[
https://issues.apache.org/jira/browse/CAMEL-25405?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-25405 started by Andrea Cosentino.
------------------------------------------------
> camel-ai-tool - expose a runtime-neutral MCP principal name and roles for the
> AuthorizationPolicies
> ---------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25405
> URL: https://issues.apache.org/jira/browse/CAMEL-25405
> Project: Camel
> Issue Type: Improvement
> Components: camel-mcp-server
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> Follow-up to CAMEL-24831 (MCP identity propagation, 4.23.0).
> On the MCP-server path the authenticated caller is stamped on the tool-route
> exchange as the CamelMcpSecurityPrincipal property holding the RAW runtime
> principal object (for the Vert.x engine, the io.vertx.ext.auth.User from
> ctx.user()). Camel's shipped AuthorizationPolicies (SpiffeSecurityPolicy,
> KeycloakSecurityPolicy, OpaSecurityPolicy, Shiro) cannot read that
> runtime-specific object, so an identity-based policy cannot actually
> authorize an MCP tool call out of the box.
> Expose a runtime-neutral view alongside the raw object - e.g.
> CamelMcpSecurityPrincipalName (String) and CamelMcpSecurityPrincipalRoles
> (collection), derived from the transport user - so the shipped policies and
> route authors can authorize on a stable name/roles regardless of the MCP
> server runtime.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
