oscerd opened a new pull request, #25195: URL: https://github.com/apache/camel/pull/25195
Backport of `010bcd575ebd` (originally #23389) to `camel-4.18.x` (→ 4.18.4). Adds `jwtIssuer` and `jwtAudience` to the embedded HTTP server and the management server. When either is set, a `JWTOptions` carrying those values is attached to the `JWTAuthOptions` passed to `JWTAuth.create`, so the `iss` and `aud` claims are validated in addition to the signature and the expiry. `jwtAudience` accepts a comma-separated list and a token is accepted if its `aud` claim matches any configured value. ## Why on a maintenance branch Without these options a JWT authenticator on this branch validates the signature and expiry only, and there is no configuration that changes that. This backport gives operators on 4.18.4 a way to constrain which issuer and audience are accepted. The related fail-closed change (CAMEL-24281, #25187) is deliberately **not** backported, since it would be a startup-breaking change here. ## Compatibility Additive only. Both options default to `null`, `buildJwtOptions` returns `null` when both are empty, and the caller then skips `setJWTOptions`, so an existing configuration builds the authenticator exactly as before. The new methods on `HttpServerConfigurationProperties` and `HttpManagementServerConfigurationProperties` are additive and binary compatible. The pre-existing keystore-only `JWTAuthenticationMainHttpServerTest` passes unchanged on this branch, which is the compatibility check that matters here. ## Notes * The upgrade-guide entry from the original commit is omitted: the options are purely additive on this branch, and the guide is for migration concerns. * Generated configurers and metadata were regenerated from source rather than taken from the cherry-pick. * Module suite green (16 tests, including the 6 added by this change). _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
