A high-security API management infrastructure using Apache Camel
summary
Shows a working API management stack built from Apache Camel plus Keycloak that fixes three concrete security gaps: minimal token validation, no per-API access management, and stolen-token replay. Implements token introspection by calling Keycloak’s introspection endpoint via Camel’s http4 component, enforces scope check with custom Camel processors, and validates client binding with OAuth MTLS using the x5t#S256 hash in tokens. Tested end-to-end and returns 401/403 on invalid or unauthorized requests.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:12Contents
- 3:14Chapter 2 Drawbacks
- 6:15Chapter 3 Security enhancements
- 7:04Token introspection
- 9:39Implement token introspection
- 12:39OSMTLS
- 16:41Conclusion
- 17:16Questions
- 20:08Answers
related talks
31mHigh-level API Security
27mDesigning an Agentic AI-Ready Secure Authentication and Authorization Platform
53mCommon API Security Pitfalls
45mAPI Security: Acting Now to Enable Security Controls
18mAPI Security Simplified: A 5-Pillar Approach
42mConfirming Safety of IAM Specifications and their OSS Implementations: Keycloak as a Case Study
21mDon't Be Afraid to Operate Alone! The ABCs of Authentication Infrastructure Management
17mAPI Security Simplified: Practical Tips & Tools