153 lines
6 KiB
Text
153 lines
6 KiB
Text
[[_fuse_adapter_camel]]
|
|
|
|
===== Securing an Apache Camel Application
|
|
|
|
You can secure Apache Camel endpoints implemented with the http://camel.apache.org/jetty.html[camel-jetty] component by adding securityHandler with `KeycloakJettyAuthenticator` and the proper security constraints injected. You can add the `OSGI-INF/blueprint/blueprint.xml` file to your Camel application with a similar configuration as below. The roles, security constraint mappings, and {project_name} adapter configuration might differ slightly depending on your environment and needs.
|
|
|
|
For example:
|
|
|
|
[source,xml]
|
|
----
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns:camel="http://camel.apache.org/schema/blueprint"
|
|
xsi:schemaLocation="
|
|
http://www.osgi.org/xmlns/blueprint/v1.0.0 http://www.osgi.org/xmlns/blueprint/v1.0.0/blueprint.xsd
|
|
http://camel.apache.org/schema/blueprint http://camel.apache.org/schema/blueprint/camel-blueprint.xsd">
|
|
|
|
<bean id="kcAdapterConfig" class="org.keycloak.representations.adapters.config.AdapterConfig">
|
|
<property name="realm" value="demo"/>
|
|
<property name="resource" value="admin-camel-endpoint"/>
|
|
<property name="bearerOnly" value="true"/>
|
|
<property name="authServerUrl" value="http://localhost:8080/auth" />
|
|
<property name="sslRequired" value="EXTERNAL"/>
|
|
</bean>
|
|
|
|
<bean id="keycloakAuthenticator" class="org.keycloak.adapters.jetty.KeycloakJettyAuthenticator">
|
|
<property name="adapterConfig" ref="kcAdapterConfig"/>
|
|
</bean>
|
|
|
|
<bean id="constraint" class="org.eclipse.jetty.util.security.Constraint">
|
|
<property name="name" value="Customers"/>
|
|
<property name="roles">
|
|
<list>
|
|
<value>admin</value>
|
|
</list>
|
|
</property>
|
|
<property name="authenticate" value="true"/>
|
|
<property name="dataConstraint" value="0"/>
|
|
</bean>
|
|
|
|
<bean id="constraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
|
|
<property name="constraint" ref="constraint"/>
|
|
<property name="pathSpec" value="/*"/>
|
|
</bean>
|
|
|
|
<bean id="securityHandler" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
|
|
<property name="authenticator" ref="keycloakAuthenticator" />
|
|
<property name="constraintMappings">
|
|
<list>
|
|
<ref component-id="constraintMapping" />
|
|
</list>
|
|
</property>
|
|
<property name="authMethod" value="BASIC"/>
|
|
<property name="realmName" value="does-not-matter"/>
|
|
</bean>
|
|
|
|
<bean id="sessionHandler" class="org.keycloak.adapters.jetty.spi.WrappingSessionHandler">
|
|
<property name="handler" ref="securityHandler" />
|
|
</bean>
|
|
|
|
<bean id="helloProcessor" class="org.keycloak.example.CamelHelloProcessor" />
|
|
|
|
<camelContext id="blueprintContext"
|
|
trace="false"
|
|
xmlns="http://camel.apache.org/schema/blueprint">
|
|
<route id="httpBridge">
|
|
<from uri="jetty:http://0.0.0.0:8383/admin-camel-endpoint?handlers=sessionHandler&matchOnUriPrefix=true" />
|
|
<process ref="helloProcessor" />
|
|
<log message="The message from camel endpoint contains ${body}"/>
|
|
</route>
|
|
</camelContext>
|
|
|
|
</blueprint>
|
|
----
|
|
|
|
|
|
* The `Import-Package` in `META-INF/MANIFEST.MF` needs to contain these imports:
|
|
|
|
[source, subs="attributes"]
|
|
----
|
|
javax.servlet;version="[3,4)",
|
|
javax.servlet.http;version="[3,4)",
|
|
org.apache.camel.*,
|
|
org.apache.camel;version="[2.13,3)",
|
|
org.eclipse.jetty.security;version="[8,10)",
|
|
org.eclipse.jetty.server.nio;version="[8,10)",
|
|
org.eclipse.jetty.util.security;version="[8,10)",
|
|
org.keycloak.*;version="{project_versionMvn}",
|
|
org.osgi.service.blueprint,
|
|
org.osgi.service.blueprint.container,
|
|
org.osgi.service.event,
|
|
----
|
|
|
|
===== Camel RestDSL
|
|
|
|
Camel RestDSL is a Camel feature used to define your REST endpoints in a fluent way. But you must still use specific implementation classes and provide instructions on how to integrate with {project_name}.
|
|
|
|
The way to configure the integration mechanism depends on the Camel component for which you configure your RestDSL-defined routes.
|
|
|
|
The following example shows how to configure integration using the Jetty component, with references to some of the beans defined in previous Blueprint example.
|
|
|
|
[source,xml]
|
|
----
|
|
<bean id="securityHandlerRest" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
|
|
<property name="authenticator" ref="keycloakAuthenticator" />
|
|
<property name="constraintMappings">
|
|
<list>
|
|
<ref component-id="constraintMapping" />
|
|
</list>
|
|
</property>
|
|
<property name="authMethod" value="BASIC"/>
|
|
<property name="realmName" value="does-not-matter"/>
|
|
</bean>
|
|
|
|
<bean id="sessionHandlerRest" class="org.keycloak.adapters.jetty.spi.WrappingSessionHandler">
|
|
<property name="handler" ref="securityHandlerRest" />
|
|
</bean>
|
|
|
|
|
|
<camelContext id="blueprintContext"
|
|
trace="false"
|
|
xmlns="http://camel.apache.org/schema/blueprint">
|
|
|
|
<restConfiguration component="jetty" contextPath="/restdsl"
|
|
port="8484">
|
|
<!--the link with Keycloak security handlers happens here-->
|
|
<endpointProperty key="handlers" value="sessionHandlerRest"></endpointProperty>
|
|
<endpointProperty key="matchOnUriPrefix" value="true"></endpointProperty>
|
|
</restConfiguration>
|
|
|
|
<rest path="/hello" >
|
|
<description>Hello rest service</description>
|
|
<get uri="/{id}" outType="java.lang.String">
|
|
<description>Just an helllo</description>
|
|
<to uri="direct:justDirect" />
|
|
</get>
|
|
|
|
</rest>
|
|
|
|
<route id="justDirect">
|
|
<from uri="direct:justDirect"/>
|
|
<process ref="helloProcessor" />
|
|
<log message="RestDSL correctly invoked ${body}"/>
|
|
<setBody>
|
|
<constant>(__This second sentence is returned from a Camel RestDSL endpoint__)</constant>
|
|
</setBody>
|
|
</route>
|
|
|
|
</camelContext>
|
|
|
|
----
|