Skip to content

chore(camel-test-infra-keycloak): upgrade keycloak.container to 26.6.2#23356

Merged
apupier merged 2 commits into
mainfrom
automated/upgrade-keycloak-container-26.6.2
May 22, 2026
Merged

chore(camel-test-infra-keycloak): upgrade keycloak.container to 26.6.2#23356
apupier merged 2 commits into
mainfrom
automated/upgrade-keycloak-container-26.6.2

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot commented May 20, 2026

This PR updates the keycloak.container container image to version 26.6.2.

Update Details

  • Property: keycloak.container
  • Image: mirror.gcr.io/keycloak/keycloak
  • File: /home/runner/work/camel/camel/test-infra/camel-test-infra-keycloak/src/main/resources/org/apache/camel/test/infra/keycloak/services/container.properties
  • Old version: 26.6.1
  • New version: 26.6.2

Verification

Please verify:

  • Container image version is compatible with existing tests
  • No breaking changes in the updated version
  • Tests pass with the new version

Run the following to rebuild the test infra:

mvn clean verify -pl camel-test-infra-keycloak

Then test the impacted components.

This PR was automatically created by the Container Version Upgrade workflow.

@github-actions github-actions Bot added dependencies Pull requests that update a dependency file container-images For check container upgrades automated For Check Container upgrade labels May 20, 2026
apupier
apupier requested changes May 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@apupier apupier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

locally I have test failures:

[�[1;31mERROR�[m] �[1;31mTests �[0;1mrun: �[0;1m16�[m, �[1;31mFailures: �[0;1;31m5�[m, �[1;31mErrors: �[0;1;31m3�[m, Skipped: 0, Time elapsed: 16.95 s�[1;31m <<< FAILURE!�[m -- in org.apache.camel.component.keycloak.security.�[1mKeycloakTokenIntrospectionIT�[m
[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testTokenIntrospectionWithValidToken -- Time elapsed: 0.109 s <<< FAILURE!
org.opentest4j.AssertionFailedError: Token should be active ==> expected: <true> but was: <false>
	at org.junit.jupiter.api.Assertions.assertTrue(Assertions.java:232)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testTokenIntrospectionWithValidToken(KeycloakTokenIntrospectionIT.java:362)

[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testTokenIntrospectionCaching -- Time elapsed: 0.061 s <<< FAILURE!
org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.Assertions.assertTrue(Assertions.java:190)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testTokenIntrospectionCaching(KeycloakTokenIntrospectionIT.java:409)

[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testSecurityPolicyWithIntrospection -- Time elapsed: 0.051 s <<< ERROR!
org.apache.camel.CamelExecutionException: Exception occurred during execution on the exchange: Exchange[11937C691FD201C-0000000000000000]
	at org.apache.camel.CamelExecutionException.wrapCamelExecutionException(CamelExecutionException.java:60)
	at org.apache.camel.support.ExchangeHelper.extractResultBody(ExchangeHelper.java:704)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.extractResultBody(DefaultProducerTemplate.java:594)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.extractResultBody(DefaultProducerTemplate.java:590)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.requestBodyAndHeader(DefaultProducerTemplate.java:432)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testSecurityPolicyWithIntrospection(KeycloakTokenIntrospectionIT.java:426)
Caused by: org.apache.camel.CamelAuthorizationException: Token is not active (may be revoked or expired). Exchange[]
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.validateRoles(KeycloakSecurityProcessor.java:231)
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.beforeProcess(KeycloakSecurityProcessor.java:63)
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.process(KeycloakSecurityProcessor.java:50)
	at org.apache.camel.support.AsyncProcessorConverterHelper$ProcessorToAsyncProcessorBridge.process(AsyncProcessorConverterHelper.java:65)
	at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.handleFirst(RedeliveryErrorHandler.java:445)
	at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.run(RedeliveryErrorHandler.java:421)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.doRun(DefaultReactiveExecutor.java:202)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.executeReactiveWork(DefaultReactiveExecutor.java:192)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.tryExecuteReactiveWork(DefaultReactiveExecutor.java:169)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.schedule(DefaultReactiveExecutor.java:143)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor.scheduleMain(DefaultReactiveExecutor.java:59)
	at org.apache.camel.processor.Pipeline.process(Pipeline.java:162)
	at org.apache.camel.impl.engine.CamelInternalProcessor.processNonTransacted(CamelInternalProcessor.java:385)
	at org.apache.camel.impl.engine.CamelInternalProcessor.process(CamelInternalProcessor.java:361)
	at org.apache.camel.component.direct.DirectProducer.process(DirectProducer.java:103)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.processNonTransacted(SharedCamelInternalProcessor.java:156)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.process(SharedCamelInternalProcessor.java:133)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor$1.process(SharedCamelInternalProcessor.java:89)
	at org.apache.camel.impl.engine.DefaultAsyncProcessorAwaitManager.process(DefaultAsyncProcessorAwaitManager.java:81)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.process(SharedCamelInternalProcessor.java:86)
	at org.apache.camel.support.cache.DefaultProducerCache.send(DefaultProducerCache.java:180)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.send(DefaultProducerTemplate.java:175)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.send(DefaultProducerTemplate.java:171)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.requestBodyAndHeader(DefaultProducerTemplate.java:430)
	... 1 more

