feat(config): update OpenTelemetry OTLP

[foukou19]

PR Description

What this PR Provides

• Webhook JWT_BEARER security: client_id_field now accepts any non-empty
  claim name (client_id, sub, azp, email, or a custom claim) instead of
  only azp or email.
• Existing connectors using azp or email keep working without
  reconfiguration.
• Webhook NONE security: config is now optional. You can omit it, pass
  null, or pass {}. A non-empty config is still rejected.
• A missing configured claim in the incoming JWT now returns 401
  (previously 403). A claim value outside client_id_values still returns
  403.
• The JWT validator logs the caller identity (webhook_jwt_caller) with the
  result ACCEPTED or REJECTED.
• OpenTelemetry: library-based setup (no Java agent) with OTLP export of traces
  and metrics configured in application.yml.
• OpenTelemetry: business attributes on webhook spans
  (idp.webhook.identifier, idp.webhook.security.result,
  idp.webhook.mapping.result) to ease debugging in Datadog.
• Documentation updated in docs/src/concepts/webhooks.md.

Fixes

Review

The reviewer must double-check these points:

• The reviewer has tested the feature
• The reviewer has reviewed the implementation of the feature
• The documentation has been updated
• The feature implementation respects the Technical Doc / ADR previously produced
• The Pull Request title has a ! after the type/scope to identify the breaking
  change in the release note and ensure we will release a major version.

How to test

• Initial state:
  • A running idp-core instance.
  • The product entity template and the product-mapping entity dynamic
    mapping exist.
  • A JWT issuer exposing a public HTTPS JWKS endpoint.
• JWT_BEARER with a client_id claim:

  1. Create the connector with POST /api/v1/inbound_webhooks:

     {
       "identifier": "product",
       "name": "product",
       "description": "product connector",
       "enabled": true,
       "mapping_identifiers": ["product-mapping"],
       "security": {
         "type": "JWT_BEARER",
         "config": {
           "jwks_uri": "xxx/ext/JWKS",
           "client_id_field": "client_id",
           "client_id_values": "C60ee4cXXXXXXXXXXXXXX8ae"
         }
       }
     }

  2. Call POST /webhooks/product with Authorization: Bearer <jwt>.
     The JWT must contain
     "client_id": "C60ee4cXXXXXXXXXXXXXX8ae.

  3. Repeat with client_id_field set to email and azp to check there is
     no regression.

• Missing claim: call with a JWT without the configured claim.
• Wrong value: call with a claim value not in client_id_values.
• Missing header: call without the Authorization header.
• NONE without config: create or update a webhook with
  {"security": {"type": "NONE"}}, then with "config": null and
  "config": {}.
• NONE with config: send "config": {"a": "b"}.
• Observability: set OTEL_EXPORTER_OTLP_ENDPOINT and call a webhook, then
  check the trace attributes in Datadog.
• Expected results:
  • Valid configurations are accepted (201 on creation, 200 on update).
  • Authenticated calls are processed and log
    webhook_jwt_caller ... result=ACCEPTED.
  • Missing claim or missing header returns 401.
  • Wrong claim value returns 403.
  • NONE with a non-empty config returns 400.
  • Spans carry the three idp.webhook.* attributes.

Breaking changes (if any)

• Behavior modification of a component

Context of the Breaking Change

For JWT_BEARER, a JWT that does not contain the configured claim now returns
401 Unauthorized instead of 403 Forbidden.

Result of the Breaking Change

Callers or monitoring that relied on 403 for a missing claim must handle
401. A claim value that is present but not allowed still returns 403.

[github-code-quality]

Code Coverage Overview

Languages: Java

Java / code-coverage/jacoco

The overall line coverage in commit deb926e in the feat/idp-core-observ... branch remains at 91%, unchanged from commit 75392db in the main branch.

Show a line coverage summary of the most impacted files.

File	main 75392db	feat/idp-core-observ... deb926e	+/-
com/decathlon/i...okSecurity.java	100%	100%	0%
com/decathlon/i...ionService.java	100%	100%	0%
com/decathlon/i...tractDtoIn.java	100%	100%	0%
com/decathlon/i...hookMapper.java	100%	100%	0%
com/decathlon/i...yProcessor.java	100%	100%	0%
com/decathlon/i...ationUtils.java	87%	87%	0%
com/decathlon/i...yValidator.java	87%	89%	+2%

---

_{Updated October 14, 2026 09:33 UTC}

[Copilot]

Copilot review overview

🟡 Changes recommended

Default startup and OTLP header configuration issues can prevent or misroute telemetry exports.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Mapping results overwrite each other on the current span · New
• Tracing defaults to enabled instead of remaining opt-in · New
• Add coverage for omitted config normalization · New
• Remove obsolete commented-out test · New

What changed in this PR

Updates OpenTelemetry export and webhook observability while broadening JWT claim support and allowing omitted configuration for unsecured webhooks.

Changes:

• Adds OTLP tracing/metrics dependencies and configuration.
• Adds webhook security and mapping trace attributes.
• Supports custom JWT identity claims and optional NONE security configuration.

File	Description
pom.xml	Adds OpenTelemetry and Micrometer dependencies.
src/​main/​resources/​application.yml	Configures OTLP exporters and Camel tracing.
JwtBearerSecurityValidator.java	Accepts custom identity claims.
JwtBearerSecurityValidatorTest.java	Tests custom JWT claims.
SecurityProcessor.java	Records webhook security trace attributes.
IngestionProcessor.java	Records ingestion mapping outcomes.
InboundWebhookSecurityContractDtoIn.java	Makes security config optional.
WebhookSecurityValidationService.java	Handles absent NONE configuration.
WebhookSecurity.java	Normalizes absent NONE configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Telemetry defaults risk breaking unconfigured deployments, mapping results are lossy, and claimed JWT audit logging is missing.

Review effort: Balanced
Findings: 1 · 3 · 3

Open (7)

• Missing safe defaults for new telemetry configuration placeholders · New
• Mapping results overwrite the webhook span attribute · New
• Add structured JWT caller outcome logging · New
• Tracing defaults to enabled instead of remaining opt-in
• Indent NONE tab content beneath its marker · New
• Update deployment docs for management OTLP HTTP configuration · New
• Add coverage for omitted config normalization

Resolved since last review (2)

• Mapping results overwrite each other on the current span
• Remove obsolete commented-out test

[Copilot]

🟡 Changes recommended

OTLP configuration and multi-mapping telemetry currently produce incorrect or misleading operational behavior.

9 open findings

• Use supported Spring Boot OTLP trace properties · New
• Gate OTLP metrics export behind explicit opt-in · New
• Mapping results overwrite the webhook span attribute
• Tracing defaults to enabled instead of remaining opt-in
• Fix table delimiter spacing for markdownlint · New
• Add coverage for omitted and null config values · New
• Update deployment docs for management OTLP HTTP configuration
• Indent NONE tab content beneath its marker
• Add coverage for omitted config normalization

2 resolved since last review

• Missing safe defaults for new telemetry configuration placeholders
• Add structured JWT caller outcome logging

🧠 Review effort: Balanced

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud