Keycloak

// Configure Keycloak component
KeycloakComponent keycloak = context.getComponent("keycloak", KeycloakComponent.class);
KeycloakConfiguration config = new KeycloakConfiguration();
config.setServerUrl("http://localhost:8080");
config.setRealm("master");
config.setUsername("admin");
config.setPassword("admin");
keycloak.setConfiguration(config);

# Configuration in application.yaml
camel:
  component:
    keycloak:
      server-url: "http://localhost:8080"
      realm: "master"
      username: "admin"
      password: "admin"

// Create a new realm
template.sendBodyAndHeader("keycloak:admin?operation=createRealm", null,
    KeycloakConstants.REALM_NAME, "my-new-realm");

// Get realm information
template.sendBodyAndHeader("keycloak:admin?operation=getRealm", null,
    KeycloakConstants.REALM_NAME, "my-realm");

// Delete a realm
template.sendBodyAndHeader("keycloak:admin?operation=deleteRealm", null,
    KeycloakConstants.REALM_NAME, "my-old-realm");

- route:
    from:
      uri: direct:create-realm
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-new-realm"
        - to:
            uri: keycloak:admin?operation=createRealm
        - log: "Created realm: ${header.CamelKeycloakRealmName}"

- route:
    from:
      uri: direct:get-realm
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - to:
            uri: keycloak:admin?operation=getRealm
        - log: "Realm info: ${body}"

- route:
    from:
      uri: direct:delete-realm
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-old-realm"
        - to:
            uri: keycloak:admin?operation=deleteRealm
        - log: "Deleted realm: ${header.CamelKeycloakRealmName}"

// Create a new user
Map<String, Object> headers = new HashMap<>();
headers.put(KeycloakConstants.REALM_NAME, "my-realm");
headers.put(KeycloakConstants.USERNAME, "john.doe");
headers.put(KeycloakConstants.USER_EMAIL, "john.doe@example.com");
headers.put(KeycloakConstants.USER_FIRST_NAME, "John");
headers.put(KeycloakConstants.USER_LAST_NAME, "Doe");

template.sendBodyAndHeaders("keycloak:admin?operation=createUser", null, headers);

// Set user password
Map<String, Object> passwordHeaders = new HashMap<>();
passwordHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
passwordHeaders.put(KeycloakConstants.USERNAME, "john.doe");
passwordHeaders.put("CamelKeycloakUserPassword", "secure-password");
passwordHeaders.put("CamelKeycloakUserPasswordTemporary", false);

template.sendBodyAndHeaders("keycloak:admin?operation=setUserPassword", null, passwordHeaders);

// List all users in realm
template.sendBodyAndHeader("keycloak:admin?operation=listUsers", null,
    KeycloakConstants.REALM_NAME, "my-realm");

// Delete a user
Map<String, Object> deleteHeaders = new HashMap<>();
deleteHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
deleteHeaders.put(KeycloakConstants.USERNAME, "john.doe");

template.sendBodyAndHeaders("keycloak:admin?operation=deleteUser", null, deleteHeaders);

# Create user route
- route:
    from:
      uri: direct:create-user
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakUsername
            simple: "${body[username]}"
        - setHeader:
            name: CamelKeycloakUserEmail
            simple: "${body[email]}"
        - setHeader:
            name: CamelKeycloakUserFirstName
            simple: "${body[firstName]}"
        - setHeader:
            name: CamelKeycloakUserLastName
            simple: "${body[lastName]}"
        - to:
            uri: keycloak:admin?operation=createUser
        - log: "Created user: ${header.CamelKeycloakUsername}"

# Set user password route
- route:
    from:
      uri: direct:set-user-password
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakUsername
            simple: "${body[username]}"
        - setHeader:
            name: CamelKeycloakUserPassword
            simple: "${body[password]}"
        - setHeader:
            name: CamelKeycloakUserPasswordTemporary
            constant: false
        - to:
            uri: keycloak:admin?operation=setUserPassword
        - log: "Set password for user: ${header.CamelKeycloakUsername}"

