[backport camel-4.14.x] CAMEL-23525: Add optional JWT issuer and audience claim validation - #25196
Merged
Merged
Conversation
Backport of 010bcd5 to camel-4.14.x. Adds jwtIssuer and jwtAudience to the embedded HTTP server and the management server. When either is set, a JWTOptions configured with the corresponding values is attached to the JWTAuthOptions passed to JWTAuth.create, so the iss and aud claims are validated in addition to the signature and expiry. jwtAudience accepts a comma-separated list; a token is accepted if its aud claim matches any configured value. Behaviour is unchanged when both are unset, so this is additive: existing configurations continue to build the authenticator exactly as before. The upgrade-guide entry from the original commit is omitted, since the options are purely additive on this branch and the guide is for migration concerns. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
oscerd
force-pushed
the
backport/CAMEL-23525-4.14.x
branch
from
July 28, 2026 12:25
fc64ab1 to
13200da
Compare
davsclaus
approved these changes
Jul 28, 2026
The committed catalog copy of camel-main-configuration-metadata.json carried main-only entries not present on camel-4.14.x (camel.security / SecurityConfigurationProperties, errorRegistryEnabled/errorRegistryMaximumEntries, the security="insecure:dev" attribute, and json/png route-dump options), picked up from a main-built camel-main artifact during an earlier regeneration. Regenerate the catalog copy from this branch's camel-main so it matches the module's generated metadata, which is what CI reproduces — fixing the "uncommitted changes" failure. The CAMEL-23525 jwtIssuer/jwtAudience options remain. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of
010bcd575ebd(originally #23389) tocamel-4.14.x(→ 4.14.9).Adds
jwtIssuerandjwtAudienceto the embedded HTTP server and the management server. When either is set, aJWTOptionscarrying those values is attached to theJWTAuthOptionspassed toJWTAuth.create, so theissandaudclaims are validated in addition to the signature and the expiry.jwtAudienceaccepts a comma-separated list and a token is accepted if itsaudclaim matches any configured value.Why on a maintenance branch
Without these options a JWT authenticator on this branch validates the signature and expiry only, and there is no configuration that changes that. This backport gives operators on 4.14.9 a way to constrain which issuer and audience are accepted. The related fail-closed change (CAMEL-24281, #25187) is deliberately not backported, since it would be a startup-breaking change here.
Compatibility
Additive only. Both options default to
null,buildJwtOptionsreturnsnullwhen both are empty, and the caller then skipssetJWTOptions, so an existing configuration builds the authenticator exactly as before. The new methods onHttpServerConfigurationPropertiesandHttpManagementServerConfigurationPropertiesare additive and binary compatible.The pre-existing keystore-only
JWTAuthenticationMainHttpServerTestpasses unchanged on this branch, which is the compatibility check that matters here.Notes
Claude Code on behalf of oscerd