[jira] [Work started] (CAMEL-24497) camel-undertow-spring-security-starter - JWT decoder is built without an issuer or audience validator

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24497?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Work on CAMEL-24497 started by Andrea Cosentino.
------------------------------------------------
> camel-undertow-spring-security-starter - JWT decoder is built without an issuer or audience validator
> -----------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24497
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24497
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-spring-boot-starters, camel-undertow
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> {{UndertowSpringSecurityCustomizer.jwtDecoderByIssuerUri()}} builds the decoder from the JWK set URI and installs only a claim-set converter:
> {code:java}
> @Bean
> public JwtDecoder jwtDecoderByIssuerUri() {
>     final String jwkSetUri = getClientRegistration().getProviderDetails().getJwkSetUri();
>     final NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
>     jwtDecoder.setClaimSetConverter(new KeycloakUsernameSubClaimAdapter(getProvider().getUserNameAttribute()));
>     return jwtDecoder;
> }
> {code}
> (UndertowSpringSecurityCustomizer:107)
> Despite the bean name, the decoder is built with {{withJwkSetUri}} and no {{setJwtValidator}} call, so the default validator applies: signature and timestamps are checked, but the {{iss}} claim is not, and the configured {{clientId}} is used only to build the {{ClientRegistration}} and is never bound to an {{aud}}/{{azp}} check. Spring Security's own {{withIssuerLocation}} path installs an issuer validator by default; this starter's construction path does not.
> *Proposal*
> {code:java}
> jwtDecoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(
>         JwtValidators.createDefaultWithIssuer(issuerUri),
>         new AudienceValidator(getClientRegistration().getClientId())));
> {code}
> with the issuer derived from the configured {{url}} + {{realmId}}.
> Separately: the starter has no test module, and the registration of the non-static inner {{@EnableWebSecurity SecurityConfiguration}} is not confirmed anywhere. A test asserting that the security filter chain actually installs would be worth adding alongside, since the decoder bean is only reached if the chain is registered.
> ----
> _This issue was drafted by Claude Code on behalf of Andrea Cosentino._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)