You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/07/28 10:28:18 UTC
[PR] CAMEL-24281: camel-platform-http-main - fail closed when JWT authentication has no issuer or audience [camel]
oscerd opened a new pull request, #25187:
URL: https://github.com/apache/camel/pull/25187
# CAMEL-24281
When JWT authentication is enabled on the camel-main embedded HTTP server, `JWTAuthenticationConfigurer.buildJwtOptions(...)` returns `null` if neither `jwtIssuer` nor `jwtAudience` is configured, and the caller then skips `JWTAuthOptions.setJWTOptions(...)`. The resulting Vert.x `JWTAuth` is built from the keystore alone, so tokens are only checked for signature and expiry and the `iss` and `aud` claims are not validated. Nothing signals this: the server starts normally, so a deployment configured the documented way can be enforcing less than intended.
## Change
* `assertIssuerOrAudienceConfigured(...)` is called at the top of **both** `configureAuthentication` overloads, so the application server and the management server are both covered. It throws `IllegalArgumentException` when a JWT keystore is configured but neither value is set, naming the properties involved.
* New `jwtAllowMissingIssuerAndAudience` option (default `false`) on `HttpServerConfigurationProperties` and `HttpManagementServerConfigurationProperties` for deployments that genuinely want signature and expiry validation only.
This mirrors the posture `camel-oauth` already uses, where `DefaultOAuthTokenValidationFactory.validateResolvedConfiguration` refuses to operate unless an expected audience and issuer are configured (`allow-missing-audience` and `allow-missing-issuer` both default to `false`).
## Compatibility
This changes startup behaviour for an existing configuration, so it is documented in the 4.22 upgrade guide with the opt-out.
`jwtIssuer` and `jwtAudience` were only added in 4.21.0 by CAMEL-23525, so this applies to `main` only. Backporting the fail-closed behaviour to 4.18.x or 4.14.x is not possible as-is, because those branches have no such options to satisfy the requirement.
## Tests
`JWTIssuerAudienceRequiredMainHttpServerTest` (4): startup fails without an issuer or audience and the message names all three properties; the opt-out starts and still serves; a token minted for a different issuer and audience is rejected once both are configured; the opt-out defaults to false on both properties classes.
One existing test config, `jwt-auth.properties`, is keystore-only and therefore no longer starts. It now sets `jwtAllowMissingIssuerAndAudience=true`, which keeps `JWTAuthenticationMainHttpServerTest` testing what it was written to test and exercises the opt-out.
Module suite green (23), `camel-main` green (231), full reactor build green with generated files committed.
The component documentation previously described signature and expiry checking as the default with issuer and audience as an optional extra. It now states that without them any unexpired token signed by a trusted key is accepted regardless of issuer or audience.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24281: camel-platform-http-main - fail closed when JWT authentication has no issuer or audience [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on PR #25187:
URL: https://github.com/apache/camel/pull/25187#issuecomment-5104579500
Two follow-up notes on the review round, beyond the three inline replies.
**On `insecure:dev`:** applied to both properties classes as suggested, and it propagates correctly into the generated metadata for `camel.server.jwtAllowMissingIssuerAndAudience` and `camel.management.jwtAllowMissingIssuerAndAudience`. Worth flagging though that `design/security.adoc` defines `insecure:dev` as *"development/debug features that should not be enabled in production"* (`devConsoleEnabled`, `debugBreakpoints`), whereas this flag weakens **authentication** rather than enabling a dev feature. None of the three valid values (`insecure:ssl`, `insecure:serialization`, `insecure:dev`) really covers auth-weakening options. `insecure:dev` is the closest fit and matches what this file already does, so it is what I used, but a dedicated `insecure:auth` category may be the better long-term answer. That would be a separate change across the annotation, the docs and `SecurityUtils` generation, so I have not attempted it here.
