Andrea Cosentino created CAMEL-26847:
----------------------------------------
Summary: camel-cedar - add embedded authorization producer and
security policy
Key: CAMEL-26847
URL: https://issues.apache.org/jira/browse/CAMEL-26847
Project: Camel
Issue Type: New Feature
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
h2. Problem / motivation
Camel has SPIFFE workload identity, OPA policy evaluation and OpenFGA
relationship authorization. A Cedar component would support applications
already using Cedar authorization policies over
principal/action/resource/context and supplied entities.
h2. Proposed scope
After the feasibility task, implement a focused embedded cedar:authorize
producer and CedarSecurityPolicy. Support configured policy/schema resources,
principal/action/resource/context mapping, an entity-provider SPI and
body-preserving structured decisions. Validate policies at startup, expose
determining policy IDs and diagnostics, and support immutable versioned
snapshots with atomic reload. Preserve raw engine decisions and explicitly
document an optional/default strict enforcement choice for evaluation errors.
No generic remote Cedar protocol is assumed.
h2. Acceptance criteria / validation
* Test default deny, permit/forbid precedence, entity hierarchy/context, schema
validation, diagnostic errors and concurrency.
* Test invalid startup/reload retains the configured valid revision or fails as
explicitly documented.
* Provide component docs, catalog/bean metadata, generated artifacts and
Java/XML/YAML examples with verified SPIFFE identity.
* Bound resources and omit sensitive input from default diagnostics.
* Document tested deployment targets and engine version compatibility.
h2. References
* https://docs.cedarpolicy.com/auth/authorization.html
* https://docs.cedarpolicy.com/validation.html
* https://github.com/cedar-policy/cedar-java
Source: read-only component audit at 5686684cb418. Recheck current main before
implementing; historical references identify the audited code.
_AI-generated by Codex on behalf of oscerd (JIRA: acosentino)._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