# List users route
- route:
    from:
      uri: direct:list-users
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - to:
            uri: keycloak:admin?operation=listUsers
        - log: "Users in realm: ${body}"

# Delete user route
- route:
    from:
      uri: direct:delete-user
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakUsername
            simple: "${body[username]}"
        - to:
            uri: keycloak:admin?operation=deleteUser
        - log: "Deleted user: ${header.CamelKeycloakUsername}"

// Create a new role
Map<String, Object> roleHeaders = new HashMap<>();
roleHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
roleHeaders.put(KeycloakConstants.ROLE_NAME, "manager");
roleHeaders.put(KeycloakConstants.ROLE_DESCRIPTION, "Manager role with elevated privileges");

template.sendBodyAndHeaders("keycloak:admin?operation=createRole", null, roleHeaders);

// Get role information
Map<String, Object> getRoleHeaders = new HashMap<>();
getRoleHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
getRoleHeaders.put(KeycloakConstants.ROLE_NAME, "manager");

template.sendBodyAndHeaders("keycloak:admin?operation=getRole", null, getRoleHeaders);

// Assign role to user
Map<String, Object> assignHeaders = new HashMap<>();
assignHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
assignHeaders.put(KeycloakConstants.USERNAME, "john.doe");
assignHeaders.put(KeycloakConstants.ROLE_NAME, "manager");

template.sendBodyAndHeaders("keycloak:admin?operation=assignRoleToUser", null, assignHeaders);

// Delete a role
Map<String, Object> deleteRoleHeaders = new HashMap<>();
deleteRoleHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
deleteRoleHeaders.put(KeycloakConstants.ROLE_NAME, "old-role");

template.sendBodyAndHeaders("keycloak:admin?operation=deleteRole", null, deleteRoleHeaders);

# Create role route
- route:
    from:
      uri: direct:create-role
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakRoleName
            simple: "${body[roleName]}"
        - setHeader:
            name: CamelKeycloakRoleDescription
            simple: "${body[description]}"
        - to:
            uri: keycloak:admin?operation=createRole
        - log: "Created role: ${header.CamelKeycloakRoleName}"

# Get role route
- route:
    from:
      uri: direct:get-role
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakRoleName
            simple: "${body[roleName]}"
        - to:
            uri: keycloak:admin?operation=getRole
        - log: "Role info: ${body}"

# Assign role to user route
- route:
    from:
      uri: direct:assign-role
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakUsername
            simple: "${body[username]}"
        - setHeader:
            name: CamelKeycloakRoleName
            simple: "${body[roleName]}"
        - to:
            uri: keycloak:admin?operation=assignRoleToUser
        - log: "Assigned role ${header.CamelKeycloakRoleName} to user ${header.CamelKeycloakUsername}"

# Delete role route
- route:
    from:
      uri: direct:delete-role
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakRoleName
            simple: "${body[roleName]}"
        - to:
            uri: keycloak:admin?operation=deleteRole
        - log: "Deleted role: ${header.CamelKeycloakRoleName}"

// Create a new client
Map<String, Object> clientHeaders = new HashMap<>();
clientHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
clientHeaders.put("CamelKeycloakClientId", "my-service-client");
clientHeaders.put("CamelKeycloakClientSecretRequired", true);
clientHeaders.put("CamelKeycloakClientDirectAccessGrantsEnabled", true);

template.sendBodyAndHeaders("keycloak:admin?operation=createClient", null, clientHeaders);

// Get client information
Map<String, Object> getClientHeaders = new HashMap<>();
getClientHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
getClientHeaders.put("CamelKeycloakClientId", "my-service-client");

template.sendBodyAndHeaders("keycloak:admin?operation=getClient", null, getClientHeaders);

