[backport camel-4.18.x] CAMEL-23592: camel-shiro - align Exchange header constant names with Camel naming convention#23552
Merged
oscerd merged 2 commits intoMay 28, 2026
Conversation
…Camel naming convention (apache#23506) Renames the three Exchange header string values in ShiroSecurityConstants that drive Shiro authentication (SHIRO_SECURITY_TOKEN, SHIRO_SECURITY_USERNAME, SHIRO_SECURITY_PASSWORD) to CamelShiroSecurity<Name>, following the convention used across the rest of the Camel component catalog and matching the pattern established in CAMEL-23526 (camel-cxf), CAMEL-23522 (camel-mail), CAMEL-23461 (camel-aws-bedrock), CAMEL-23532 (camel-vertx-websocket / camel-atmosphere-websocket / camel-iggy), and CAMEL-23576 (camel-jira). - SHIRO_SECURITY_TOKEN: "SHIRO_SECURITY_TOKEN" -> "CamelShiroSecurityToken" - SHIRO_SECURITY_USERNAME: "SHIRO_SECURITY_USERNAME" -> "CamelShiroSecurityUsername" - SHIRO_SECURITY_PASSWORD: "SHIRO_SECURITY_PASSWORD" -> "CamelShiroSecurityPassword" These headers carry credentials and a serialized authentication token, so filtering them at transport boundaries by default is particularly important. The Java field names are unchanged so routes referencing the constants symbolically continue to work; routes using the literal string values must be updated (documented in the 4.21 upgrade guide). No tests reference the literal values, and the shiro adoc documentation references the constants symbolically. Tracker: CAMEL-23577 Reported by Claude Code on behalf of Andrea Cosentino Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
davsclaus
approved these changes
May 27, 2026
3 tasks
…security headers After CAMEL-23592 the three Shiro security header values move into the Camel* namespace (CamelShiroSecurityToken etc.). The default JmsHeaderFilterStrategy filters every Camel* header at the transport boundary, which is the intended behavior for untrusted producers but strips the serialized authentication token from trusted Shiro-over-JMS routes that previously relied on the old non-Camel-prefixed value surviving the JMS round-trip. ShiroOverJmsTest is exactly such a trusted Shiro-over-JMS route and started failing on this backport branch's CI: mock://ShiroOverJmsTestError Received message count. Expected: <0> but was: <1> (the consumer-side ShiroSecurityPolicy could no longer read the token and the message ended up at the dead-letter mock). The same regression exists latently on main; the matching fix is in PR apache#23592. - ShiroOverJmsTest: configure a small subclass of JmsHeaderFilterStrategy on the JMS component that opts the three Shiro security headers back in (returns false from applyFilterToCamelHeaders / applyFilterToExternalHeaders for those headers, delegates to super for everything else). This is the pattern end-users will need. - 4.18 upgrade guide: extend the camel-shiro entry to document the new required HeaderFilterStrategy opt-in for trusted Shiro-over-transport routes, with a worked code example mirroring the one used in the test. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
oscerd
added a commit
to oscerd/camel
that referenced
this pull request
May 28, 2026
…security headers After CAMEL-23592 the three Shiro security header values move into the Camel* namespace (CamelShiroSecurityToken etc.). The default JmsHeaderFilterStrategy filters every Camel* header at the transport boundary, which is the intended behavior for untrusted producers but strips the serialized authentication token from trusted Shiro-over-JMS routes that previously relied on the old non-Camel-prefixed value surviving the JMS round-trip. ShiroOverJmsTest is exactly such a trusted Shiro-over-JMS route and was failing on this backport branch's CI: mock://ShiroOverJmsTestError Received message count. Expected: <0> but was: <1> (the consumer-side ShiroSecurityPolicy could no longer read the token and the message ended up at the dead-letter mock). The same regression exists latently on main; the matching fix is in PR apache#23592, and PR apache#23552 applies it to the 4.18.x backport. - ShiroOverJmsTest: configure a small subclass of JmsHeaderFilterStrategy on the JMS component that opts the three Shiro security headers back in (returns false from applyFilterToCamelHeaders / applyFilterToExternalHeaders for those headers, delegates to super for everything else). This is the pattern end-users will need. - 4.14 upgrade guide: extend the camel-shiro entry to document the new required HeaderFilterStrategy opt-in for trusted Shiro-over-transport routes, with a worked code example mirroring the one used in the test. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
3 tasks
apupier
approved these changes
May 28, 2026
oscerd
added a commit
to oscerd/camel
that referenced
this pull request
May 28, 2026
…security headers After CAMEL-23592 the three Shiro security header values move into the Camel* namespace (CamelShiroSecurityToken etc.). The default JmsHeaderFilterStrategy filters every Camel* header at the transport boundary, which is the intended behavior for untrusted producers but strips the serialized authentication token from trusted Shiro-over-JMS routes that previously relied on the old non-Camel-prefixed value surviving the JMS round-trip. ShiroOverJmsTest is exactly such a trusted Shiro-over-JMS route and was failing on this backport branch's CI: mock://ShiroOverJmsTestError Received message count. Expected: <0> but was: <1> (the consumer-side ShiroSecurityPolicy could no longer read the token and the message ended up at the dead-letter mock). The same regression exists latently on main; the matching fix is in PR apache#23592, and PR apache#23552 applies it to the 4.18.x backport. - ShiroOverJmsTest: configure a small subclass of JmsHeaderFilterStrategy on the JMS component that opts the three Shiro security headers back in (returns false from applyFilterToCamelHeaders / applyFilterToExternalHeaders for those headers, delegates to super for everything else). This is the pattern end-users will need. - 4.14 upgrade guide: extend the camel-shiro entry to document the new required HeaderFilterStrategy opt-in for trusted Shiro-over-transport routes, with a worked code example mirroring the one used in the test. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
