Andrea Cosentino created CAMEL-26562:
----------------------------------------
Summary: camel-opa, camel-openfga - let the security policies use
the global SSL context
Key: CAMEL-26562
URL: https://issues.apache.org/jira/browse/CAMEL-26562
Project: Camel
Issue Type: Improvement
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0
Found while checking how well the camel-opa and camel-openfga configuration can
be written in YAML.
h4. What happens
The {{opa}} and {{openfga}} components have {{useGlobalSslContextParameters}}:
an endpoint without its own {{sslContextParameters}} then uses the context-wide
{{SSLContextParameters}}, the one camel-main builds from {{camel.ssl.*}}.
{{OpaSecurityPolicy}} and {{OpenFgaSecurityPolicy}} have no such option and
ignore the component's, so a policy that must reach a TLS-protected OPA or
OpenFGA server needs an {{SSLContextParameters}} bean of its own, even when the
global one is exactly what it should use. In YAML that means repeating the key
store and trust store configuration as a nested bean.
The {{setSslContextParameters}} javadoc of both policies says the global
context "cannot be resolved automatically" because the policy is not bound to a
component instance. The policy does have the {{CamelContext}} where it matters:
{{beforeWrap}} takes it from the route and builds the {{SSLContext}} there.
h4. Proposed fix
Add {{useGlobalSslContextParameters}} (default {{false}}) to both policies,
with the endpoints' precedence: an explicit {{sslContextParameters}} wins;
otherwise the context's global {{SSLContextParameters}} when the option is on;
otherwise the JVM default, as today. Update both component pages, which today
say the component option has no effect on the policy. In {{wasm}} mode the OPA
policy talks to no server, so the option is ignored there, like
{{sslContextParameters}}.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
