[
https://issues.apache.org/jira/browse/CAMEL-26847?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26847 started by Andrea Cosentino.
------------------------------------------------
> camel-cedar - add embedded authorization producer and security policy
> ---------------------------------------------------------------------
>
> Key: CAMEL-26847
> URL: https://issues.apache.org/jira/browse/CAMEL-26847
> Project: Camel
> Issue Type: New Feature
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Labels: authorization, camel-cedar, component-audit
>
> h2. Problem / motivation
> Camel has SPIFFE workload identity, OPA policy evaluation and OpenFGA
> relationship authorization. A Cedar component would support applications
> already using Cedar authorization policies over
> principal/action/resource/context and supplied entities.
> h2. Proposed scope
> After the feasibility task, implement a focused embedded cedar:authorize
> producer and CedarSecurityPolicy. Support configured policy/schema resources,
> principal/action/resource/context mapping, an entity-provider SPI and
> body-preserving structured decisions. Validate policies at startup, expose
> determining policy IDs and diagnostics, and support immutable versioned
> snapshots with atomic reload. Preserve raw engine decisions and explicitly
> document an optional/default strict enforcement choice for evaluation errors.
> No generic remote Cedar protocol is assumed.
> h2. Acceptance criteria / validation
> * Test default deny, permit/forbid precedence, entity hierarchy/context,
> schema validation, diagnostic errors and concurrency.
> * Test invalid startup/reload retains the configured valid revision or fails
> as explicitly documented.
> * Provide component docs, catalog/bean metadata, generated artifacts and
> Java/XML/YAML examples with verified SPIFFE identity.
> * Bound resources and omit sensitive input from default diagnostics.
> * Document tested deployment targets and engine version compatibility.
> h2. References
> * https://docs.cedarpolicy.com/auth/authorization.html
> * https://docs.cedarpolicy.com/validation.html
> * https://github.com/cedar-policy/cedar-java
> Source: read-only component audit at 5686684cb418. Recheck current main
> before implementing; historical references identify the audited code.
> _AI-generated by Codex on behalf of oscerd (JIRA: acosentino)._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
