oscerd opened a new pull request, #28155:
URL: https://github.com/apache/camel/pull/28155
The A2A consumer validates the security schemes that the agent card declares
and builds the caller profile that it
gives to the route as the `CamelA2AUserProfile` exchange property. The task
operations use the same profile to know
which caller owns a task. This PR improves how the profile is derived:
- **Several schemes in one requirement.** `A2AAuthHandler.selectProfile`
kept the profile of the first scheme, so a
requirement such as `{apiKey, oauth2}` that listed the API key first gave
the route `{"scheme": "apiKey"}`, and the
tasks belonged to the API key rather than to the caller of the token. The
profile that identifies the caller (a
validated token) is now kept whatever the order of the schemes; the
profile of an API key or a static bearer token
only names its scheme.
- **Tokens without `sub`.** `A2AUserProfile.ownerKey()` built the key from
the issuer and the subject, so every caller
with a valid token without `sub` (client credentials tokens of some
identity providers, RFC 7662 introspection) got
the same `<issuer>|null` key. Such a token is now identified by its
`client_id` or `azp` claim (RFC 9068 / OpenID
Connect). A valid token with none of these claims is rejected, rather than
given a key that other callers share.
- **`CamelOAuthTokenValidationResult`.** The validation result was only set
on the incoming HTTP exchange; it is now
also set on the exchange that the route processes, as `a2a-consumer.adoc`
describes (new
`A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT`).
### Docs
- `a2a-consumer.adoc`: a "Caller Profile" section describing the profile of
each scheme type, requirements with several
schemes, and task ownership.
- Upgrade guide notes: 4.24, plus 4.22.3 on `main` for the backport
(`camel-a2a` is not on `camel-4.18.x`).
### Tests
- `A2AAuthHandlerTest`: the token profile is kept with the API key listed
first or second (the API key profile was
kept without the fix); tokens without `sub` are keyed by `client_id` and
by `azp`; a token without `sub`,
`client_id` or `azp` is rejected (accepted without the fix).
- `A2AConsumerCallerProfileTest`: the route receives
`CamelOAuthTokenValidationResult` (null without the fix); the tasks
of two clients with tokens without `sub` are listed separately (each saw
both without the fix).
- `camel-a2a`: 524 tests, 0 failures.
- Full reactor `mvn clean install -DskipTests -DskipITs`: 706/706, only the
expected regenerated file (the catalog copy
of `a2a-consumer.adoc`).
A backport to `camel-4.22.x` will follow once this is merged.
JIRA: https://issues.apache.org/jira/browse/CAMEL-25458
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