[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testSecurityPolicyIntrospectionVsLocalValidation -- Time elapsed: 0.051 s <<< ERROR!
org.apache.camel.CamelExecutionException: Exception occurred during execution on the exchange: Exchange[809C16C869AAC6E-0000000000000000]
	at org.apache.camel.CamelExecutionException.wrapCamelExecutionException(CamelExecutionException.java:60)
	at org.apache.camel.support.ExchangeHelper.extractResultBody(ExchangeHelper.java:704)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.extractResultBody(DefaultProducerTemplate.java:594)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.extractResultBody(DefaultProducerTemplate.java:590)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.requestBodyAndHeader(DefaultProducerTemplate.java:432)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testSecurityPolicyIntrospectionVsLocalValidation(KeycloakTokenIntrospectionIT.java:453)
Caused by: org.apache.camel.CamelAuthorizationException: Token is not active (may be revoked or expired). Exchange[]
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.validateRoles(KeycloakSecurityProcessor.java:231)
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.beforeProcess(KeycloakSecurityProcessor.java:63)
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.process(KeycloakSecurityProcessor.java:50)
	at org.apache.camel.support.AsyncProcessorConverterHelper$ProcessorToAsyncProcessorBridge.process(AsyncProcessorConverterHelper.java:65)
	at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.handleFirst(RedeliveryErrorHandler.java:445)
	at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.run(RedeliveryErrorHandler.java:421)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.doRun(DefaultReactiveExecutor.java:202)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.executeReactiveWork(DefaultReactiveExecutor.java:192)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.tryExecuteReactiveWork(DefaultReactiveExecutor.java:169)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.schedule(DefaultReactiveExecutor.java:143)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor.scheduleMain(DefaultReactiveExecutor.java:59)
	at org.apache.camel.processor.Pipeline.process(Pipeline.java:162)
	at org.apache.camel.impl.engine.CamelInternalProcessor.processNonTransacted(CamelInternalProcessor.java:385)
	at org.apache.camel.impl.engine.CamelInternalProcessor.process(CamelInternalProcessor.java:361)
	at org.apache.camel.component.direct.DirectProducer.process(DirectProducer.java:103)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.processNonTransacted(SharedCamelInternalProcessor.java:156)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.process(SharedCamelInternalProcessor.java:133)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor$1.process(SharedCamelInternalProcessor.java:89)
	at org.apache.camel.impl.engine.DefaultAsyncProcessorAwaitManager.process(DefaultAsyncProcessorAwaitManager.java:81)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.process(SharedCamelInternalProcessor.java:86)
	at org.apache.camel.support.cache.DefaultProducerCache.send(DefaultProducerCache.java:180)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.send(DefaultProducerTemplate.java:175)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.send(DefaultProducerTemplate.java:171)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.requestBodyAndHeader(DefaultProducerTemplate.java:430)
	... 1 more

