oscerd opened a new pull request, #25187: URL: https://github.com/apache/camel/pull/25187
# CAMEL-24281 When JWT authentication is enabled on the camel-main embedded HTTP server, `JWTAuthenticationConfigurer.buildJwtOptions(...)` returns `null` if neither `jwtIssuer` nor `jwtAudience` is configured, and the caller then skips `JWTAuthOptions.setJWTOptions(...)`. The resulting Vert.x `JWTAuth` is built from the keystore alone, so tokens are only checked for signature and expiry and the `iss` and `aud` claims are not validated. Nothing signals this: the server starts normally, so a deployment configured the documented way can be enforcing less than intended. ## Change * `assertIssuerOrAudienceConfigured(...)` is called at the top of **both** `configureAuthentication` overloads, so the application server and the management server are both covered. It throws `IllegalArgumentException` when a JWT keystore is configured but neither value is set, naming the properties involved. * New `jwtAllowMissingIssuerAndAudience` option (default `false`) on `HttpServerConfigurationProperties` and `HttpManagementServerConfigurationProperties` for deployments that genuinely want signature and expiry validation only. This mirrors the posture `camel-oauth` already uses, where `DefaultOAuthTokenValidationFactory.validateResolvedConfiguration` refuses to operate unless an expected audience and issuer are configured (`allow-missing-audience` and `allow-missing-issuer` both default to `false`). ## Compatibility This changes startup behaviour for an existing configuration, so it is documented in the 4.22 upgrade guide with the opt-out. `jwtIssuer` and `jwtAudience` were only added in 4.21.0 by CAMEL-23525, so this applies to `main` only. Backporting the fail-closed behaviour to 4.18.x or 4.14.x is not possible as-is, because those branches have no such options to satisfy the requirement. ## Tests `JWTIssuerAudienceRequiredMainHttpServerTest` (4): startup fails without an issuer or audience and the message names all three properties; the opt-out starts and still serves; a token minted for a different issuer and audience is rejected once both are configured; the opt-out defaults to false on both properties classes. One existing test config, `jwt-auth.properties`, is keystore-only and therefore no longer starts. It now sets `jwtAllowMissingIssuerAndAudience=true`, which keeps `JWTAuthenticationMainHttpServerTest` testing what it was written to test and exercises the opt-out. Module suite green (23), `camel-main` green (231), full reactor build green with generated files committed. The component documentation previously described signature and expiry checking as the default with issuer and audience as an optional extra. It now states that without them any unexpired token signed by a trusted key is accepted regardless of issuer or audience. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
