[
https://issues.apache.org/jira/browse/CAMEL-26832?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26832 started by Andrea Cosentino.
------------------------------------------------
> camel-spiffe - support verified peer identity across HTTP transports
> --------------------------------------------------------------------
>
> Key: CAMEL-26832
> URL: https://issues.apache.org/jira/browse/CAMEL-26832
> Project: Camel
> Issue Type: Improvement
> Components: camel-spiffe
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Labels: authorization, camel-spiffe, component-audit
>
> h2. Problem / motivation
> SpiffeSecurityPolicy depends on an SSLSession exposed by Netty. The component
> documentation explicitly states that platform-http, Jetty, Undertow and
> servlet do not supply the session needed by the current policy.
> h2. Proposed scope
> Design a transport-neutral authenticated peer identity SPI/property and
> integrate supported consumers. Preserve proof that the TLS layer
> authenticated the peer; raw inbound identity strings or arbitrary certificate
> headers are not sufficient. Keep existing Netty behavior compatible.
> h2. Acceptance criteria / validation
> * Implement and test adapters for the selected supported transports, with the
> remaining support matrix explicit.
> * Cover absent peer, missing client authentication, invalid SVID and
> accepted/rejected identity.
> * Demonstrate downstream OPA/OpenFGA composition using verified exchange
> state.
> * Document reverse-proxy termination limitations.
> h2. References
> *
> https://github.com/apache/camel/blob/5686684cb418/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffePeerIdentity.java
> *
> https://github.com/apache/camel/blob/5686684cb418/components/camel-spiffe/src/main/docs/spiffe-component.adoc#L193
> Source: read-only component audit at 5686684cb418. Recheck current main
> before implementing; historical references identify the audited code.
> _AI-generated by Codex on behalf of oscerd (JIRA: acosentino)._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