oscerd
added a commit
that referenced
this pull request
May 28, 2026
…der constant names with Camel naming convention (#23559) * CAMEL-23592: camel-shiro - align Exchange header constant names with Camel naming convention (#23506) Renames the three Exchange header string values in ShiroSecurityConstants that drive Shiro authentication (SHIRO_SECURITY_TOKEN, SHIRO_SECURITY_USERNAME, SHIRO_SECURITY_PASSWORD) to CamelShiroSecurity<Name>, following the convention used across the rest of the Camel component catalog and matching the pattern established in CAMEL-23526 (camel-cxf), CAMEL-23522 (camel-mail), CAMEL-23461 (camel-aws-bedrock), CAMEL-23532 (camel-vertx-websocket / camel-atmosphere-websocket / camel-iggy), and CAMEL-23576 (camel-jira). - SHIRO_SECURITY_TOKEN: "SHIRO_SECURITY_TOKEN" -> "CamelShiroSecurityToken" - SHIRO_SECURITY_USERNAME: "SHIRO_SECURITY_USERNAME" -> "CamelShiroSecurityUsername" - SHIRO_SECURITY_PASSWORD: "SHIRO_SECURITY_PASSWORD" -> "CamelShiroSecurityPassword" These headers carry credentials and a serialized authentication token, so filtering them at transport boundaries by default is particularly important. The Java field names are unchanged so routes referencing the constants symbolically continue to work; routes using the literal string values must be updated (documented in the 4.21 upgrade guide). No tests reference the literal values, and the shiro adoc documentation references the constants symbolically. Tracker: CAMEL-23577 Reported by Claude Code on behalf of Andrea Cosentino Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * CAMEL-23592: camel-itest - update ShiroOverJmsTest for renamed Shiro security headers After CAMEL-23592 the three Shiro security header values move into the Camel* namespace (CamelShiroSecurityToken etc.). The default JmsHeaderFilterStrategy filters every Camel* header at the transport boundary, which is the intended behavior for untrusted producers but strips the serialized authentication token from trusted Shiro-over-JMS routes that previously relied on the old non-Camel-prefixed value surviving the JMS round-trip. ShiroOverJmsTest is exactly such a trusted Shiro-over-JMS route and was failing on this backport branch's CI: mock://ShiroOverJmsTestError Received message count. Expected: <0> but was: <1> (the consumer-side ShiroSecurityPolicy could no longer read the token and the message ended up at the dead-letter mock). The same regression exists latently on main; the matching fix is in PR #23592, and PR #23552 applies it to the 4.18.x backport. - ShiroOverJmsTest: configure a small subclass of JmsHeaderFilterStrategy on the JMS component that opts the three Shiro security headers back in (returns false from applyFilterToCamelHeaders / applyFilterToExternalHeaders for those headers, delegates to super for everything else). This is the pattern end-users will need. - 4.14 upgrade guide: extend the camel-shiro entry to document the new required HeaderFilterStrategy opt-in for trusted Shiro-over-transport routes, with a worked code example mirroring the one used in the test. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com> --------- Signed-off-by: Andrea Cosentino <ancosen@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Backport of CAMEL-23592 (main: #23506 /
aeb5fd9d) tocamel-4.18.x. Renames thethree Exchange header values in
ShiroSecurityConstantsthat drive Shiroauthentication into the canonical
Camel*namespace, so they fall under the defaultHeaderFilterStrategylike every other Camel internal header. Java field names areunchanged; only the header string values change.
ShiroSecurityConstants.SHIRO_SECURITY_TOKENSHIRO_SECURITY_TOKENCamelShiroSecurityTokenShiroSecurityConstants.SHIRO_SECURITY_USERNAMESHIRO_SECURITY_USERNAMECamelShiroSecurityUsernameShiroSecurityConstants.SHIRO_SECURITY_PASSWORDSHIRO_SECURITY_PASSWORDCamelShiroSecurityPasswordThese headers carry credentials and a serialized authentication token, so filtering
them at transport boundaries by default is particularly important.
Commits in this PR
CAMEL-23592: camel-shiro - align Exchange header constant names with Camel naming convention (#23506)CAMEL-23592: camel-itest - update ShiroOverJmsTest for renamed Shiro security headers(new)was failing because the renamed headers are now filtered by the default
JmsHeaderFilterStrategy, so the consumer-sideShiroSecurityPolicycould nolonger read the auth token and the message ended up at the dead-letter mock.
JmsHeaderFilterStrategyin the test that optsthe three Shiro security headers back through the transport boundary while
leaving every other
Camel*-prefixed filter rule untouched. This is theopt-in pattern end-users need post-CAMEL-23592 for trusted Shiro-over-JMS
routes.
camel-4x-upgrade-guide-4_18.adocwith a worked
HeaderFilterStrategyopt-in example.Compatibility
Backport of an already-documented breaking change (literal string value of the
three headers). Symbolic references to
ShiroSecurityConstants.SHIRO_SECURITY_*continue to work; literal-string references must be updated. The new commit is
test + doc only.
Test plan
mvn -pl tests/camel-itest test -Dtest=ShiroOverJmsTestpasses locally onthis branch (was failing on CI before the second commit).
mvn clean install -DskipTests(8m53s).git statuspost-build).Related
Claude Code on behalf of Andrea Cosentino