[
https://issues.apache.org/jira/browse/CAMEL-25578?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-25578 started by Andrea Cosentino.
------------------------------------------------
> camel-lra - verify participant callbacks with an optional shared secret
> -----------------------------------------------------------------------
>
> Key: CAMEL-25578
> URL: https://issues.apache.org/jira/browse/CAMEL-25578
> Project: Camel
> Issue Type: Improvement
> Components: camel-lra
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.2, 4.24.0
>
>
> The LRA participant routes ({{PUT <localParticipantContextPath>/compensate}}
> and {{/complete}}) take the saga step endpoint and the saga options from the
> callback URL enlisted with the LRA coordinator.
> Add an optional shared secret to the LRA saga service so the participant can
> sign the callback URLs it enlists and verify them when the coordinator calls
> back:
> * new {{LRASagaService}} option, also settable as {{camel.lra.callbackSecret}}
> * when set: the compensate/complete URLs carry an HMAC-SHA256 signature over
> the callback type and all query parameters; callbacks with a missing or
> mismatching signature get HTTP 403, and only the signed values are passed on
> to the step endpoint
> * when not set: behaviour unchanged, plus a startup warning
> * docs: the Saga EIP / LRA pages describe the participant endpoints, that
> they are meant to be reachable by the coordinator, and the new option
> Follow-up: expose the option in {{camel-lra-starter}} (camel-spring-boot).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