// Get client secret
Map<String, Object> secretHeaders = new HashMap<>();
secretHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
secretHeaders.put("CamelKeycloakClientId", "my-service-client");

String clientSecret = template.requestBodyAndHeaders("keycloak:admin?operation=getClientSecret",
    null, secretHeaders, String.class);

// Delete a client
Map<String, Object> deleteClientHeaders = new HashMap<>();
deleteClientHeaders.put(KeycloakConstants.REALM_NAME, "my-realm");
deleteClientHeaders.put("CamelKeycloakClientId", "old-client");

template.sendBodyAndHeaders("keycloak:admin?operation=deleteClient", null, deleteClientHeaders);

# Create client route
- route:
    from:
      uri: direct:create-client
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakClientId
            simple: "${body[clientId]}"
        - setHeader:
            name: CamelKeycloakClientSecretRequired
            constant: true
        - setHeader:
            name: CamelKeycloakClientDirectAccessGrantsEnabled
            constant: true
        - to:
            uri: keycloak:admin?operation=createClient
        - log: "Created client: ${header.CamelKeycloakClientId}"

# Get client route
- route:
    from:
      uri: direct:get-client
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakClientId
            simple: "${body[clientId]}"
        - to:
            uri: keycloak:admin?operation=getClient
        - log: "Client info: ${body}"

# Get client secret route
- route:
    from:
      uri: direct:get-client-secret
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakClientId
            simple: "${body[clientId]}"
        - to:
            uri: keycloak:admin?operation=getClientSecret
        - log: "Client secret retrieved for: ${header.CamelKeycloakClientId}"

# Delete client route
- route:
    from:
      uri: direct:delete-client
      steps:
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-realm"
        - setHeader:
            name: CamelKeycloakClientId
            simple: "${body[clientId]}"
        - to:
            uri: keycloak:admin?operation=deleteClient
        - log: "Deleted client: ${header.CamelKeycloakClientId}"

public class KeycloakManagementRoutes extends RouteBuilder {

    @Override
    public void configure() throws Exception {

        // Configure Keycloak component
        KeycloakComponent keycloak = getContext().getComponent("keycloak", KeycloakComponent.class);
        KeycloakConfiguration config = new KeycloakConfiguration();
        config.setServerUrl("http://localhost:8080");
        config.setRealm("master");
        config.setUsername("admin");
        config.setPassword("admin");
        keycloak.setConfiguration(config);

        // Comprehensive user management route
        from("direct:setup-user-environment")
            .routeId("setup-user-environment")
            .log("Setting up user environment...")

            // Step 1: Create realm
            .setHeader(KeycloakConstants.REALM_NAME, constant("my-company"))
            .to("keycloak:admin?operation=createRealm")
            .log("Created realm: my-company")

            // Step 2: Create roles
            .setHeader(KeycloakConstants.ROLE_NAME, constant("admin"))
            .setHeader(KeycloakConstants.ROLE_DESCRIPTION, constant("Administrator role"))
            .to("keycloak:admin?operation=createRole")
            .log("Created admin role")

            .setHeader(KeycloakConstants.ROLE_NAME, constant("user"))
            .setHeader(KeycloakConstants.ROLE_DESCRIPTION, constant("Standard user role"))
            .to("keycloak:admin?operation=createRole")
            .log("Created user role")

            // Step 3: Create client
            .setHeader("CamelKeycloakClientId", constant("my-app"))
            .setHeader("CamelKeycloakClientSecretRequired", constant(true))
            .setHeader("CamelKeycloakClientDirectAccessGrantsEnabled", constant(true))
            .to("keycloak:admin?operation=createClient")
            .log("Created client: my-app")

            // Step 4: Create users
            .setHeader(KeycloakConstants.USERNAME, constant("admin.user"))
            .setHeader(KeycloakConstants.USER_EMAIL, constant("admin@company.com"))
            .setHeader(KeycloakConstants.USER_FIRST_NAME, constant("Admin"))
            .setHeader(KeycloakConstants.USER_LAST_NAME, constant("User"))
            .to("keycloak:admin?operation=createUser")
            .log("Created admin user")

