adds /identity/:id/authenticators Management API endpoint

controller/internal/routes/identity_api_model.go

@@ -57,6 +57,7 @@ func (factory *IdentityLinkFactoryImpl) Links(entity models.Entity) rest_model.L
 	links[EntityNameServicePolicy] = factory.NewNestedLink(entity, EntityNameServicePolicy)
 	links[EntityNamePostureData] = factory.NewNestedLink(entity, EntityNamePostureData)
 	links[EntityNameFailedServiceRequest] = factory.NewNestedLink(entity, EntityNameFailedServiceRequest)
+	links[EntityNameAuthenticator] = factory.NewNestedLink(entity, EntityNameAuthenticator)
 
 	return links
 }

controller/internal/routes/identity_router.go

@@ -81,6 +81,11 @@ func (r *IdentityRouter) Register(ae *env.AppEnv) {
 		return ae.IsAllowed(func(ae *env.AppEnv, rc *response.RequestContext) { r.Patch(ae, rc, params) }, params.HTTPRequest, params.ID, "", permissions.IsAdmin())
 	})
 
+	// authenticators list
+	ae.ManagementApi.IdentityGetIdentityAuthenticatorsHandler = identity.GetIdentityAuthenticatorsHandlerFunc(func(params identity.GetIdentityAuthenticatorsParams, _ interface{}) middleware.Responder {
+		return ae.IsAllowed(r.listAuthenticators, params.HTTPRequest, params.ID, "", permissions.IsAdmin())
+	})
+
 	// edge router policies list
 	ae.ManagementApi.IdentityListIdentitysEdgeRouterPoliciesHandler = identity.ListIdentitysEdgeRouterPoliciesHandlerFunc(func(params identity.ListIdentitysEdgeRouterPoliciesParams, _ interface{}) middleware.Responder {
 		return ae.IsAllowed(r.listEdgeRouterPolicies, params.HTTPRequest, params.ID, "", permissions.IsAdmin())
@@ -215,6 +220,11 @@ func (r *IdentityRouter) listServices(ae *env.AppEnv, rc *response.RequestContex
 	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Handlers.EdgeService, MapServiceToRestEntity)
 }
 
+func (r *IdentityRouter) listAuthenticators(ae *env.AppEnv, rc *response.RequestContext) {
+	filterTemplate := `identity = "%v"`
+	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Handlers.Authenticator, MapAuthenticatorToRestEntity)
+}
+
 func (r *IdentityRouter) listEdgeRouters(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `not isEmpty(from edgeRouterPolicies where anyOf(identities) = "%v")`
 	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Handlers.EdgeRouter, MapEdgeRouterToRestEntity)

rest_management_api_client/identity/get_identity_authenticators_parameters.go

@@ -0,0 +1,173 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package identity
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewGetIdentityAuthenticatorsParams creates a new GetIdentityAuthenticatorsParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewGetIdentityAuthenticatorsParams() *GetIdentityAuthenticatorsParams {
+	return &GetIdentityAuthenticatorsParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewGetIdentityAuthenticatorsParamsWithTimeout creates a new GetIdentityAuthenticatorsParams object
+// with the ability to set a timeout on a request.
+func NewGetIdentityAuthenticatorsParamsWithTimeout(timeout time.Duration) *GetIdentityAuthenticatorsParams {
+	return &GetIdentityAuthenticatorsParams{
+		timeout: timeout,
+	}
+}
+
+// NewGetIdentityAuthenticatorsParamsWithContext creates a new GetIdentityAuthenticatorsParams object
+// with the ability to set a context for a request.
+func NewGetIdentityAuthenticatorsParamsWithContext(ctx context.Context) *GetIdentityAuthenticatorsParams {
+	return &GetIdentityAuthenticatorsParams{
+		Context: ctx,
+	}
+}
+
+// NewGetIdentityAuthenticatorsParamsWithHTTPClient creates a new GetIdentityAuthenticatorsParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewGetIdentityAuthenticatorsParamsWithHTTPClient(client *http.Client) *GetIdentityAuthenticatorsParams {
+	return &GetIdentityAuthenticatorsParams{
+		HTTPClient: client,
+	}
+}
+
+/* GetIdentityAuthenticatorsParams contains all the parameters to send to the API endpoint
+   for the get identity authenticators operation.
+
+   Typically these are written to a http.Request.
+*/
+type GetIdentityAuthenticatorsParams struct {
+
+	/* ID.
+
+	   The id of the requested resource
+	*/
+	ID string
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the get identity authenticators params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *GetIdentityAuthenticatorsParams) WithDefaults() *GetIdentityAuthenticatorsParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the get identity authenticators params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *GetIdentityAuthenticatorsParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) WithTimeout(timeout time.Duration) *GetIdentityAuthenticatorsParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) WithContext(ctx context.Context) *GetIdentityAuthenticatorsParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) WithHTTPClient(client *http.Client) *GetIdentityAuthenticatorsParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithID adds the id to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) WithID(id string) *GetIdentityAuthenticatorsParams {
+	o.SetID(id)
+	return o
+}
+
+// SetID adds the id to the get identity authenticators params
+func (o *GetIdentityAuthenticatorsParams) SetID(id string) {
+	o.ID = id
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *GetIdentityAuthenticatorsParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	// path param id
+	if err := r.SetPathParam("id", o.ID); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_management_api_client/identity/get_identity_authenticators_responses.go

