ramu11 opened a new pull request, #29592:
URL: https://github.com/apache/camel/pull/29592
## CAMEL-26356: Add OAuth support and RFC 9728 metadata to MCP server
### Motivation
Add OAuth 2.0 bearer-token authentication support to the Camel MCP HTTP
server, enabling MCP clients to authenticate using tokens issued by an external
Authorization Server.
The implementation supports protected-resource metadata discovery according
to RFC 9728 and validates incoming tokens using Camel's OAuth infrastructure.
### Changes
- **OAuth authentication**
- Add configurable OAuth profile support through
`camel.server.mcp-oauth-profile`.
- Support JWT validation using OIDC discovery/JWKS and opaque-token
validation using token introspection.
- Validate token signature, issuer, audience, expiration, not-before and
configured signing algorithms.
- Support required MCP scopes through `camel.server.mcp-required-scopes`.
- Support scope extraction from both `scope` and `scp` claims.
- **RFC 9728 protected-resource metadata**
- Add the protected-resource metadata endpoint.
- Require an explicit public resource URI through
`camel.server.mcp-resource-uri`.
- Advertise the configured Authorization Server and supported bearer-token
authentication method.
- Avoid trusting incoming `Host` and `X-Forwarded-*` headers when
determining the public resource URI.
- **Authentication and error handling**
- Return HTTP 401 with a `WWW-Authenticate` challenge for missing or
invalid bearer tokens.
- Return HTTP 403 for insufficient scopes.
- Return HTTP 503 when the Authorization Server is unavailable or token
validation encounters an infrastructure failure.
- Avoid exposing tokens, secrets or internal validation details in
authentication responses.
- **Identity propagation**
- Propagate the authenticated subject, principal name, roles, scopes and
token claims through `McpToolCallContext` and Camel exchange properties.
- **Configuration and compatibility**
- Validate OAuth configuration during MCP server startup.
- Publish protected-resource metadata only when OAuth is configured.
- Ignore OAuth settings for stdio transport, with an appropriate warning.
- Add configuration documentation and tests.
### Tests
Add unit tests and real Keycloak integration tests using Camel Test Infra
Keycloak and the production OAuth token-validation implementation.
Coverage includes:
- Successful JWT authentication and identity propagation.
- Missing, invalid, tampered and expired tokens.
- Invalid issuer, audience and signing algorithm.
- Required-scope enforcement and `scope` / `scp` claim handling.
- Keycloak token introspection for active and inactive tokens.
- RFC 9728 metadata and forwarded-header spoofing.
- Startup configuration validation and unreachable Authorization Server.
- HTTP 503 handling for introspection infrastructure failures.
- Security-sensitive response information leakage.
**Validation results:**
- MCP Server unit tests: 106 passed.
- Keycloak OAuth integration tests: 16 passed.
- Total: 122 tests passed, 0 failures, 0 errors.
Commands executed:
```bash
mvn -pl components/camel-ai/camel-mcp-server \
-Dit.test=McpServerMainOAuthKeycloakIT verify
mvn -pl components/camel-ai/camel-mcp-server \
-DskipTests=false -DskipITs=true test
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