            // Step 5: Set password
            .setHeader("CamelKeycloakUserPassword", constant("admin123"))
            .setHeader("CamelKeycloakUserPasswordTemporary", constant(false))
            .to("keycloak:admin?operation=setUserPassword")
            .log("Set admin user password")

            // Step 6: Assign role
            .setHeader(KeycloakConstants.ROLE_NAME, constant("admin"))
            .to("keycloak:admin?operation=assignRoleToUser")
            .log("Assigned admin role to user")

            .transform().constant("User environment setup completed successfully");

        // User management API routes
        from("rest:post:/users")
            .routeId("create-user-api")
            .log("Creating user: ${body}")
            .setHeader(KeycloakConstants.REALM_NAME, constant("my-company"))
            .setHeader(KeycloakConstants.USERNAME, jsonpath("$.username"))
            .setHeader(KeycloakConstants.USER_EMAIL, jsonpath("$.email"))
            .setHeader(KeycloakConstants.USER_FIRST_NAME, jsonpath("$.firstName"))
            .setHeader(KeycloakConstants.USER_LAST_NAME, jsonpath("$.lastName"))
            .to("keycloak:admin?operation=createUser")
            .setHeader("Content-Type", constant("application/json"))
            .transform().constant("{\"status\": \"success\", \"message\": \"User created\"}");

        from("rest:get:/users")
            .routeId("list-users-api")
            .log("Listing users")
            .setHeader(KeycloakConstants.REALM_NAME, constant("my-company"))
            .to("keycloak:admin?operation=listUsers")
            .setHeader("Content-Type", constant("application/json"));

        from("rest:delete:/users/{username}")
            .routeId("delete-user-api")
            .log("Deleting user: ${header.username}")
            .setHeader(KeycloakConstants.REALM_NAME, constant("my-company"))
            .setHeader(KeycloakConstants.USERNAME, header("username"))
            .to("keycloak:admin?operation=deleteUser")
            .setHeader("Content-Type", constant("application/json"))
            .transform().constant("{\"status\": \"success\", \"message\": \"User deleted\"}");
    }
}

# Complete Keycloak producer configuration
- route:
    id: setup-user-environment
    from:
      uri: direct:setup-user-environment
      steps:
        - log: "Setting up user environment..."

        # Step 1: Create realm
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-company"
        - to:
            uri: keycloak:admin?operation=createRealm
        - log: "Created realm: my-company"

        # Step 2: Create admin role
        - setHeader:
            name: CamelKeycloakRoleName
            constant: "admin"
        - setHeader:
            name: CamelKeycloakRoleDescription
            constant: "Administrator role"
        - to:
            uri: keycloak:admin?operation=createRole
        - log: "Created admin role"

        # Step 3: Create user role
        - setHeader:
            name: CamelKeycloakRoleName
            constant: "user"
        - setHeader:
            name: CamelKeycloakRoleDescription
            constant: "Standard user role"
        - to:
            uri: keycloak:admin?operation=createRole
        - log: "Created user role"

        # Step 4: Create client
        - setHeader:
            name: CamelKeycloakClientId
            constant: "my-app"
        - setHeader:
            name: CamelKeycloakClientSecretRequired
            constant: true
        - setHeader:
            name: CamelKeycloakClientDirectAccessGrantsEnabled
            constant: true
        - to:
            uri: keycloak:admin?operation=createClient
        - log: "Created client: my-app"

        # Step 5: Create admin user
        - setHeader:
            name: CamelKeycloakUsername
            constant: "admin.user"
        - setHeader:
            name: CamelKeycloakUserEmail
            constant: "admin@company.com"
        - setHeader:
            name: CamelKeycloakUserFirstName
            constant: "Admin"
        - setHeader:
            name: CamelKeycloakUserLastName
            constant: "User"
        - to:
            uri: keycloak:admin?operation=createUser
        - log: "Created admin user"