@@ -0,0 +1,167 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package identity
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// GetIdentityAuthenticatorsReader is a Reader for the GetIdentityAuthenticators structure.
+type GetIdentityAuthenticatorsReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *GetIdentityAuthenticatorsReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewGetIdentityAuthenticatorsOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewGetIdentityAuthenticatorsUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 404:
+		result := NewGetIdentityAuthenticatorsNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("response status code does not match any response statuses defined for this endpoint in the swagger spec", response, response.Code())
+	}
+}
+
+// NewGetIdentityAuthenticatorsOK creates a GetIdentityAuthenticatorsOK with default headers values
+func NewGetIdentityAuthenticatorsOK() *GetIdentityAuthenticatorsOK {
+	return &GetIdentityAuthenticatorsOK{}
+}
+
+/* GetIdentityAuthenticatorsOK describes a response with status code 200, with default header values.
+
+A list of authenticators
+*/
+type GetIdentityAuthenticatorsOK struct {
+	Payload *rest_model.ListAuthenticatorsEnvelope
+}
+
+func (o *GetIdentityAuthenticatorsOK) Error() string {
+	return fmt.Sprintf("[GET /identities/{id}/authenticators][%d] getIdentityAuthenticatorsOK  %+v", 200, o.Payload)
+}
+func (o *GetIdentityAuthenticatorsOK) GetPayload() *rest_model.ListAuthenticatorsEnvelope {
+	return o.Payload
+}
+
+func (o *GetIdentityAuthenticatorsOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.ListAuthenticatorsEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewGetIdentityAuthenticatorsUnauthorized creates a GetIdentityAuthenticatorsUnauthorized with default headers values
+func NewGetIdentityAuthenticatorsUnauthorized() *GetIdentityAuthenticatorsUnauthorized {
+	return &GetIdentityAuthenticatorsUnauthorized{}
+}
+
+/* GetIdentityAuthenticatorsUnauthorized describes a response with status code 401, with default header values.
+
+The currently supplied session does not have the correct access rights to request this resource
+*/
+type GetIdentityAuthenticatorsUnauthorized struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *GetIdentityAuthenticatorsUnauthorized) Error() string {
+	return fmt.Sprintf("[GET /identities/{id}/authenticators][%d] getIdentityAuthenticatorsUnauthorized  %+v", 401, o.Payload)
+}
+func (o *GetIdentityAuthenticatorsUnauthorized) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *GetIdentityAuthenticatorsUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewGetIdentityAuthenticatorsNotFound creates a GetIdentityAuthenticatorsNotFound with default headers values
+func NewGetIdentityAuthenticatorsNotFound() *GetIdentityAuthenticatorsNotFound {
+	return &GetIdentityAuthenticatorsNotFound{}
+}
+
+/* GetIdentityAuthenticatorsNotFound describes a response with status code 404, with default header values.
+
+The requested resource does not exist
+*/
+type GetIdentityAuthenticatorsNotFound struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *GetIdentityAuthenticatorsNotFound) Error() string {
+	return fmt.Sprintf("[GET /identities/{id}/authenticators][%d] getIdentityAuthenticatorsNotFound  %+v", 404, o.Payload)
+}
+func (o *GetIdentityAuthenticatorsNotFound) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *GetIdentityAuthenticatorsNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}

rest_management_api_client/identity/identity_client.go

@@ -66,6 +66,8 @@ type ClientService interface {
 
 	DisassociateIdentitysServiceConfigs(params *DisassociateIdentitysServiceConfigsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*DisassociateIdentitysServiceConfigsOK, error)
 
+	GetIdentityAuthenticators(params *GetIdentityAuthenticatorsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*GetIdentityAuthenticatorsOK, error)
+
 	GetIdentityFailedServiceRequests(params *GetIdentityFailedServiceRequestsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*GetIdentityFailedServiceRequestsOK, error)
 
 	GetIdentityPolicyAdvice(params *GetIdentityPolicyAdviceParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*GetIdentityPolicyAdviceOK, error)
@@ -343,6 +345,48 @@ func (a *Client) DisassociateIdentitysServiceConfigs(params *DisassociateIdentit
 	panic(msg)
 }
 