**Re-verified against the Vert.x upgrade:** `main` moved from Vert.x 4.5.28 to 4.5.31 while this PR was open. Since the change depends on how Vert.x applies `JWTOptions` claim checks, I merged `main` and re-ran rather than assuming: module suite is green (23 tests) on 4.5.31, behaviour unchanged. The merge also resolved a conflict in `camel-4x-upgrade-guide-4_22.adoc` against the CAMEL-24279 entry that landed in the meantime; both notes are kept.
Full reactor build `mvn clean install -DskipTests` green, no regenerated-file drift.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24281: camel-platform-http-main - fail closed when JWT authentication has no issuer or audience [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #25187:
URL: https://github.com/apache/camel/pull/25187
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24281: camel-platform-http-main - fail closed when JWT authentication has no issuer or audience [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #25187:
URL: https://github.com/apache/camel/pull/25187#issuecomment-5103340433
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24281: camel-platform-http-main - fail closed when JWT authentication has no issuer or audience [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #25187:
URL: https://github.com/apache/camel/pull/25187#issuecomment-5103991575
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `catalog/camel-catalog`
- `components/camel-platform-http-main`
- `core/camel-main`
- `docs`
> :information_source: Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the `test-dependents` label to force testing all dependents.
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 63 tested, 27 compile-only — current: 61 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **90 affected modules** (current approach: 61).
<details><summary>:warning: Modules only in Scalpel (29)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-csimple-maven-plugin`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
**Skip-tests mode would test 63 modules** (4 direct + 59 downstream), **skip tests for 27** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (63)</summary>
- `camel-a2a`
- `camel-as2`
- `camel-catalog`
- `camel-clickup`
- `camel-consul`
- `camel-core-all`
- `camel-csv`
- `camel-fhir`
- `camel-groovy`
- `camel-hazelcast`
- `camel-hl7`
- `camel-ibm-watsonx-ai`
- `camel-iso8583`
- `camel-java-joor-dsl`
- `camel-jbang-mcp`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-jetty`
- `camel-jsonpath`
- `camel-kamelet`
- `camel-kamelet-main-support`
- `camel-knative-http`
- `camel-launcher-container`
- `camel-mail`
- `camel-mail-microsoft-oauth`
- `camel-main`
- `camel-maven-plugin`
- `camel-micrometer-prometheus`
- `camel-microprofile-health`
- `camel-netty`
- `camel-netty-http`
- `camel-oauth`
- `camel-observability-services`
- `camel-once`
- `camel-openapi-validator`
- `camel-platform-http-main`
- `camel-platform-http-vertx`
- `camel-plc4x`
- `camel-pubnub`
- `camel-quickfix`
- `camel-rest-openapi`
- `camel-restdsl-openapi-plugin`
- `camel-salesforce`
- `camel-salesforce-codegen`
- `camel-salesforce-maven-plugin`
- `camel-spring-main`
- `camel-syslog`
- `camel-telegram`
- `camel-test-main-junit5`
- `camel-test-main-junit6`
- `camel-vertx-websocket`
- `camel-webhook`
- `camel-whatsapp`
- `camel-xml-io-dsl`
- `camel-xml-jaxb-dsl`
- `camel-xml-jaxb-dsl-test-definition`
- `camel-xml-jaxb-dsl-test-spring`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
- `camel-zookeeper`
- `docs`
</details>
<details><summary>Modules with tests skipped (27)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-csimple-maven-plugin`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `dummy-component`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>Build reactor — dependencies compiled but only changed modules were tested (90 modules)</summary>