        # Step 6: Set password
        - setHeader:
            name: CamelKeycloakUserPassword
            constant: "admin123"
        - setHeader:
            name: CamelKeycloakUserPasswordTemporary
            constant: false
        - to:
            uri: keycloak:admin?operation=setUserPassword
        - log: "Set admin user password"

        # Step 7: Assign role
        - setHeader:
            name: CamelKeycloakRoleName
            constant: "admin"
        - to:
            uri: keycloak:admin?operation=assignRoleToUser
        - log: "Assigned admin role to user"

        - transform:
            constant: "User environment setup completed successfully"

# REST API routes for user management
- rest:
    path: /users
    post:
      - to: direct:create-user-api

- rest:
    path: /users
    get:
      - to: direct:list-users-api

- rest:
    path: /users/{username}
    delete:
      - to: direct:delete-user-api

# Route implementations
- route:
    id: create-user-api
    from:
      uri: direct:create-user-api
      steps:
        - log: "Creating user: ${body}"
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-company"
        - setHeader:
            name: CamelKeycloakUsername
            jsonpath: "$.username"
        - setHeader:
            name: CamelKeycloakUserEmail
            jsonpath: "$.email"
        - setHeader:
            name: CamelKeycloakUserFirstName
            jsonpath: "$.firstName"
        - setHeader:
            name: CamelKeycloakUserLastName
            jsonpath: "$.lastName"
        - to:
            uri: keycloak:admin?operation=createUser
        - setHeader:
            name: Content-Type
            constant: "application/json"
        - transform:
            constant: '{"status": "success", "message": "User created"}'

- route:
    id: list-users-api
    from:
      uri: direct:list-users-api
      steps:
        - log: "Listing users"
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-company"
        - to:
            uri: keycloak:admin?operation=listUsers
        - setHeader:
            name: Content-Type
            constant: "application/json"

- route:
    id: delete-user-api
    from:
      uri: direct:delete-user-api
      steps:
        - log: "Deleting user: ${header.username}"
        - setHeader:
            name: CamelKeycloakRealmName
            constant: "my-company"
        - setHeader:
            name: CamelKeycloakUsername
            header: "username"
        - to:
            uri: keycloak:admin?operation=deleteUser
        - setHeader:
            name: Content-Type
            constant: "application/json"
        - transform:
            constant: '{"status": "success", "message": "User deleted"}'

# Component configuration
camel:
  component:
    keycloak:
      server-url: "http://localhost:8080"
      realm: "master"
      username: "admin"
      password: "admin"

KeycloakSecurityPolicy policy = new KeycloakSecurityPolicy();
policy.setServerUrl("http://localhost:8080");
policy.setRealm("my-realm");
policy.setClientId("my-client");
policy.setClientSecret("my-client-secret");

- route:
    from:
      uri: direct:start
      steps:
        - policy:
            ref: keycloakPolicy
        - to:
            uri: mock:result

# Bean definition in beans configuration
beans:
  - name: keycloakPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "http://localhost:8080"
      realm: "my-realm"
      clientId: "my-client"
      clientSecret: "my-client-secret"

KeycloakSecurityPolicy policy = new KeycloakSecurityPolicy(
    "http://localhost:8080", "my-realm", "my-client", "client-secret");

// Require specific roles
policy.setRequiredRoles(Arrays.asList("admin", "user"));
policy.setAllRolesRequired(true); // User must have ALL roles

from("direct:admin")
    .policy(policy)
    .to("mock:admin-endpoint");

- route:
    from:
      uri: direct:admin
      steps:
        - policy:
            ref: adminPolicy
        - to:
            uri: mock:admin-endpoint