[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testSecurityPolicyIntrospectionWithoutCache -- Time elapsed: 0.047 s <<< ERROR!
org.apache.camel.CamelExecutionException: Exception occurred during execution on the exchange: Exchange[DC0956AC44AE534-0000000000000000]
	at org.apache.camel.CamelExecutionException.wrapCamelExecutionException(CamelExecutionException.java:60)
	at org.apache.camel.support.ExchangeHelper.extractResultBody(ExchangeHelper.java:704)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.extractResultBody(DefaultProducerTemplate.java:594)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.extractResultBody(DefaultProducerTemplate.java:590)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.requestBodyAndHeader(DefaultProducerTemplate.java:432)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testSecurityPolicyIntrospectionWithoutCache(KeycloakTokenIntrospectionIT.java:476)
Caused by: org.apache.camel.CamelAuthorizationException: Token is not active (may be revoked or expired). Exchange[]
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.validateRoles(KeycloakSecurityProcessor.java:231)
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.beforeProcess(KeycloakSecurityProcessor.java:63)
	at org.apache.camel.component.keycloak.security.KeycloakSecurityProcessor.process(KeycloakSecurityProcessor.java:50)
	at org.apache.camel.support.AsyncProcessorConverterHelper$ProcessorToAsyncProcessorBridge.process(AsyncProcessorConverterHelper.java:65)
	at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.handleFirst(RedeliveryErrorHandler.java:445)
	at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.run(RedeliveryErrorHandler.java:421)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.doRun(DefaultReactiveExecutor.java:202)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.executeReactiveWork(DefaultReactiveExecutor.java:192)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.tryExecuteReactiveWork(DefaultReactiveExecutor.java:169)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.schedule(DefaultReactiveExecutor.java:143)
	at org.apache.camel.impl.engine.DefaultReactiveExecutor.scheduleMain(DefaultReactiveExecutor.java:59)
	at org.apache.camel.processor.Pipeline.process(Pipeline.java:162)
	at org.apache.camel.impl.engine.CamelInternalProcessor.processNonTransacted(CamelInternalProcessor.java:385)
	at org.apache.camel.impl.engine.CamelInternalProcessor.process(CamelInternalProcessor.java:361)
	at org.apache.camel.component.direct.DirectProducer.process(DirectProducer.java:103)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.processNonTransacted(SharedCamelInternalProcessor.java:156)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.process(SharedCamelInternalProcessor.java:133)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor$1.process(SharedCamelInternalProcessor.java:89)
	at org.apache.camel.impl.engine.DefaultAsyncProcessorAwaitManager.process(DefaultAsyncProcessorAwaitManager.java:81)
	at org.apache.camel.impl.engine.SharedCamelInternalProcessor.process(SharedCamelInternalProcessor.java:86)
	at org.apache.camel.support.cache.DefaultProducerCache.send(DefaultProducerCache.java:180)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.send(DefaultProducerTemplate.java:175)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.send(DefaultProducerTemplate.java:171)
	at org.apache.camel.impl.engine.DefaultProducerTemplate.requestBodyAndHeader(DefaultProducerTemplate.java:430)
	... 1 more

[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testRoleExtractionFromIntrospection -- Time elapsed: 0.048 s <<< FAILURE!
org.opentest4j.AssertionFailedError: Should extract roles from introspection result ==> expected: <true> but was: <false>
	at org.junit.jupiter.api.Assertions.assertTrue(Assertions.java:232)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testRoleExtractionFromIntrospection(KeycloakTokenIntrospectionIT.java:513)

[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testCaffeineCacheWithValidToken -- Time elapsed: 0.056 s <<< FAILURE!
org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.Assertions.assertTrue(Assertions.java:190)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testCaffeineCacheWithValidToken(KeycloakTokenIntrospectionIT.java:557)

[�[1;31mERROR�[m] org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testCaffeineCachePerformance -- Time elapsed: 0.073 s <<< FAILURE!
org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.Assertions.assertTrue(Assertions.java:190)
	at org.apache.camel.component.keycloak.security.KeycloakTokenIntrospectionIT.testCaffeineCachePerformance(KeycloakTokenIntrospectionIT.java:602)

@oscerd
Copy link
Copy Markdown
Contributor

oscerd commented May 20, 2026

This should be related to the last fix. Let me double check.

