Andrea Cosentino created CAMEL-24734:
----------------------------------------
Summary: camel-spiffe - validateJwtSvid silently validates against
only the first configured audience
Key: CAMEL-24734
URL: https://issues.apache.org/jira/browse/CAMEL-24734
Project: Camel
Issue Type: Bug
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
h2. Problem
{{SpiffeProducer.validateJwtSvid}} takes the first audience and discards the
rest:
{code:java}
JwtSvid svid = client.validateJwtSvid(token, audiences[0]);
{code}
So an endpoint configured
{{audience=spiffe://example.org/a,spiffe://example.org/b}} validates *only*
against {{a}}. Nothing warns; {{b}} is silently ignored.
This is documented in passing, but silent truncation is the wrong behaviour for
a security check - the operator's stated intent was that either audience is
acceptable, and only half of it is enforced. It also became more consequential
with CAMEL-24730: now that {{CamelSpiffeAudience}} can no longer override the
configured value on the validation path, the configuration is the *only* input,
so a misconfiguration there has nowhere else to surface.
Contrast {{fetchJwtSvid}} on the line above, which does honour every audience:
{code:java}
audiences.length > 1
? client.fetchJwtSvid(audiences[0], Arrays.copyOfRange(audiences, 1,
audiences.length))
: client.fetchJwtSvid(audiences[0]);
{code}
h2. Proposal
Pick one, and make it explicit rather than silent:
# Validate against each configured audience and accept if any matches - matches
the natural reading of a list, and mirrors how {{fetchJwtSvid}} treats the same
option.
# Reject a multi-value {{audience}} at endpoint creation when the operation is
{{validateJwtSvid}}, so the misconfiguration fails fast instead of
half-applying.
Option 1 is the better fit for the existing option semantics. Whichever is
chosen, the javadoc and {{spiffe-component.adoc}} must state it, and a test
must lock it.
h2. Scope
{{main}} only. {{camel-spiffe}} is new in the unreleased 4.23.0.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