- Camel :: AI :: A2A
- Camel :: AS2 :: Component
- Camel :: All Components Sync point
- Camel :: All Core Sync point
- Camel :: Assembly
- Camel :: CSV
- Camel :: Catalog :: CSimple Maven Plugin (deprecated)
- Camel :: Catalog :: Camel Catalog
- Camel :: Catalog :: Camel Report Maven Plugin
- Camel :: Catalog :: Camel Route Parser
- Camel :: Catalog :: Console
- Camel :: Catalog :: Dummy Component
- Camel :: Catalog :: Lucene (deprecated)
- Camel :: Catalog :: Maven
- Camel :: Catalog :: Suggest
- Camel :: ClickUp
- Camel :: Component DSL
- Camel :: Consul
- Camel :: Coverage
- Camel :: Docs
- Camel :: Endpoint DSL
- Camel :: Endpoint DSL :: Support
- Camel :: FHIR
- Camel :: Groovy
- Camel :: HL7
- Camel :: HazelCast
- Camel :: IBM :: watsonx.ai
- Camel :: ISO-8583
- Camel :: Integration Tests
- Camel :: JBang :: Core
- Camel :: JBang :: Integration tests
- Camel :: JBang :: MCP
- Camel :: JBang :: Main
- Camel :: JBang :: Plugin :: Edit
- Camel :: JBang :: Plugin :: Generate
- Camel :: JBang :: Plugin :: Kubernetes
- Camel :: JBang :: Plugin :: MCP
- Camel :: JBang :: Plugin :: Route Parser
- Camel :: JBang :: Plugin :: TUI
- Camel :: JBang :: Plugin :: Testing
- Camel :: JBang :: Plugin :: Validate
- Camel :: JSon Path
- Camel :: Java DSL with jOOR
- Camel :: Jetty
- Camel :: Kamelet
- Camel :: Kamelet Main
- Camel :: Kamelet Main :: Support
- Camel :: Knative HTTP
- Camel :: Launcher
- Camel :: Launcher :: Container
- Camel :: Mail
- Camel :: Mail :: Microsoft OAuth
- Camel :: Main
- Camel :: Maven Plugins :: Camel Maven Plugin
- Camel :: Maven Plugins :: OpenApi REST DSL Generator
- Camel :: MicroProfile :: Health
- Camel :: Micrometer :: Prometheus
- Camel :: Netty
- Camel :: Netty HTTP
- Camel :: OAuth
- Camel :: Observability Services
- Camel :: Once
- Camel :: OpenAPI :: Validator
- Camel :: PLC4X
- Camel :: Platform HTTP :: Main
- Camel :: Platform HTTP :: Vert.x
- Camel :: PubNub
- Camel :: QuickFIX/J
- Camel :: REST OpenApi
- Camel :: Salesforce
- Camel :: Salesforce :: CodeGen
- Camel :: Salesforce :: Maven Plugin
- Camel :: Spring Main
- Camel :: Syslog
- Camel :: Telegram
- Camel :: Test :: Main :: JUnit5
- Camel :: Test :: Main :: JUnit6
- Camel :: Vert.x :: WebSocket
- Camel :: Webhook
- Camel :: Whatsapp
- Camel :: XML DSL Jaxb :: Test :: Definition
- Camel :: XML DSL Jaxb :: Test :: Spring
- Camel :: XML DSL with camel-xml-io
- Camel :: XML DSL with camel-xml-jaxb
- Camel :: YAML DSL
- Camel :: YAML DSL :: Deserializers
- Camel :: YAML DSL :: Maven Plugins
- Camel :: YAML DSL :: Validator
- Camel :: YAML DSL :: Validator Maven Plugin
- Camel :: Zookeeper
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/30350877014)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24281: camel-platform-http-main - fail closed when JWT authentication has no issuer or audience [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #25187:
URL: https://github.com/apache/camel/pull/25187#discussion_r3665182582
##########
core/camel-main/src/main/java/org/apache/camel/main/HttpManagementServerConfigurationProperties.java:
##########
@@ -77,6 +77,8 @@ public class HttpManagementServerConfigurationProperties implements BootstrapClo
private String jwtIssuer;
@Metadata(label = "security")
private String jwtAudience;
+ @Metadata(label = "security", defaultValue = "false")
+ private boolean jwtAllowMissingIssuerAndAudience;
Review Comment:
Same here — this file already uses `security = "insecure:dev"` on `devConsoleEnabled`, `uploadEnabled`, `downloadEnabled`, and `sendEnabled`, so the pattern is well established.