# Bean definition
beans:
  - name: adminPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "http://localhost:8080"
      realm: "my-realm"
      clientId: "my-client"
      clientSecret: "client-secret"
      requiredRoles:
        - "admin"
        - "user"
      allRolesRequired: true

KeycloakSecurityPolicy policy = new KeycloakSecurityPolicy(
    "http://localhost:8080", "my-realm", "my-client", "client-secret");

// Require specific permissions
policy.setRequiredPermissions(Arrays.asList("read:documents", "write:documents"));
policy.setAllPermissionsRequired(false); // User needs ANY permission

from("direct:documents")
    .policy(policy)
    .to("mock:documents-endpoint");

- route:
    from:
      uri: direct:documents
      steps:
        - policy:
            ref: documentsPolicy
        - to:
            uri: mock:documents-endpoint

# Bean definition
beans:
  - name: documentsPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "http://localhost:8080"
      realm: "my-realm"
      clientId: "my-client"
      clientSecret: "client-secret"
      requiredPermissions:
        - "read:documents"
        - "write:documents"
      allPermissionsRequired: false

KeycloakSecurityPolicy policy = new KeycloakSecurityPolicy(
    "http://localhost:8080", "my-realm", "my-client", "username", "password");

from("direct:user-flow")
    .policy(policy)
    .to("mock:result");

- route:
    from:
      uri: direct:user-flow
      steps:
        - policy:
            ref: userFlowPolicy
        - to:
            uri: mock:result

# Bean definition
beans:
  - name: userFlowPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "http://localhost:8080"
      realm: "my-realm"
      clientId: "my-client"
      username: "username"
      password: "password"
      useResourceOwnerPasswordCredentials: true

from("direct:admin-only")
    .policy(adminPolicy)
    .transform().constant("Admin access granted")
    .to("mock:admin");

from("direct:user-or-admin")
    .policy(userPolicy)
    .transform().constant("User access granted")
    .to("mock:user");

from("rest:get:/api/documents")
    .policy(documentsPolicy)
    .to("direct:list-documents");

- route:
    from:
      uri: direct:admin-only
      steps:
        - policy:
            ref: adminPolicy
        - transform:
            constant: "Admin access granted"
        - to:
            uri: mock:admin

- route:
    from:
      uri: direct:user-or-admin
      steps:
        - policy:
            ref: userPolicy
        - transform:
            constant: "User access granted"
        - to:
            uri: mock:user

- rest:
    get:
      - uri: /api/documents
        to: direct:list-documents
        route:
          policy:
            ref: documentsPolicy

// Create Keycloak security policy
KeycloakSecurityPolicy keycloakPolicy = new KeycloakSecurityPolicy();
keycloakPolicy.setServerUrl("http://localhost:8080");
keycloakPolicy.setRealm("my-company");
keycloakPolicy.setClientId("my-service");
keycloakPolicy.setClientSecret("client-secret-value");

// Require admin role
keycloakPolicy.setRequiredRoles(Arrays.asList("admin"));

// Apply to route
from("direct:admin-endpoint")
    .policy(keycloakPolicy)
    .transform().constant("Admin access granted")
    .to("mock:admin-result");

- route:
    from:
      uri: direct:admin-endpoint
      steps:
        - policy:
            ref: keycloakPolicy
        - transform:
            constant: "Admin access granted"
        - to:
            uri: mock:admin-result

# Bean definition
beans:
  - name: keycloakPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "http://localhost:8080"
      realm: "my-company"
      clientId: "my-service"
      clientSecret: "client-secret-value"
      requiredRoles:
        - "admin"

// Require either admin OR user role
KeycloakSecurityPolicy userPolicy = new KeycloakSecurityPolicy(
    "http://localhost:8080", "my-company", "my-service", "client-secret");
userPolicy.setRequiredRoles(Arrays.asList("admin", "user"));
userPolicy.setAllRolesRequired(false); // ANY role (OR logic)

from("direct:user-endpoint")
    .policy(userPolicy)
    .to("bean:userService?method=processUser");

