[backport camel-4.14.x] CAMEL-23592: camel-shiro - align Exchange header constant names with Camel naming convention#23559
Merged
oscerd merged 2 commits intoMay 28, 2026
Conversation
davsclaus
approved these changes
May 27, 2026
…Camel naming convention (apache#23506) Renames the three Exchange header string values in ShiroSecurityConstants that drive Shiro authentication (SHIRO_SECURITY_TOKEN, SHIRO_SECURITY_USERNAME, SHIRO_SECURITY_PASSWORD) to CamelShiroSecurity<Name>, following the convention used across the rest of the Camel component catalog and matching the pattern established in CAMEL-23526 (camel-cxf), CAMEL-23522 (camel-mail), CAMEL-23461 (camel-aws-bedrock), CAMEL-23532 (camel-vertx-websocket / camel-atmosphere-websocket / camel-iggy), and CAMEL-23576 (camel-jira). - SHIRO_SECURITY_TOKEN: "SHIRO_SECURITY_TOKEN" -> "CamelShiroSecurityToken" - SHIRO_SECURITY_USERNAME: "SHIRO_SECURITY_USERNAME" -> "CamelShiroSecurityUsername" - SHIRO_SECURITY_PASSWORD: "SHIRO_SECURITY_PASSWORD" -> "CamelShiroSecurityPassword" These headers carry credentials and a serialized authentication token, so filtering them at transport boundaries by default is particularly important. The Java field names are unchanged so routes referencing the constants symbolically continue to work; routes using the literal string values must be updated (documented in the 4.21 upgrade guide). No tests reference the literal values, and the shiro adoc documentation references the constants symbolically. Tracker: CAMEL-23577 Reported by Claude Code on behalf of Andrea Cosentino Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
…security headers After CAMEL-23592 the three Shiro security header values move into the Camel* namespace (CamelShiroSecurityToken etc.). The default JmsHeaderFilterStrategy filters every Camel* header at the transport boundary, which is the intended behavior for untrusted producers but strips the serialized authentication token from trusted Shiro-over-JMS routes that previously relied on the old non-Camel-prefixed value surviving the JMS round-trip. ShiroOverJmsTest is exactly such a trusted Shiro-over-JMS route and was failing on this backport branch's CI: mock://ShiroOverJmsTestError Received message count. Expected: <0> but was: <1> (the consumer-side ShiroSecurityPolicy could no longer read the token and the message ended up at the dead-letter mock). The same regression exists latently on main; the matching fix is in PR apache#23592, and PR apache#23552 applies it to the 4.18.x backport. - ShiroOverJmsTest: configure a small subclass of JmsHeaderFilterStrategy on the JMS component that opts the three Shiro security headers back in (returns false from applyFilterToCamelHeaders / applyFilterToExternalHeaders for those headers, delegates to super for everything else). This is the pattern end-users will need. - 4.14 upgrade guide: extend the camel-shiro entry to document the new required HeaderFilterStrategy opt-in for trusted Shiro-over-transport routes, with a worked code example mirroring the one used in the test. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
oscerd
force-pushed
the
backport/23506-to-camel-4.14.x
branch
from
64c4f4a to
16afc3f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Backport of CAMEL-23592 (main: #23506 /
aeb5fd9d; 4.18.x: #23552) tocamel-4.14.x.Renames the three Exchange header values in
ShiroSecurityConstantsthat driveShiro authentication into the canonical
Camel*namespace, so they fall under thedefault
HeaderFilterStrategylike every other Camel internal header. Java fieldnames are unchanged; only the header string values change.
ShiroSecurityConstants.SHIRO_SECURITY_TOKENSHIRO_SECURITY_TOKENCamelShiroSecurityTokenShiroSecurityConstants.SHIRO_SECURITY_USERNAMESHIRO_SECURITY_USERNAMECamelShiroSecurityUsernameShiroSecurityConstants.SHIRO_SECURITY_PASSWORDSHIRO_SECURITY_PASSWORDCamelShiroSecurityPasswordThese headers carry credentials and a serialized authentication token, so filtering
them at transport boundaries by default is particularly important.
Commits in this PR
CAMEL-23592: camel-shiro - align Exchange header constant names with Camel naming convention (#23506)CAMEL-23592: camel-itest - update ShiroOverJmsTest for renamed Shiro security headers(new)test on this branch was failing because the renamed headers are now filtered by the
default
JmsHeaderFilterStrategy, so the consumer-sideShiroSecurityPolicycould nolonger read the auth token and the message ended up at the dead-letter mock.
JmsHeaderFilterStrategyin the test that opts thethree Shiro security headers back through the transport boundary while leaving every
other
Camel*-prefixed filter rule untouched. This is the opt-in pattern end-usersneed post-CAMEL-23592 for trusted Shiro-over-JMS routes.
camel-4x-upgrade-guide-4_14.adocwith aworked
HeaderFilterStrategyopt-in example.Compatibility
Backport of an already-documented breaking change (literal string value of the three
headers). Symbolic references to
ShiroSecurityConstants.SHIRO_SECURITY_*continue towork; literal-string references must be updated. The new commit is test + doc only.
Test plan
mvn -pl tests/camel-itest test -Dtest=ShiroOverJmsTestpasses locally on thisbranch (was failing on CI before the second commit).
mvn clean install -DskipTests(9m27s).git statuspost-build).Related
Claude Code on behalf of Andrea Cosentino