Andrea Cosentino created CAMEL-24645:
----------------------------------------
Summary: camel-opa - cover the bearerToken option with an
integration test
Key: CAMEL-24645
URL: https://issues.apache.org/jira/browse/CAMEL-24645
Project: Camel
Issue Type: Test
Reporter: Andrea Cosentino
h2. Problem
{{camel-opa}} (CAMEL-24634) exposes a {{bearerToken}} option for an OPA server
that has its API authentication enabled. It is wired through
{{OpaPolicyEvaluator.createClient}}:
{code:java}
if (ObjectHelper.isNotEmpty(bearerToken)) {
return new OPAClient(serverUrl, Map.of("Authorization", "Bearer " +
bearerToken));
}
return new OPAClient(serverUrl);
{code}
No test exercises it. The unit tests all inject a mocked {{OPAClient}}, which
bypasses {{createClient}} entirely, and {{OpaIT}} runs an unauthenticated OPA
container. So nothing verifies that the token actually reaches the server as an
{{Authorization}} header.
This is a security-relevant option - if it silently failed to be applied, a
deployment would believe it was authenticating to its policy decision point
when it was not.
h2. Proposal
Extend {{OpaIT}} (or add a sibling IT) with a case that starts OPA with token
authentication enabled and asserts both directions:
* a request carrying the configured {{bearerToken}} is authorized and returns a
decision;
* a request without it, or with the wrong token, is rejected - and the
component fails closed on that rejection rather than treating it as a deny.
OPA is started with {{--authentication=token}} plus an authorization policy
over {{input.identity}}. The existing {{camel-test-infra-opa}} service starts a
plain server, so this likely needs either a second container configuration or a
parameter on the local container service.
h2. Scope
{{main}} only. Test-only change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