- route:
    from:
      uri: direct:user-endpoint
      steps:
        - policy:
            ref: userPolicy
        - to:
            uri: bean:userService?method=processUser

# Bean definition
beans:
  - name: userPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "http://localhost:8080"
      realm: "my-company"
      clientId: "my-service"
      clientSecret: "client-secret"
      requiredRoles:
        - "admin"
        - "user"
      allRolesRequired: false

// Configure different policies for different endpoints
KeycloakSecurityPolicy readPolicy = new KeycloakSecurityPolicy(
    "{{keycloak.server-url}}", "{{keycloak.realm}}",
    "{{keycloak.client-id}}", "{{keycloak.client-secret}}");
readPolicy.setRequiredRoles(Arrays.asList("reader", "writer", "admin"));
readPolicy.setAllRolesRequired(false);

KeycloakSecurityPolicy writePolicy = new KeycloakSecurityPolicy(
    "{{keycloak.server-url}}", "{{keycloak.realm}}",
    "{{keycloak.client-id}}", "{{keycloak.client-secret}}");
writePolicy.setRequiredRoles(Arrays.asList("writer", "admin"));
writePolicy.setAllRolesRequired(false);

KeycloakSecurityPolicy adminPolicy = new KeycloakSecurityPolicy(
    "{{keycloak.server-url}}", "{{keycloak.realm}}",
    "{{keycloak.client-id}}", "{{keycloak.client-secret}}");
adminPolicy.setRequiredRoles(Arrays.asList("admin"));

// Configure REST endpoints
rest("/api")
    .get("/documents")
        .route()
        .policy(readPolicy)
        .to("bean:documentService?method=listDocuments")
        .endRest()
    .post("/documents")
        .route()
        .policy(writePolicy)
        .to("bean:documentService?method=createDocument")
        .endRest()
    .delete("/documents/{id}")
        .route()
        .policy(adminPolicy)
        .to("bean:documentService?method=deleteDocument")
        .endRest();

- rest:
    path: "/api"
    get:
      - uri: "/documents"
        to: bean:documentService?method=listDocuments
        route:
          policy:
            ref: readPolicy
    post:
      - uri: "/documents"
        to: bean:documentService?method=createDocument
        route:
          policy:
            ref: writePolicy
    delete:
      - uri: "/documents/{id}"
        to: bean:documentService?method=deleteDocument
        route:
          policy:
            ref: adminPolicy

# Bean definitions for policies
beans:
  - name: readPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "{{keycloak.server-url}}"
      realm: "{{keycloak.realm}}"
      clientId: "{{keycloak.client-id}}"
      clientSecret: "{{keycloak.client-secret}}"
      requiredRoles:
        - "reader"
        - "writer"
        - "admin"
      allRolesRequired: false

  - name: writePolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "{{keycloak.server-url}}"
      realm: "{{keycloak.realm}}"
      clientId: "{{keycloak.client-id}}"
      clientSecret: "{{keycloak.client-secret}}"
      requiredRoles:
        - "writer"
        - "admin"
      allRolesRequired: false

  - name: adminPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "{{keycloak.server-url}}"
      realm: "{{keycloak.realm}}"
      clientId: "{{keycloak.client-id}}"
      clientSecret: "{{keycloak.client-secret}}"
      requiredRoles:
        - "admin"

// Global error handler for authorization failures
onException(CamelAuthorizationException.class)
    .handled(true)
    .setHeader(Exchange.HTTP_RESPONSE_CODE, constant(403))
    .setHeader("Content-Type", constant("application/json"))
    .transform().constant("{\"error\": \"Access denied\", \"message\": \"Insufficient privileges\"}")
    .log("Authorization failed: ${exception.message}");