@apupier
Copy link
Copy Markdown
Contributor

apupier commented May 21, 2026

https://www.keycloak.org/docs/latest/upgrading/index.html#token-introspection-now-validates-audience-claim

Token introspection now validates audience claim

The OAuth2 token introspection endpoint now validates that the authenticated client is present in the token’s audience (aud) claim before allowing introspection.

Previously, any authenticated client could introspect any valid token. Now, the introspection endpoint returns {"active": false} if the authenticated client is not in the token’s audience

@apupier apupier self-assigned this May 21, 2026
github-actions Bot and others added 2 commits May 21, 2026 17:56
@github-actions @apupier
chore(camel-test-infra-keycloak): upgrade keycloak.container to 26.6.2
f67ee86 
Update keycloak.container from 26.6.1 to 26.6.2
@apupier
Configure Keycloak 26.6.2 test to include the client ID in the aud claim
f168422 
of issued tokens, ensuring that when the same client performs token
introspection, the validation passes.

this is now required
https://www.keycloak.org/docs/latest/upgrading/index.html#token-introspection-now-validates-audience-claim

```
Token introspection now validates audience claim

The OAuth2 token introspection endpoint now validates that the
authenticated client is present in the token’s audience (aud) claim
before allowing introspection.

Previously, any authenticated client could introspect any valid token.
Now, the introspection endpoint returns {"active": false} if the
authenticated client is not in the token’s audience
```

Co-authored-by: IBM Bob IDE 1.0.2
Signed-off-by: Aurélien Pupier <apupier@ibm.com>
@apupier apupier force-pushed the automated/upgrade-keycloak-container-26.6.2 branch from 7b4216e to f168422 Compare May 21, 2026 15:57
@apupier apupier requested review from apupier and oscerd May 21, 2026 15:59
@github-actions
Copy link
Copy Markdown
Contributor Author

github-actions Bot commented May 21, 2026

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

  • First-time contributors require MANUAL approval for the GitHub Actions to run
  • You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
  • You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
  • Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

@github-actions
Copy link
Copy Markdown
Contributor Author

github-actions Bot commented May 21, 2026

🧪 CI tested the following changed modules:

  • components/camel-keycloak
  • test-infra/camel-test-infra-keycloak
All tested modules (10 modules)
  • Camel :: JBang :: MCP
  • Camel :: JBang :: Plugin :: Route Parser
  • Camel :: JBang :: Plugin :: TUI
  • Camel :: JBang :: Plugin :: Validate
  • Camel :: Keycloak
  • Camel :: Launcher :: Container
  • Camel :: Test Infra :: All test services
  • Camel :: Test Infra :: Keycloak
  • Camel :: YAML DSL :: Validator
  • Camel :: YAML DSL :: Validator Maven Plugin

⚙️ View full build and test results

@apupier
Copy link
Copy Markdown
Contributor

apupier commented May 22, 2026 •
edited
Loading

I'm wondering if we should not provide this kind of configuration by default inside the component itself, rather than just on the test side.

maybe here org.apache.camel.component.keycloak.KeycloakProducer.createClient(Keycloak, Exchange)

But given that it could different type of authentication, maybe we cannot really.

@oscerd
Copy link
Copy Markdown
Contributor

oscerd commented May 22, 2026

I'm wondering if we should not provide this kind of configuration by default inside the component itself, rather than just on the test side.

maybe here org.apache.camel.component.keycloak.KeycloakProducer.createClient(Keycloak, Exchange)

But given that it could different type of authentication, maybe we cannot really.

This could interesting to do, but we should also look at the keycloak instance verrsion.

@apupier apupier merged commit b268dd4 into main May 22, 2026
6 checks passed
@apupier apupier deleted the automated/upgrade-keycloak-container-26.6.2 branch May 22, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@oscerd oscerd oscerd approved these changes

@apupier apupier Awaiting requested review from apupier

Assignees

@apupier apupier

Labels

automated For Check Container upgrade components container-images For check container upgrades dependencies Pull requests that update a dependency file test-infra

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@oscerd @apupier