Undertow Spring Security

Spring Boot auto-configuration for Camel Undertow with Spring Security.

This starter secures Camel HTTP endpoints served by the Undertow component using Spring Security. It supports OAuth2/OpenID Connect providers (such as Keycloak) for authentication and authorization of incoming HTTP requests to Camel routes.

Token validation

Incoming JWTs are validated against the configured provider on three points: the standard timestamp checks, the iss claim (which must match the configured realm), and the audience — the token must carry the configured clientId in its aud claim. Keycloak may require an Audience protocol mapper to add the service client to access tokens.

The audience check matters because every client of a realm is served by the same signing key. Without it, a token minted for any other client in the realm — including a low-trust public one — satisfies the signature check and is accepted here.

It can be turned off if an existing deployment relies on tokens minted for a different client:

camel.security.undertow.keycloak.validate-audience = false

Maven coordinates

<dependency>
    <groupId>org.apache.camel.springboot</groupId>
    <artifactId>camel-undertow-spring-security-starter</artifactId>
</dependency>

Spring Boot Auto-Configuration

The starter supports 6 options, which are listed below.

Name	Description	Default	Type
camel.security.undertow.keycloak	Properties defined for keycloak provider. Value is gathered together from properties with prefix "camel.component.undertow.spring.security.keycloak"		KeycloakProviderConfiguration
camel.security.undertow.keycloak.client-id	Client id from the Keycloak server used for authentication.		String
camel.security.undertow.keycloak.realm-id	Realm id from the keycloak server used for authentication.		String
camel.security.undertow.keycloak.url	Url to keycloak server which will be used in spring security configuration. (Example "http://localhost:8080")		String
camel.security.undertow.keycloak.user-name-attribute	Name of the attribute, which will be used as username.	preferred_username	String
camel.security.undertow.keycloak.validate-audience	Whether an incoming token must carry the configured client id in its aud claim. Every client of a realm shares the signing key, so with this disabled a token minted for any other client of the same realm is accepted.	true	Boolean

Name

Description

Default

Type

camel.security.undertow.keycloak

Properties defined for keycloak provider. Value is gathered together from properties with prefix "camel.component.undertow.spring.security.keycloak"

KeycloakProviderConfiguration

camel.security.undertow.keycloak.client-id

Client id from the Keycloak server used for authentication.

String

camel.security.undertow.keycloak.realm-id

Realm id from the keycloak server used for authentication.

String

camel.security.undertow.keycloak.url

Url to keycloak server which will be used in spring security configuration. (Example "http://localhost:8080")

String

camel.security.undertow.keycloak.user-name-attribute

Name of the attribute, which will be used as username.

preferred_username

String

camel.security.undertow.keycloak.validate-audience

Whether an incoming token must carry the configured client id in its aud claim. Every client of a realm shares the signing key, so with this disabled a token minted for any other client of the same realm is accepted.

true

Boolean