oscerd commented on code in PR #26435:
URL: https://github.com/apache/camel/pull/26435#discussion_r4013721761
##########
components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeConfiguration.java:
##########
@@ -66,8 +66,8 @@ public void setSpiffeSocketPath(String spiffeSocketPath) {
/**
* The comma-separated audience(s) to request for a JWT-SVID
(fetchJwtSvid) or to validate against
* (validateJwtSvid). Can be overridden per-message with the {@code
CamelSpiffeAudience} header. Note that
Review Comment:
Rebased onto main now that #26420 is in, and qualified the description as
you suggested:
> fetchJwtSvid requests all of them and can be overridden per-message with
the `CamelSpiffeAudience` header; validateJwtSvid ignores that header and uses
this configuration only, accepting the token if it matches any of the
configured audiences, trying each in turn.
The rebase conflicted on the one line both PRs touch, which was worth
resolving carefully rather than mechanically: #26420 pinned validation to
`resolveConfiguredAudiences()[0]`, this PR looped `resolveAudiences(exchange)`.
Taking either side alone would have lost something — the first drops the
multi-audience fix, the second reintroduces the header override. The resolution
loops `resolveConfiguredAudiences()`, so the audience list is honoured in full
and still comes from the configuration only.
_Claude Code on behalf of @oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