```suggestion
@Metadata(label = "security", defaultValue = "false", security = "insecure:dev")
private boolean jwtAllowMissingIssuerAndAudience;
```
##########
core/camel-main/src/main/java/org/apache/camel/main/HttpServerConfigurationProperties.java:
##########
@@ -68,6 +68,8 @@ public class HttpServerConfigurationProperties implements BootstrapCloseable {
private String jwtIssuer;
@Metadata(label = "security")
private String jwtAudience;
+ @Metadata(label = "security", defaultValue = "false")
+ private boolean jwtAllowMissingIssuerAndAudience;
Review Comment:
The `jwtAllowMissingIssuerAndAudience` flag weakens security (it opts out of issuer/audience validation), so per the project convention it should carry `security = "insecure:dev"` on its `@Metadata` annotation — the same pattern used for `trustAllCertificates`, `allowJavaSerializedObject`, etc. Without it, the security policy framework (`camel.main.profile = prod`) cannot warn about or block this flag in production.
```suggestion
@Metadata(label = "security", defaultValue = "false", security = "insecure:dev")
private boolean jwtAllowMissingIssuerAndAudience;
```
##########
components/camel-platform-http-main/src/test/java/org/apache/camel/component/platform/http/main/authentication/JWTIssuerAudienceRequiredMainHttpServerTest.java:
##########
@@ -0,0 +1,132 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.platform.http.main.authentication;
+
+import io.vertx.core.Vertx;
+import io.vertx.core.json.JsonObject;
+import io.vertx.ext.auth.JWTOptions;
+import io.vertx.ext.auth.jwt.JWTAuth;
+import io.vertx.ext.auth.jwt.JWTAuthOptions;
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.main.HttpManagementServerConfigurationProperties;
+import org.apache.camel.main.HttpServerConfigurationProperties;
+import org.apache.camel.main.Main;
+import org.apache.camel.test.AvailablePortFinder;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import static io.restassured.RestAssured.given;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/**
+ * A JWT authenticator built without an issuer or an audience only verifies the token signature and the exp/nbf claims,
+ * so the embedded server refuses to start in that configuration unless the opt-out is set.
+ */
+class JWTIssuerAudienceRequiredMainHttpServerTest {
+
+ @RegisterExtension
+ static AvailablePortFinder.Port port = AvailablePortFinder.find();
+
+ @Test
+ void serverFailsToStartWithoutIssuerOrAudience() {
+ Main main = MainHttpServerAuthenticationTestSupport.createMain(
+ "jwt-auth-no-issuer-audience.properties", port, new PlatformHttpRouteBuilder());
+ try {
+ assertThatThrownBy(main::start)
+ .isInstanceOf(IllegalArgumentException.class)
+ .hasMessageContaining("camel.server.jwtIssuer")
+ .hasMessageContaining("camel.server.jwtAudience")
+ .hasMessageContaining("camel.server.jwtAllowMissingIssuerAndAudience");
+ } finally {
+ MainHttpServerAuthenticationTestSupport.stopMain(main);
+ }
+ }
+
+ @Test
+ void optOutStartsAndValidatesSignatureAndExpiryOnly() {
+ // jwt-auth.properties sets jwtAllowMissingIssuerAndAudience=true
+ Main main = MainHttpServerAuthenticationTestSupport.createMain(
+ "jwt-auth.properties", port, new PlatformHttpRouteBuilder());
+ try {
+ main.start();
+
Review Comment:
Minor: the `Vertx.vertx()` instances created here and in `configuredIssuerAndAudienceRejectAForeignToken()` are never closed, leaking native event-loop threads. This follows the pre-existing pattern in `JWTAuthenticationMainHttpServerTest`, but consider extracting a shared `Vertx` instance with proper cleanup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24281: camel-platform-http-main - fail closed when JWT authentication has no issuer or audience [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #25187:
