oscerd commented on code in PR #27419:
URL: https://github.com/apache/camel/pull/27419#discussion_r4192894060
##########
components/camel-spiffe/src/main/docs/spiffe-component.adoc:
##########
@@ -155,6 +155,14 @@ verified SPIFFE ID:
[source,java]
------------------------------------------------------------
+// the server must REQUIRE a client certificate, or the policy has no verified
peer to authorize
+SpiffeSSLContextParameters serverSsl = new SpiffeSSLContextParameters();
+serverSsl.setAcceptedSpiffeIds("spiffe://example.org/frontend");
Review Comment:
Good point — added in 34fc600 as a third bullet in the server-side IMPORTANT
block: `SpiffeSSLContextParameters.acceptedSpiffeIds` gates the handshake
before any route's policy runs, so when several routes with different
`SpiffeSecurityPolicy` allow-lists share one server the TLS-level list must
contain every ID those policies accept (or use `acceptAnySpiffeId` and let each
policy narrow it), otherwise a peer is turned away before its route could have
authorized it.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