// Route-specific error handling
from("rest:post:/secure-data")
    .doTry()
        .policy(keycloakPolicy)
        .to("bean:dataProcessor")
    .doCatch(CamelAuthorizationException.class)
        .setHeader(Exchange.HTTP_RESPONSE_CODE, constant(403))
        .transform().constant("Access denied")
    .end();

# Global error handler
- onException:
    exception:
      - "org.apache.camel.CamelAuthorizationException"
    handled: true
    steps:
      - setHeader:
          name: "CamelHttpResponseCode"
          constant: 403
      - setHeader:
          name: "Content-Type"
          constant: "application/json"
      - transform:
          constant: '{"error": "Access denied", "message": "Insufficient privileges"}'
      - log: "Authorization failed: ${exception.message}"

# Route-specific error handling
- route:
    from:
      uri: rest:post:/secure-data
      steps:
        - doTry:
            steps:
              - policy:
                  ref: keycloakPolicy
              - to:
                  uri: bean:dataProcessor
            doCatch:
              - exception:
                  - "org.apache.camel.CamelAuthorizationException"
                steps:
                  - setHeader:
                      name: "CamelHttpResponseCode"
                      constant: 403
                  - transform:
                      constant: "Access denied"

// Create a policy that requires BOTH roles AND permissions
KeycloakSecurityPolicy strictPolicy = new KeycloakSecurityPolicy();
strictPolicy.setServerUrl("{{keycloak.server-url}}");
strictPolicy.setRealm("{{keycloak.realm}}");
strictPolicy.setClientId("{{keycloak.client-id}}");
strictPolicy.setClientSecret("{{keycloak.client-secret}}");

// User must have admin role AND document permissions
strictPolicy.setRequiredRoles(Arrays.asList("admin"));
strictPolicy.setRequiredPermissions(Arrays.asList("read:documents", "write:documents"));
strictPolicy.setAllRolesRequired(true);
strictPolicy.setAllPermissionsRequired(false); // ANY permission

// Create a policy that requires EITHER roles OR permissions
KeycloakSecurityPolicy flexiblePolicy = new KeycloakSecurityPolicy();
flexiblePolicy.setServerUrl("{{keycloak.server-url}}");
flexiblePolicy.setRealm("{{keycloak.realm}}");
flexiblePolicy.setClientId("{{keycloak.client-id}}");
flexiblePolicy.setClientSecret("{{keycloak.client-secret}}");

// Apply different policies to different routes
from("direct:admin-documents")
    .policy(strictPolicy)
    .to("bean:documentService?method=adminOperations");

from("direct:flexible-access")
    .policy(flexiblePolicy)
    .to("bean:documentService?method=flexibleOperations");

- route:
    from:
      uri: direct:admin-documents
      steps:
        - policy:
            ref: strictPolicy
        - to:
            uri: bean:documentService?method=adminOperations

- route:
    from:
      uri: direct:flexible-access
      steps:
        - policy:
            ref: flexiblePolicy
        - to:
            uri: bean:documentService?method=flexibleOperations

# Bean definitions
beans:
  - name: strictPolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "{{keycloak.server-url}}"
      realm: "{{keycloak.realm}}"
      clientId: "{{keycloak.client-id}}"
      clientSecret: "{{keycloak.client-secret}}"
      requiredRoles:
        - "admin"
      requiredPermissions:
        - "read:documents"
        - "write:documents"
      allRolesRequired: true
      allPermissionsRequired: false

  - name: flexiblePolicy
    type: org.apache.camel.component.keycloak.security.KeycloakSecurityPolicy
    properties:
      serverUrl: "{{keycloak.server-url}}"
      realm: "{{keycloak.realm}}"
      clientId: "{{keycloak.client-id}}"
      clientSecret: "{{keycloak.client-secret}}"
      requiredRoles:
        - "admin"
        - "manager"
      requiredPermissions:
        - "read:documents"
        - "emergency:access"
      allRolesRequired: false
      allPermissionsRequired: false