[
https://issues.apache.org/jira/browse/CAMEL-23525?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18100015#comment-18100015
]
Andrea Cosentino commented on CAMEL-23525:
------------------------------------------
Backported to the maintenance branches so operators on the LTS lines can
constrain which issuer and audience are accepted:
* camel-4.18.x (4.18.4) - https://github.com/apache/camel/pull/25195 (merged as
23c6bbf0e026)
* camel-4.14.x (4.14.9) - https://github.com/apache/camel/pull/25196 (merged as
a69ff2b4504f)
Both are additive: {{jwtIssuer}} and {{jwtAudience}} default to null,
{{buildJwtOptions}} returns null when both are empty, and the caller then skips
{{setJWTOptions}}, so an existing configuration builds the authenticator
exactly as before. The pre-existing keystore-only
{{JWTAuthenticationMainHttpServerTest}} passes unmodified on both branches.
Each backport also regenerates the catalog copy of
{{camel-main-configuration-metadata.json}} from the branch's own camel-main,
dropping main-only entries it had picked up from an earlier regeneration
against a main-built artifact.
Related: CAMEL-24281 makes the embedded server fail closed when a JWT keystore
is configured but neither option is set. That part applies to 4.22.0 only,
since it cannot be satisfied on branches that lack these options.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
> camel-platform-http-main: add optional JWT issuer and audience claim
> validation
> -------------------------------------------------------------------------------
>
> Key: CAMEL-23525
> URL: https://issues.apache.org/jira/browse/CAMEL-23525
> Project: Camel
> Issue Type: Improvement
> Components: camel-platform-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.14.9, 4.18.4, 4.21.0
>
>
> The embedded HTTP server JWT authentication in camel-platform-http-main
> ({{JWTAuthenticationConfigurer}}) currently configures the Vert.x {{JWTAuth}}
> provider with keystore parameters only ({{jwtKeystoreType}},
> {{jwtKeystorePath}}, {{jwtKeystorePassword}}). Tokens are verified for
> signature (and the Vert.x default exp/nbf checks), but the RFC 7519
> registered claims {{iss}} (issuer) and {{aud}} (audience) are not validated,
> and there is currently no configuration option to enable that validation.
> Vert.x already supports this via {{JWTAuthOptions.setJWTOptions(new
> JWTOptions().setIssuer(...).addAudience(...))}}. Exposing it would let
> operators opt into stricter token scoping, aligning with RFC 8725 (JSON Web
> Token Best Current Practices).
> h3. Proposed change (backwards compatible -- behaviour unchanged when unset)
> * Add optional {{jwtIssuer}} and {{jwtAudience}} properties to
> {{HttpServerConfigurationProperties}} and
> {{HttpManagementServerConfigurationProperties}}.
> * In both {{configureAuthentication}} overloads of
> {{JWTAuthenticationConfigurer}}, when these are set, attach a {{JWTOptions}}
> configured with the issuer/audience to the {{JWTAuthOptions}}.
> * Regenerate config metadata; document the new options in the
> platform-http-main docs.
> * Extend the existing auth tests ({{*MainHttpServerTest}}) with
> issuer/audience positive and negative cases.
> h3. Affected classes
> *
> {{components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java}}
> *
> {{core/camel-main/src/main/java/org/apache/camel/main/HttpServerConfigurationProperties.java}}
> *
> {{core/camel-main/src/main/java/org/apache/camel/main/HttpManagementServerConfigurationProperties.java}}
> ----
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
