[
https://issues.apache.org/jira/browse/CAMEL-26920?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Simon Hartl updated CAMEL-26920:
--------------------------------
Description:
When configuring JWT authentication for the embedded Camel HTTP/MCP server
using {{{}camel.server.jwtKeystore*{}}}, authentication fails if the keystore
contains a valid key under an alias that does not match the JWT signing
algorithm.
For example, a PKCS12 keystore containing an RSA key under the alias
{{keycloak}} results in:
{{java.lang.IllegalStateException:}}
{{JWT is in unsecured mode but token is signed.}}
The underlying Vert.x JWT implementation requires algorithm-specific keystore
aliases (e.g., '{{{}RS256'{}}}).
While this is expected Vert.x behavior, Camel currently does not document this
requirement or provide an indication during startup that the configured
keystore does not contain usable JWT verification keys.
As a result, the server starts successfully, but all requests using signed JWTs
fail with HTTP 401.
h3. Steps to Reproduce
1. Enable JWT authentication in Camel Main:
{{application.properties:}}
{{ camel.server.authenticationEnabled=true}}
{{ camel.server.authenticationPath=/mcp}}
{{ camel.server.jwtKeystorePath=./keycloak-realm.p12}}
{{ camel.server.jwtKeystoreType=PKCS12}}
{{ camel.server.jwtKeystorePassword=...}}
2. Configure a valid PKCS12 keystore containing an RSA key with the alias
'{{{}keycloak'{}}}.
3. Start the Camel application.
4. Send a valid RS256-signed JWT to the protected MCP endpoint.
5. Observe HTTP 401 with the exception above.
h3. Expected Behavior
Camel should ideally:
* Document the Vert.x requirement for algorithm-specific JWT keystore aliases.
* Validate the configured keystore during startup and warn or fail fast if no
usable JWT verification keys are found.
* Provide a meaningful diagnostic message identifying the keystore
configuration problem.
h3. Actual Behavior
Camel starts successfully, but JWT authentication fails at runtime with an
exception that does not indicate the underlying keystore alias issue.
h3. Workaround
Rename the keystore alias to match the JWT signing algorithm:
keytool -changealias
-alias keycloak
-destalias RS256
-keystore ./keycloak-realm.p12
{{ -storetype PKCS12}}
After restarting Camel, authentication succeeds.
_References_
* [Vert.x JWT Authentication
Documentation|https://vertx.io/docs/vertx-auth-jwt/java/]
was:
When configuring JWT authentication for the embedded Camel HTTP/MCP server
using {{{}camel.server.jwtKeystore*{}}}, authentication fails if the keystore
contains a valid key under an alias that does not match the JWT signing
algorithm.
For example, a PKCS12 keystore containing an RSA key under the alias
{{keycloak}} results in:
{{java.lang.IllegalStateException:}}
{{JWT is in unsecured mode but token is signed.}}
The underlying Vert.x JWT implementation requires algorithm-specific keystore
aliases (e.g., '{{{}RS256'{}}}).
While this is expected Vert.x behavior, Camel currently does not document this
requirement or provide an indication during startup that the configured
keystore does not contain usable JWT verification keys.
As a result, the server starts successfully, but all requests using signed JWTs
fail with HTTP 401.
h3. Steps to Reproduce
1. Enable JWT authentication in Camel Main:
{{application.properties:}}
{{ camel.server.authenticationEnabled=true}}
{{ camel.server.authenticationPath=/mcp}}
{{ camel.server.jwtKeystorePath=./keycloak-realm.p12}}
{{ camel.server.jwtKeystoreType=PKCS12}}
{{ camel.server.jwtKeystorePassword=...}}
2. Configure a valid PKCS12 keystore containing an RSA key with the alias
'{{{}keycloak'{}}}.
3. Start the Camel application.
4. Send a valid RS256-signed JWT to the protected MCP endpoint.
5. Observe HTTP 401 with the exception above.
h3. Expected Behavior
Camel should ideally:
* Document the Vert.x requirement for algorithm-specific JWT keystore aliases.
* Validate the configured keystore during startup and warn or fail fast if no
usable JWT verification keys are found.
* Provide a meaningful diagnostic message identifying the keystore
configuration problem.
h3. Actual Behavior
Camel starts successfully, but JWT authentication fails at runtime with an
exception that does not indicate the underlying keystore alias issue.
h3. Workaround
Rename the keystore alias to match the JWT signing algorithm:
{{keytool -changealias \}}
{{-alias keycloak \}}
{{ -destalias RS256 \}}
{{ -keystore ./keycloak-realm.p12 \}}
{{ -storetype PKCS12}}
After restarting Camel, authentication succeeds.
_References_
* [Vert.x JWT Authentication
Documentation|https://vertx.io/docs/vertx-auth-jwt/java/]
> Validate JWT keystore configuration and document algorithm-specific aliases
> in Camel Main HTTP Server
> -----------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26920
> URL: https://issues.apache.org/jira/browse/CAMEL-26920
> Project: Camel
> Issue Type: Improvement
> Components: camel-platform-http
> Affects Versions: 4.23.0
> Reporter: Simon Hartl
> Priority: Minor
>
> When configuring JWT authentication for the embedded Camel HTTP/MCP server
> using {{{}camel.server.jwtKeystore*{}}}, authentication fails if the keystore
> contains a valid key under an alias that does not match the JWT signing
> algorithm.
> For example, a PKCS12 keystore containing an RSA key under the alias
> {{keycloak}} results in:
> {{java.lang.IllegalStateException:}}
> {{JWT is in unsecured mode but token is signed.}}
> The underlying Vert.x JWT implementation requires algorithm-specific keystore
> aliases (e.g., '{{{}RS256'{}}}).
> While this is expected Vert.x behavior, Camel currently does not document
> this requirement or provide an indication during startup that the configured
> keystore does not contain usable JWT verification keys.
> As a result, the server starts successfully, but all requests using signed
> JWTs fail with HTTP 401.
> h3. Steps to Reproduce
> 1. Enable JWT authentication in Camel Main:
> {{application.properties:}}
> {{ camel.server.authenticationEnabled=true}}
> {{ camel.server.authenticationPath=/mcp}}
> {{ camel.server.jwtKeystorePath=./keycloak-realm.p12}}
> {{ camel.server.jwtKeystoreType=PKCS12}}
> {{ camel.server.jwtKeystorePassword=...}}
> 2. Configure a valid PKCS12 keystore containing an RSA key with the alias
> '{{{}keycloak'{}}}.
> 3. Start the Camel application.
> 4. Send a valid RS256-signed JWT to the protected MCP endpoint.
> 5. Observe HTTP 401 with the exception above.
> h3. Expected Behavior
> Camel should ideally:
> * Document the Vert.x requirement for algorithm-specific JWT keystore
> aliases.
> * Validate the configured keystore during startup and warn or fail fast if
> no usable JWT verification keys are found.
> * Provide a meaningful diagnostic message identifying the keystore
> configuration problem.
> h3. Actual Behavior
> Camel starts successfully, but JWT authentication fails at runtime with an
> exception that does not indicate the underlying keystore alias issue.
> h3. Workaround
> Rename the keystore alias to match the JWT signing algorithm:
> keytool -changealias
> -alias keycloak
> -destalias RS256
> -keystore ./keycloak-realm.p12
> {{ -storetype PKCS12}}
> After restarting Camel, authentication succeeds.
> _References_
> * [Vert.x JWT Authentication
> Documentation|https://vertx.io/docs/vertx-auth-jwt/java/]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
