Interface OAuthTokenValidationFactory

public interface OAuthTokenValidationFactory
Factory for validating incoming OAuth 2.0 bearer tokens (JWT and opaque).

JWT tokens are validated locally via JWKS (signature, expiry, audience, issuer). Opaque tokens are validated via RFC 7662 introspection.

The camel-oauth component provides the default implementation. Runtime-specific integrations can provide their own implementation backed by their native security stack.

Implementations that call identity-provider infrastructure, such as OIDC discovery, JWKS endpoints, or RFC 7662 introspection endpoints, should apply bounded connect/read timeouts and avoid unbounded blocking in request-processing paths.

Since:
4.21

  • Field Details

  • Method Details

    • validateToken

      OAuthTokenValidationResult validateToken(OAuthTokenValidationConfig config, String token)
      Validates a bearer token using explicit configuration.

      The error contract distinguishes three failure modes:

      Callers integrating at an HTTP boundary should catch all exceptions and map them to an appropriate HTTP status (401 for validation, 503 for infrastructure).
      Parameters:
      config - the token validation configuration
      token - the bearer token string to validate
      Returns:
      the validation result (never null)
      Throws:
      IllegalArgumentException - if required configuration is missing
      Since:
      4.21

    • validateToken

      default OAuthTokenValidationResult validateToken(CamelContext context, String profileName, String token)
      Validates a bearer token using a named profile from Camel properties.

      Properties are resolved from camel.oauth.<profileName>.*:

      • camel.oauth.<profileName>.base-uri — base URL for OIDC auto-discovery from /.well-known/openid-configuration
      • camel.oauth.<profileName>.jwks-endpoint — JWKS URL for JWT validation
      • camel.oauth.<profileName>.introspection-endpoint — RFC 7662 introspection URL for opaque tokens
      • camel.oauth.<profileName>.introspection-client-id — client ID for introspection; falls back to client-id
      • camel.oauth.<profileName>.introspection-client-secret — client secret for introspection; falls back to client-secret
      • camel.oauth.<profileName>.expected-issuer — expected issuer claim
      • camel.oauth.<profileName>.expected-audience — comma-separated accepted audience claim values
      • camel.oauth.<profileName>.expected-token-type — expected JWT typ header, for example at+jwt
      • camel.oauth.<profileName>.clock-skew-seconds — clock skew leeway in seconds (default: 0)
      • camel.oauth.<profileName>.jwks-cache-ttl-seconds — JWKS cache TTL in seconds (default: 600)
      • camel.oauth.<profileName>.oidc-discovery-cache-ttl-seconds — OIDC discovery cache TTL in seconds (default: 600)
      • camel.oauth.<profileName>.connect-timeout-seconds — outbound HTTP connect timeout in seconds (default: 5)
      • camel.oauth.<profileName>.read-timeout-seconds — outbound HTTP read timeout in seconds (default: 10)
      • camel.oauth.<profileName>.require-expiration — whether JWTs must contain exp (default: true)
      • camel.oauth.<profileName>.allowed-jws-algorithms — comma-separated JWS algorithm allowlist
      • camel.oauth.<profileName>.allow-missing-audience — opt out of requiring an expected audience (default: false)
      • camel.oauth.<profileName>.allow-missing-issuer — opt out of requiring an expected issuer (default: false)
      • camel.oauth.<profileName>.allow-insecure-http — allow plain HTTP IdP endpoints for local development (default: false)
      Opaque-token introspection requires an introspection endpoint and client credentials, either through introspection-client-id/introspection-client-secret or the client-id/client-secret fallback properties.
      Parameters:
      context - the CamelContext to resolve properties from
      profileName - the named profile (e.g., "keycloak", "azure")
      token - the bearer token string to validate
      Returns:
      the validation result (never null)
      Throws:
      RuntimeException - if required properties are missing or an infrastructure error occurs
      Since:
      4.21

    • validateToken

      default OAuthTokenValidationResult validateToken(CamelContext context, String token)
      Validates a bearer token using the default (unnamed) profile.

      Properties are resolved from camel.oauth.* directly (backward compatible with existing single-IdP configuration).

      Parameters:
      context - the CamelContext to resolve properties from
      token - the bearer token string to validate
      Returns:
      the validation result (never null)
      Throws:
      RuntimeException - if required properties are missing or an infrastructure error occurs
      Since:
      4.21

    • validateConfiguration

      void validateConfiguration(OAuthTokenValidationConfig config)
      Validates explicit token validation configuration without validating a token.

      Implementations should fail fast for static configuration errors such as missing endpoints, missing client credentials, insecure endpoint URLs, or missing expected issuer/audience policy.

      Parameters:
      config - the token validation configuration
      Throws:
      IllegalArgumentException - if required configuration is missing or invalid
      Since:
      4.21

    • validateConfiguration

      default void validateConfiguration(CamelContext context, String profileName)
      Validates a named token validation profile without validating a token.
      Parameters:
      context - the CamelContext to resolve properties from
      profileName - the named profile
      Throws:
      IllegalArgumentException - if required profile configuration is missing or invalid
      Since:
      4.21

    • validateConfiguration

      default void validateConfiguration(CamelContext context)
      Validates the default token validation profile without validating a token.
      Parameters:
      context - the CamelContext to resolve properties from
      Throws:
      IllegalArgumentException - if required profile configuration is missing or invalid
      Since:
      4.21