[
https://issues.apache.org/jira/browse/CAMEL-25405?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126635#comment-18126635
]
Andrea Cosentino commented on CAMEL-25405:
------------------------------------------
PR opened: https://github.com/apache/camel/pull/27767
Exposes a runtime-neutral MCP principal name (CamelMcpSecurityPrincipalName)
and roles (CamelMcpSecurityPrincipalRoles) alongside the raw
CamelMcpSecurityPrincipal, derived from the Vert.x transport user, so a tool
route or AuthorizationPolicy can authorize on a stable identity. Wiring the
shipped policies to consume it is left as a follow-up.
_Claude Code on behalf of oscerd_
> camel-ai-tool - expose a runtime-neutral MCP principal name and roles for the
> AuthorizationPolicies
> ---------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25405
> URL: https://issues.apache.org/jira/browse/CAMEL-25405
> Project: Camel
> Issue Type: Improvement
> Components: camel-mcp-server
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> Follow-up to CAMEL-24831 (MCP identity propagation, 4.23.0).
> On the MCP-server path the authenticated caller is stamped on the tool-route
> exchange as the CamelMcpSecurityPrincipal property holding the RAW runtime
> principal object (for the Vert.x engine, the io.vertx.ext.auth.User from
> ctx.user()). Camel's shipped AuthorizationPolicies (SpiffeSecurityPolicy,
> KeycloakSecurityPolicy, OpaSecurityPolicy, Shiro) cannot read that
> runtime-specific object, so an identity-based policy cannot actually
> authorize an MCP tool call out of the box.
> Expose a runtime-neutral view alongside the raw object - e.g.
> CamelMcpSecurityPrincipalName (String) and CamelMcpSecurityPrincipalRoles
> (collection), derived from the transport user - so the shipped policies and
> route authors can authorize on a stable name/roles regardless of the MCP
> server runtime.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
