Claus Ibsen created CAMEL-24833:
-----------------------------------
Summary: camel-spiffe - validateJwtSvid should accept the token
from the Authorization Bearer header
Key: CAMEL-24833
URL: https://issues.apache.org/jira/browse/CAMEL-24833
Project: Camel
Issue Type: Improvement
Reporter: Claus Ibsen
h2. Problem
{{spiffe:...?operation=validateJwtSvid}} reads the token from the
{{CamelSpiffeToken}} header or, failing that, the message body
({{SpiffeProducer.validateJwtSvid}}). An HTTP caller presents a JWT-SVID as
{{Authorization: Bearer <token>}}, which is how the SPIFFE JWT-SVID is meant to
travel, so every route that authenticates an HTTP request today needs a small
bean or expression to strip the scheme and copy the token into
{{CamelSpiffeToken}} (see {{BearerToken}} in the {{ai-tools-spiffe-opa}}
example in camel-examples). That is the only Java the assistant route in that
example needs.
h2. Proposal
* When {{CamelSpiffeToken}} is not set, fall back to the {{Authorization}}
header: accept a {{Bearer}} scheme case-insensitively, trim the token, and
reject an empty or non-bearer value with a clear {{IllegalArgumentException}}
(the same one used today for a missing token) so an {{onException}} can answer
401.
* Keep the existing header and body sources; the {{Authorization}} header is
the last fallback so nothing changes for current users.
* Document the lookup order in {{spiffe-component.adoc}}, with a YAML example
of a {{platform-http}} route validating the bearer token without a bean.
Optional: an {{Authorization}} header left on the exchange after validation is
a credential; mention removing it before the exchange goes further, or offer a
{{removeToken=true}} option.
Related: CAMEL-24831.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
