[jira] [Resolved] (CAMEL-24281) camel-platform-http-main: fail closed when JWT authentication is enabled without an issuer or audience

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24281?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino resolved CAMEL-24281.
--------------------------------------
    Resolution: Fixed

Fixed on main via PR https://github.com/apache/camel/pull/25187. Platform-http-main JWT authentication now fails closed when the token has no issuer/audience and validation is configured; the opt-out flag jwtAllowMissingIssuerAndAudience (marked security=insecure:dev) restores the previous accept-signature-and-expiry-only behavior. Main-only (4.22.0) as it changes a security default.

_Claude Code on behalf of Andrea Cosentino (@oscerd)._

> camel-platform-http-main: fail closed when JWT authentication is enabled without an issuer or audience
> ------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24281
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24281
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-platform-http
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.22.0
>
>
> When JWT authentication is enabled on the camel-main embedded HTTP server, {{JWTAuthenticationConfigurer.buildJwtOptions(...)}} returns {{null}} if neither {{jwtIssuer}} nor {{jwtAudience}} is configured, and the caller then skips {{JWTAuthOptions.setJWTOptions(...)}}. The resulting Vert.x {{JWTAuth}} is built from the keystore alone, so only the token signature and the {{exp}} / {{nbf}} claims are enforced and the {{iss}} and {{aud}} claims are not.
> Nothing signals this to the user: the setup completes normally and the server starts, so a deployment that configures JWT authentication the documented way can be enforcing less than intended.
> Proposal: fail closed at startup when a JWT keystore is configured but neither {{jwtIssuer}} nor {{jwtAudience}} is set, with an explicit opt-out for deployments that genuinely want signature and expiry only validation. The check must be applied to both overloads of {{configureAuthentication}}, since the application server and the management server share this configurer.
> This aligns the embedded server with the posture already used by {{camel-oauth}}, where {{DefaultOAuthTokenValidationFactory.validateResolvedConfiguration}} refuses to operate unless an expected audience and issuer are configured ({{allow-missing-audience}} and {{allow-missing-issuer}} both default to {{false}}).
> Notes:
> * {{jwtIssuer}} and {{jwtAudience}} were added in 4.21.0 by CAMEL-23525, so this only applies to branches that have those options.
> * Add tests covering the fail-closed path and the opt-out, and an upgrade-guide note, since this changes startup behaviour for an existing configuration.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)