[jira] [Created] (CAMEL-25406) camel-mcp-server - propagate the authenticated principal from the Spring Boot and Quarkus MCP server engines

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-25406:
----------------------------------------

             Summary: camel-mcp-server - propagate the authenticated principal from the Spring Boot and Quarkus MCP server engines
                 Key: CAMEL-25406
                 URL: https://issues.apache.org/jira/browse/CAMEL-25406
             Project: Camel
          Issue Type: Improvement
          Components: camel-mcp-server
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino


Follow-up to CAMEL-24831 (MCP identity propagation, 4.23.0).

Phase 3 wired the authenticated principal from the Vert.x MCP server path (VertxMcpServerEngine + VertxMcpStreamableServerTransportProvider -> exchange.transportContext() -> McpServerBridge stamps CamelMcpSecurityPrincipal). The Spring Boot SpringAiMcpServerEngine and the Quarkus QuarkusMcpServerEngine do not yet pass the authenticated principal, so the ai-tool authorizationPolicy cannot see the caller identity over MCP on those runtimes.

Wire both engines to read the authenticated user from their transport and stamp it via the McpToolCallHandler.call(Map, McpToolCallContext) / transportContext seam, the same way the Vert.x engine does. Also: the Quarkus CamelAiToolProvider is a separate AiToolResult consumer that should relay an AuthorizationDenied result to the model as a clean refusal, matching the other adapters (openai, spring-ai, langchain4j, mcp-server bridge).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)