[
https://issues.apache.org/jira/browse/CAMEL-24833?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen reassigned CAMEL-24833:
-----------------------------------
Assignee: Andrea Cosentino
> camel-spiffe - validateJwtSvid should accept the token from the Authorization
> Bearer header
> -------------------------------------------------------------------------------------------
>
> Key: CAMEL-24833
> URL: https://issues.apache.org/jira/browse/CAMEL-24833
> Project: Camel
> Issue Type: Improvement
> Reporter: Claus Ibsen
> Assignee: Andrea Cosentino
> Priority: Major
>
> h2. Problem
> {{spiffe:...?operation=validateJwtSvid}} reads the token from the
> {{CamelSpiffeToken}} header or, failing that, the message body
> ({{SpiffeProducer.validateJwtSvid}}). An HTTP caller presents a JWT-SVID as
> {{Authorization: Bearer <token>}}, which is how the SPIFFE JWT-SVID is meant
> to travel, so every route that authenticates an HTTP request today needs a
> small bean or expression to strip the scheme and copy the token into
> {{CamelSpiffeToken}} (see {{BearerToken}} in the {{ai-tools-spiffe-opa}}
> example in camel-examples). That is the only Java the assistant route in that
> example needs.
> h2. Proposal
> * When {{CamelSpiffeToken}} is not set, fall back to the {{Authorization}}
> header: accept a {{Bearer}} scheme case-insensitively, trim the token, and
> reject an empty or non-bearer value with a clear {{IllegalArgumentException}}
> (the same one used today for a missing token) so an {{onException}} can
> answer 401.
> * Keep the existing header and body sources; the {{Authorization}} header is
> the last fallback so nothing changes for current users.
> * Document the lookup order in {{spiffe-component.adoc}}, with a YAML example
> of a {{platform-http}} route validating the bearer token without a bean.
> Optional: an {{Authorization}} header left on the exchange after validation
> is a credential; mention removing it before the exchange goes further, or
> offer a {{removeToken=true}} option.
> Related: CAMEL-24831.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
