You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/06/15 13:33:49 UTC
[PR] CAMEL-23760: camel-oauth - require a JWK set to verify token signatures in UserProfile [camel]
oscerd opened a new pull request, #24032:
URL: https://github.com/apache/camel/pull/24032
## Description
The `camel-oauth` `UserProfile` token verification skipped the JWS signature check when the configured JWK set was missing or empty, leaving the signature unverified in that case. This makes the signature check mandatory:
- When no JWK set is available (`null` or empty), the token is now rejected with an `OAuthException` rather than accepted.
- Deployments with a correctly resolved JWK set are unaffected.
- This aligns the legacy `UserProfile` path with the `JwtTokenValidator` SPI path, which already fails closed on this condition.
## Behaviour change
Documented in the 4.21 upgrade guide.
## Testing
Adds `UserProfileTest` with three cases: rejection on an empty JWK set, rejection on a missing JWK set, and acceptance when the signature verifies against a matching key.
_Claude Code on behalf of Andrea Cosentino._
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23760: camel-oauth - require a JWK set to verify token signatures in UserProfile [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #24032:
URL: https://github.com/apache/camel/pull/24032#discussion_r3413989081
##########
components/camel-oauth/src/main/java/org/apache/camel/oauth/UserProfile.java:
##########
@@ -180,15 +180,16 @@ private static JsonObject verifyToken(OAuthConfig config, String token, boolean
// Fetch Keycloak public key
Review Comment:
Nit: this comment is a leftover from when the code was Keycloak-specific. The verification is now provider-agnostic (works with any OIDC IdP). Consider updating:
```suggestion
// Verify JWS signature against configured JWK set
```
##########
components/camel-oauth/src/main/java/org/apache/camel/oauth/UserProfile.java:
##########
@@ -180,15 +180,16 @@ private static JsonObject verifyToken(OAuthConfig config, String token, boolean
// Fetch Keycloak public key
var jwkSet = config.getJWKSet();
- if (!jwkSet.isEmpty()) {
- var rsaKey = (RSAKey) jwkSet.getKeyByKeyId(keyID);
- if (rsaKey == null) {
- throw new OAuthException("No matching key found for: " + keyID);
- }
- RSAPublicKey publicKey = rsaKey.toRSAPublicKey();
- if (!signedJWT.verify(new RSASSAVerifier(publicKey))) {
- throw new OAuthException("Invalid token signature");
- }
+ if (jwkSet == null || jwkSet.isEmpty()) {
Review Comment:
Good catch adding the `null` check here — the old code would have thrown an NPE if `getJWKSet()` returned `null` (which it can, since `OAuthConfig.jwkSet` has no default). This is a correctness fix beyond the stated scope of the PR and worth calling out in the description.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23760: camel-oauth - require a JWK set to verify token signatures in UserProfile [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24032:
URL: https://github.com/apache/camel/pull/24032#issuecomment-4716025752
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23760: camel-oauth - require a JWK set to verify token signatures in UserProfile [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24032:
URL: https://github.com/apache/camel/pull/24032#issuecomment-4716187962
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `components/camel-oauth`
- `docs`
<details><summary>All tested modules (8 modules)</summary>
- Camel :: JBang :: MCP
- Camel :: JBang :: Plugin :: Route Parser
- Camel :: JBang :: Plugin :: TUI
- Camel :: JBang :: Plugin :: Validate
- Camel :: Launcher :: Container
- Camel :: OAuth
- Camel :: YAML DSL :: Validator
- Camel :: YAML DSL :: Validator Maven Plugin
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/27601403002)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23760: camel-oauth - require a JWK set to verify token signatures in UserProfile [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #24032:
URL: https://github.com/apache/camel/pull/24032
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23760: camel-oauth - require a JWK set to verify token signatures in UserProfile [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #24032:
URL: https://github.com/apache/camel/pull/24032#discussion_r3418888550
##########
components/camel-oauth/src/main/java/org/apache/camel/oauth/UserProfile.java:
##########
@@ -180,15 +180,16 @@ private static JsonObject verifyToken(OAuthConfig config, String token, boolean
// Fetch Keycloak public key
Review Comment:
Updated — the comment is now provider-agnostic: `// Resolve the signing key from the configured JWK set and verify the token signature`. Thanks for the catch. — Claude Code on behalf of Andrea Cosentino
##########
components/camel-oauth/src/main/java/org/apache/camel/oauth/UserProfile.java:
##########
@@ -180,15 +180,16 @@ private static JsonObject verifyToken(OAuthConfig config, String token, boolean
// Fetch Keycloak public key
var jwkSet = config.getJWKSet();
- if (!jwkSet.isEmpty()) {
- var rsaKey = (RSAKey) jwkSet.getKeyByKeyId(keyID);
- if (rsaKey == null) {
- throw new OAuthException("No matching key found for: " + keyID);
- }
- RSAPublicKey publicKey = rsaKey.toRSAPublicKey();
- if (!signedJWT.verify(new RSASSAVerifier(publicKey))) {
- throw new OAuthException("Invalid token signature");
- }
+ if (jwkSet == null || jwkSet.isEmpty()) {
Review Comment:
Thanks! Right — `OAuthConfig.jwkSet` has no default so `getJWKSet()` can return null; the guard keeps verification fail-closed instead of NPE-ing. — Claude Code on behalf of Andrea Cosentino
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org