[
https://issues.apache.org/jira/browse/CAMEL-24497?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24497:
-------------------------------------
Fix Version/s: 4.23.0
> camel-undertow-spring-security-starter - JWT decoder is built without an
> issuer or audience validator
> -----------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24497
> URL: https://issues.apache.org/jira/browse/CAMEL-24497
> Project: Camel
> Issue Type: Improvement
> Components: camel-spring-boot-starters, camel-undertow
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{UndertowSpringSecurityCustomizer.jwtDecoderByIssuerUri()}} builds the
> decoder from the JWK set URI and installs only a claim-set converter:
> {code:java}
> @Bean
> public JwtDecoder jwtDecoderByIssuerUri() {
> final String jwkSetUri =
> getClientRegistration().getProviderDetails().getJwkSetUri();
> final NimbusJwtDecoder jwtDecoder =
> NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
> jwtDecoder.setClaimSetConverter(new
> KeycloakUsernameSubClaimAdapter(getProvider().getUserNameAttribute()));
> return jwtDecoder;
> }
> {code}
> (UndertowSpringSecurityCustomizer:107)
> Despite the bean name, the decoder is built with {{withJwkSetUri}} and no
> {{setJwtValidator}} call, so the default validator applies: signature and
> timestamps are checked, but the {{iss}} claim is not, and the configured
> {{clientId}} is used only to build the {{ClientRegistration}} and is never
> bound to an {{aud}}/{{azp}} check. Spring Security's own
> {{withIssuerLocation}} path installs an issuer validator by default; this
> starter's construction path does not.
> *Proposal*
> {code:java}
> jwtDecoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(
> JwtValidators.createDefaultWithIssuer(issuerUri),
> new AudienceValidator(getClientRegistration().getClientId())));
> {code}
> with the issuer derived from the configured {{url}} + {{realmId}}.
> Separately: the starter has no test module, and the registration of the
> non-static inner {{@EnableWebSecurity SecurityConfiguration}} is not
> confirmed anywhere. A test asserting that the security filter chain actually
> installs would be worth adding alongside, since the decoder bean is only
> reached if the chain is registered.
> ----
> _This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
