymmetry reads as an oversight rather than a
> decision.
> {{iss}} is optional in RFC 7662. Vanilla Keycloak includes it and only
> accepts its own realm's tokens, which bounds this - but it matters when
> {{serverUrl}} fronts a broker or gateway, or a minimal RFC 7662
> implementation that omits the claim.
> Proposal: treat a missing {{iss}} the same way the audience check treats a
> missing {{aud}} - fail closed - and make the behaviour consistent between the
> two validators.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
