[PR] [backport camel-4.14.x] CAMEL-23525: Add optional JWT issuer and audience claim validation [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd opened a new pull request, #25196:
URL: https://github.com/apache/camel/pull/25196

   Backport of `010bcd575ebd` (originally #23389) to `camel-4.14.x` (→ 4.14.9).
   
   Adds `jwtIssuer` and `jwtAudience` to the embedded HTTP server and the management server. When either is set, a `JWTOptions` carrying those values is attached to the `JWTAuthOptions` passed to `JWTAuth.create`, so the `iss` and `aud` claims are validated in addition to the signature and the expiry. `jwtAudience` accepts a comma-separated list and a token is accepted if its `aud` claim matches any configured value.
   
   ## Why on a maintenance branch
   
   Without these options a JWT authenticator on this branch validates the signature and expiry only, and there is no configuration that changes that. This backport gives operators on 4.14.9 a way to constrain which issuer and audience are accepted. The related fail-closed change (CAMEL-24281, #25187) is deliberately **not** backported, since it would be a startup-breaking change here.
   
   ## Compatibility
   
   Additive only. Both options default to `null`, `buildJwtOptions` returns `null` when both are empty, and the caller then skips `setJWTOptions`, so an existing configuration builds the authenticator exactly as before. The new methods on `HttpServerConfigurationProperties` and `HttpManagementServerConfigurationProperties` are additive and binary compatible.
   
   The pre-existing keystore-only `JWTAuthenticationMainHttpServerTest` passes unchanged on this branch, which is the compatibility check that matters here.
   
   ## Notes
   
   * The upgrade-guide entry from the original commit is omitted: the options are purely additive on this branch, and the guide is for migration concerns.
   * Generated configurers and metadata were regenerated from source rather than taken from the cherry-pick.
   * Module suite green (16 tests, including the 6 added by this change).
   
   _Claude Code on behalf of oscerd_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [backport camel-4.14.x] CAMEL-23525: Add optional JWT issuer and audience claim validation [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd merged PR #25196:
URL: https://github.com/apache/camel/pull/25196


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org