[
https://issues.apache.org/jira/browse/CAMEL-25486?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126218#comment-18126218
]
Andrea Cosentino commented on CAMEL-25486:
------------------------------------------
Added fixVersions 4.22.2 and 4.18.6 - the fix was backported after this issue
was resolved.
* 4.23.0 - PR #27601 (main)
* 4.22.2 - PR #27614, merged to camel-4.22.x
* 4.18.6 - PR #27615, merged to camel-4.18.x
Note 4.18.*6*, not 4.18.5: the camel-4.18.5 release was cut on 2026-10-06 and
the backport merged on 2026-10-09, so the released camel-4.18.5 tag still
carries the unfixed {{String.join()}} call. Verified against the tag rather
than the branch POM.
_Claude Code on behalf of acosentino_
> camel-http - the OAuth2 token request with a resource indicator sends only
> the resource parameter
> -------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25486
> URL: https://issues.apache.org/jira/browse/CAMEL-25486
> Project: Camel
> Issue Type: Bug
> Components: camel-http
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.18.6, 4.22.2, 4.23.0
>
>
> When the camel-http OAuth2 client credentials flow is configured with a
> resource indicator (the oauth2ResourceIndicator option, RFC 8707, added in
> CAMEL-21712), the token request body only contains the resource parameter.
> OAuth2ClientConfigurer.getAccessTokenResponse builds the body as
> "grant_type=client_credentials", then "&scope=...", then (with
> oauth2BodyAuthentication) "&client_id=...&client_secret=...", and then does:
> {code:java}
> bodyStr = String.join(bodyStr, "&resource=" + resourceIndicator);
> {code}
> String.join(delimiter, elements...) with a single element returns that
> element, so the body becomes just "&resource=<value>": grant_type, scope and
> the client credentials sent in the body are dropped. A token endpoint then
> rejects the request (no grant_type), so the oauth2ResourceIndicator option
> does not work at all.
> The fix is to append the parameter: bodyStr += "&resource=" +
> resourceIndicator. No test covered the resource indicator.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