URL: https://github.com/apache/camel/pull/25187#discussion_r3665738690
##########
core/camel-main/src/main/java/org/apache/camel/main/HttpServerConfigurationProperties.java:
##########
@@ -68,6 +68,8 @@ public class HttpServerConfigurationProperties implements BootstrapCloseable {
private String jwtIssuer;
@Metadata(label = "security")
private String jwtAudience;
+ @Metadata(label = "security", defaultValue = "false")
+ private boolean jwtAllowMissingIssuerAndAudience;
Review Comment:
Done — jwtAllowMissingIssuerAndAudience in HttpServerConfigurationProperties now carries @Metadata(label = "security", defaultValue = "false", security = "insecure:dev"), so the prod profile can flag it.\n\n_Claude Code on behalf of Andrea Cosentino (@oscerd)._
##########
core/camel-main/src/main/java/org/apache/camel/main/HttpManagementServerConfigurationProperties.java:
##########
@@ -77,6 +77,8 @@ public class HttpManagementServerConfigurationProperties implements BootstrapClo
private String jwtIssuer;
@Metadata(label = "security")
private String jwtAudience;
+ @Metadata(label = "security", defaultValue = "false")
+ private boolean jwtAllowMissingIssuerAndAudience;
Review Comment:
Done — same annotation applied to the flag in HttpManagementServerConfigurationProperties, matching devConsoleEnabled/uploadEnabled/etc.\n\n_Claude Code on behalf of Andrea Cosentino (@oscerd)._
##########
components/camel-platform-http-main/src/test/java/org/apache/camel/component/platform/http/main/authentication/JWTIssuerAudienceRequiredMainHttpServerTest.java:
##########
@@ -0,0 +1,132 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.platform.http.main.authentication;
+
+import io.vertx.core.Vertx;
+import io.vertx.core.json.JsonObject;
+import io.vertx.ext.auth.JWTOptions;
+import io.vertx.ext.auth.jwt.JWTAuth;
+import io.vertx.ext.auth.jwt.JWTAuthOptions;
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.main.HttpManagementServerConfigurationProperties;
+import org.apache.camel.main.HttpServerConfigurationProperties;
+import org.apache.camel.main.Main;
+import org.apache.camel.test.AvailablePortFinder;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import static io.restassured.RestAssured.given;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/**
+ * A JWT authenticator built without an issuer or an audience only verifies the token signature and the exp/nbf claims,
+ * so the embedded server refuses to start in that configuration unless the opt-out is set.
+ */
+class JWTIssuerAudienceRequiredMainHttpServerTest {
+
+ @RegisterExtension
+ static AvailablePortFinder.Port port = AvailablePortFinder.find();
+
+ @Test
+ void serverFailsToStartWithoutIssuerOrAudience() {
+ Main main = MainHttpServerAuthenticationTestSupport.createMain(
+ "jwt-auth-no-issuer-audience.properties", port, new PlatformHttpRouteBuilder());
+ try {
+ assertThatThrownBy(main::start)
+ .isInstanceOf(IllegalArgumentException.class)
+ .hasMessageContaining("camel.server.jwtIssuer")
+ .hasMessageContaining("camel.server.jwtAudience")
+ .hasMessageContaining("camel.server.jwtAllowMissingIssuerAndAudience");
+ } finally {
+ MainHttpServerAuthenticationTestSupport.stopMain(main);
+ }
+ }
+
+ @Test
+ void optOutStartsAndValidatesSignatureAndExpiryOnly() {
+ // jwt-auth.properties sets jwtAllowMissingIssuerAndAudience=true
+ Main main = MainHttpServerAuthenticationTestSupport.createMain(
+ "jwt-auth.properties", port, new PlatformHttpRouteBuilder());
+ try {
+ main.start();
+
Review Comment:
Done — the test now uses a single shared private static final Vertx VERTX = Vertx.vertx() closed in @AfterAll, so it no longer leaks event-loop threads.\n\n_Claude Code on behalf of Andrea Cosentino (@oscerd)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org