Add support for secondary auth in IdentityCredentials

[potto007]

WIP: exploring how to add Secondary Credentials support in the least obtrusive manner

[andrewpmartinez]

Can you elaborate on your use case? Are you trying to figure out how to authenticate w/ certificates and also provide a JWT? (I mention this because this is the only case that would need a primary auth w/ a secondary).

[potto007]

Can you elaborate on your use case? Are you trying to figure out how to authenticate w/ certificates and also provide a JWT? (I mention this because this is the only case that would need a primary auth w/ a secondary).

Hey @andrewpmartinez - yes, I am finishing up making authentication with primary and secondary work when secondary is an external jwt. I tested it against the Controller several weeks ago using Postman, and verified that the auth works when using a cert identity along with a JWT bearer on every request.

I realized I went a bit too far on this new type, and I'm pairing it down to just augment IdentityCredentials to include a JWT field.

[potto007]

Cleaning up, removing the custom type and instead overloading the IdentityCredentials type with optional JWT header support.

[potto007]

This update to sdk-golang now simply adds to the IdentityCredentials type. An example of its use can be seen in the zssh PR I made: openziti-test-kitchen/zssh#31

The existing functionality in Edge is such that, at the end of the cert auth method is processing, the code checks for an auth policy, and if the auth policy has external JWT as a secondary auth, it goes on to check for a token in the header, validates it, and succeeds if everything is in order.

[andrewpmartinez]

I think this would be better as an improvement to BaseCredentials instead and de-JWT'ed. Rather add a Headers map[string][]string{}. Then augment the BaseCredentials.AuthenticateRequest to apply those headers to the runtime.ClientRequest. Then alter all the other credentials first to call self.BaseCredentials.AuthenticateRequest(cr, r) so that their own logic applies afterward. The existing JWT authenticator can instead set the underlying headers field.

The result is that credentials instantiations can do something like:

jwtStr := getJwt()
cred := NewIdentityCrednetialFromConfig(config)
cred.Headers["authorization"][]string{"Bearter " + jwtStr}

...or any other header that comes along.

Reasoning:

1. Placing the functionality here limits the applicability to other cred mechanisms
2. Other authentication mechanisms are coming that are not JWTs but have header implications

[potto007]

That would be so much nicer! I'll give that a shot.

[potto007]

@andrewpmartinez I've refactored credentials.go based on your review.

[andrewpmartinez]

Gonna look at this today.

[andrewpmartinez]

See comments.

[potto007]

@andrewpmartinez any thoughts?