Andrea Cosentino created CAMEL-24319:
----------------------------------------
Summary: camel-keycloak: optional token type (typ) and authorized
party (azp) validation in KeycloakSecurityPolicy
Key: CAMEL-24319
URL: https://issues.apache.org/jira/browse/CAMEL-24319
Project: Camel
Issue Type: Improvement
Components: camel-keycloak
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
KeycloakSecurityPolicy verifies token signature, issuer and active state, plus
optional audience validation (CAMEL-23875), but does not check the token's type
(typ) or authorized party (azp).
This adds two opt-in settings, mirroring the existing expectedAudience opt-in
and applied on both the local JWT verification path and the token introspection
path:
* expectedTokenTypes - a comma-separated allow-list of accepted typ values
(e.g. "Bearer"). Guards against token-type confusion, for example an ID token
or refresh token being presented where an access token is expected.
* expectedAuthorizedParty - the expected azp value (e.g. "my-client"); ensures
the token was issued for the expected client.
Both checks are disabled by default for backward compatibility (non-breaking).
Includes unit tests and documentation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
