davsclaus commented on code in PR #28155:
URL: https://github.com/apache/camel/pull/28155#discussion_r4324151953
##########
components/camel-ai/camel-a2a/src/main/java/org/apache/camel/component/a2a/auth/A2AUserProfile.java:
##########
@@ -119,14 +122,43 @@ public Map<String, Object> asMap() {
return Collections.unmodifiableMap(map);
}
+ /**
+ * The key of the caller that owns the tasks it creates. A validated token
is keyed by its subject or, for a token
+ * without a subject, by the client it was issued to (the {@code
client_id} or {@code azp} claim). A profile without
+ * a token, such as one of an API key, is keyed by its scheme, which every
caller with that credential shares.
+ */
public String ownerKey() {
- if (issuer != null || subject != null) {
- return String.valueOf(issuer) + "|" + String.valueOf(subject);
+ if (hasSubject()) {
+ return issuer + "|" + subject;
+ }
+ String client = clientId();
Review Comment:
Non-blocking: falling back to `client_id`/`azp` is right for client
credentials tokens, where the client is the caller. For RFC 7662 introspection,
though, `sub` is optional even for a user token
(`DefaultOAuthTokenValidationFactory.introspectToken` reads it with
`readOptionalString`). Such a response usually carries `username` and
`client_id`. All users of the same client would then share one owner key and
see each other's tasks. That is still much better than the shared
`<issuer>|null` key before this PR. Should a token with a `username` claim be
keyed by it (or rejected) instead of by its client? Otherwise, maybe the Caller
Profile section could say that tokens without `sub` are keyed per client.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
