Andrea Cosentino created CAMEL-26832:
----------------------------------------
Summary: camel-spiffe - support verified peer identity across HTTP
transports
Key: CAMEL-26832
URL: https://issues.apache.org/jira/browse/CAMEL-26832
Project: Camel
Issue Type: Improvement
Components: camel-spiffe
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
h2. Problem / motivation
SpiffeSecurityPolicy depends on an SSLSession exposed by Netty. The component
documentation explicitly states that platform-http, Jetty, Undertow and servlet
do not supply the session needed by the current policy.
h2. Proposed scope
Design a transport-neutral authenticated peer identity SPI/property and
integrate supported consumers. Preserve proof that the TLS layer authenticated
the peer; raw inbound identity strings or arbitrary certificate headers are not
sufficient. Keep existing Netty behavior compatible.
h2. Acceptance criteria / validation
* Implement and test adapters for the selected supported transports, with the
remaining support matrix explicit.
* Cover absent peer, missing client authentication, invalid SVID and
accepted/rejected identity.
* Demonstrate downstream OPA/OpenFGA composition using verified exchange state.
* Document reverse-proxy termination limitations.
h2. References
*
https://github.com/apache/camel/blob/5686684cb418/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffePeerIdentity.java
*
https://github.com/apache/camel/blob/5686684cb418/components/camel-spiffe/src/main/docs/spiffe-component.adoc#L193
Source: read-only component audit at 5686684cb418. Recheck current main before
implementing; historical references identify the audited code.
_AI-generated by Codex on behalf of oscerd (JIRA: acosentino)._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
