[
https://issues.apache.org/jira/browse/CAMEL-26562?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137902#comment-18137902
]
Claus Ibsen commented on CAMEL-26562:
-------------------------------------
Merged via https://github.com/apache/camel/pull/29145 (commit
cb46185aab94ba28b38176383862df1410bc22d5).
_Claude Code on behalf of davsclaus_
> camel-opa, camel-openfga - let the security policies use the global SSL
> context
> -------------------------------------------------------------------------------
>
> Key: CAMEL-26562
> URL: https://issues.apache.org/jira/browse/CAMEL-26562
> Project: Camel
> Issue Type: Improvement
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.24.0
>
>
> Found while checking how well the camel-opa and camel-openfga configuration
> can be written in YAML.
> h4. What happens
> The {{opa}} and {{openfga}} components have
> {{useGlobalSslContextParameters}}: an endpoint without its own
> {{sslContextParameters}} then uses the context-wide {{SSLContextParameters}},
> the one camel-main builds from {{camel.ssl.*}}. {{OpaSecurityPolicy}} and
> {{OpenFgaSecurityPolicy}} have no such option and ignore the component's, so
> a policy that must reach a TLS-protected OPA or OpenFGA server needs an
> {{SSLContextParameters}} bean of its own, even when the global one is exactly
> what it should use. In YAML that means repeating the key store and trust
> store configuration as a nested bean.
> The {{setSslContextParameters}} javadoc of both policies says the global
> context "cannot be resolved automatically" because the policy is not bound to
> a component instance. The policy does have the {{CamelContext}} where it
> matters: {{beforeWrap}} takes it from the route and builds the {{SSLContext}}
> there.
> h4. Proposed fix
> Add {{useGlobalSslContextParameters}} (default {{false}}) to both policies,
> with the endpoints' precedence: an explicit {{sslContextParameters}} wins;
> otherwise the context's global {{SSLContextParameters}} when the option is
> on; otherwise the JVM default, as today. Update both component pages, which
> today say the component option has no effect on the policy. In {{wasm}} mode
> the OPA policy talks to no server, so the option is ignored there, like
> {{sslContextParameters}}.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
