How to secure rest endpoint built in the integration?

[dpalinic]

Hello,

We've build some test endpoints, and we're trying to secure them by either basic auth or api key. We can see some options regarding the security in the Karavan, but whatever we do, endpoints are not secured.

Example:

Can you please guide us on how this is intended to be used? How we can enable basic auth for our endpoints?

Thanks

[mgubaidullin]

Camel REST DSL itself does not have these features. Karavan is just a Visual DSL for Camel, so it provides the same functionality.

[davsclaus]

Just to clarify the "security" stuff in the image above is ONLY for defining the OpenAPI contract for the Rest DSL you design. Camel Rest DSL has the capability to generate a swagger doc (openapi spec) from Camel (code first).

Any kind of actual security is configured in the embedded HTTP server you use (spring boot http server, quarkus http server etc). How to do that, you look at their docs.

There is a Camel SB ssl example at
https://github.com/apache/camel-spring-boot-examples/tree/main/http-ssl

[dpalinic]

Thank you for sharing additional resources.

[mgubaidullin]

If you're looking for out-of-the-box REST API authentication and authorization, consider exploring the Talisman Platform. It comes with an API Gateway (built using the platform) that provides JWT support (generation, authentication, authorization) along with API user management capabilities.

[dpalinic]

Thank you. We'll take a look.

[dpalinic]

@mgubaidullin @davsclaus thanks for your help so far. It looks like Karavan is using platform-http as per default. I've found following guide on how to secure endpoints: https://camel.apache.org/components/4.4.x/others/platform-http-vertx.html#_vertxplatformhttpserver

Do you know where should we put that configuration in Karavan integrations?

Thanks

[davsclaus]

If you run on Spring Boot or Quarkus you just configure these, alot can be configured in application.properties

[dpalinic]

I tried to switch to quarkus or spring-boot but project won't build anymore. It's clean project without anything except one rest endpoint:
[ERROR] No plugin found for prefix 'jib' in the current project and in the plugin groups [org.apache.maven.plugins, org.codehaus.mojo] available from the repositories [local (/karavan/.m2/repository), central (https://repo.maven.apache.org/maven2)] -> [Help 1]

I tried setting this one in application.properties

camel.jbang.runtime=spring-boot
or
camel.jbang.runtime=quarkus

If I return back to camel-main then it builds fine.

[davsclaus]

You need to do all of that SB/Q supports yourself - karavan is OOTB camel-main only.
And it sounds like you use the web version and not just the VSCode plugin.

For the web then talisman offers a full OOTB experience that is ready for companies to use.

[dpalinic]

I see... Thanks for the information. Regards