+/*
+  GetIdentityAuthenticators retrieves the curent authenticators of a specific identity
+
+  Returns a list of authenticators associated to the idetity specified
+
+*/
+func (a *Client) GetIdentityAuthenticators(params *GetIdentityAuthenticatorsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*GetIdentityAuthenticatorsOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewGetIdentityAuthenticatorsParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "getIdentityAuthenticators",
+		Method:             "GET",
+		PathPattern:        "/identities/{id}/authenticators",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"https"},
+		Params:             params,
+		Reader:             &GetIdentityAuthenticatorsReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*GetIdentityAuthenticatorsOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for getIdentityAuthenticators: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
   GetIdentityFailedServiceRequests retrieves a list of the most recent service failure requests due to posture checks
 

rest_management_api_server/configure_ziti_edge_management.go

@@ -464,6 +464,11 @@ func configureAPI(api *operations.ZitiEdgeManagementAPI) http.Handler {
 			return middleware.NotImplemented("operation current_identity.GetCurrentIdentity has not yet been implemented")
 		})
 	}
+	if api.IdentityGetIdentityAuthenticatorsHandler == nil {
+		api.IdentityGetIdentityAuthenticatorsHandler = identity.GetIdentityAuthenticatorsHandlerFunc(func(params identity.GetIdentityAuthenticatorsParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation identity.GetIdentityAuthenticators has not yet been implemented")
+		})
+	}
 	if api.IdentityGetIdentityFailedServiceRequestsHandler == nil {
 		api.IdentityGetIdentityFailedServiceRequestsHandler = identity.GetIdentityFailedServiceRequestsHandlerFunc(func(params identity.GetIdentityFailedServiceRequestsParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation identity.GetIdentityFailedServiceRequests has not yet been implemented")

rest_management_api_server/embedded_spec.go

@@ -7356,6 +7356,88 @@ func init() {
         }
       ]
     },
+    "/identities/{id}/authenticators": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Returns a list of authenticators associated to the idetity specified\n",
+        "tags": [
+          "Identity"
+        ],
+        "summary": "Retrieve the curent authenticators of a specific identity",
+        "operationId": "getIdentityAuthenticators",
+        "responses": {
+          "200": {
+            "description": "A list of authenticators",
+            "schema": {
+              "$ref": "#/definitions/listAuthenticatorsEnvelope"
+            }
+          },
+          "401": {
+            "description": "The currently supplied session does not have the correct access rights to request this resource",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": "",
+                  "causeMessage": "",
+                  "code": "UNAUTHORIZED",
+                  "message": "The request could not be completed. The session is not authorized or the credentials are invalid",
+                  "requestId": "0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The requested resource does not exist",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {
+                      "id": "71a3000f-7dda-491a-9b90-a19f4ee6c406"
+                    }
+                  },
+                  "cause": null,
+                  "causeMessage": "",
+                  "code": "NOT_FOUND",
+                  "message": "The resource requested was not found or is no longer available",
+                  "requestId": "270908d6-f2ef-4577-b973-67bec18ae376"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          }
+        }
+      },
+      "parameters": [
+        {
+          "type": "string",
+          "description": "The id of the requested resource",
+          "name": "id",
+          "in": "path",
+          "required": true
+        }
+      ]
+    },
     "/identities/{id}/edge-router-policies": {
       "get": {
         "security": [
@@ -27504,6 +27586,88 @@ func init() {
         }
       ]
     },
+    "/identities/{id}/authenticators": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Returns a list of authenticators associated to the idetity specified\n",
+        "tags": [
+          "Identity"
+        ],
+        "summary": "Retrieve the curent authenticators of a specific identity",
+        "operationId": "getIdentityAuthenticators",
+        "responses": {
+          "200": {
+            "description": "A list of authenticators",
+            "schema": {
+              "$ref": "#/definitions/listAuthenticatorsEnvelope"
+            }
+          },
+          "401": {
+            "description": "The currently supplied session does not have the correct access rights to request this resource",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": "",
+                  "causeMessage": "",
+                  "code": "UNAUTHORIZED",
+                  "message": "The request could not be completed. The session is not authorized or the credentials are invalid",
+                  "requestId": "0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The requested resource does not exist",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {
+                      "id": "71a3000f-7dda-491a-9b90-a19f4ee6c406"
+                    }
+                  },
+                  "cause": null,
+                  "causeMessage": "",
+                  "code": "NOT_FOUND",
+                  "message": "The resource requested was not found or is no longer available",
+                  "requestId": "270908d6-f2ef-4577-b973-67bec18ae376"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          }
+        }
+      },
+      "parameters": [
+        {
+          "type": "string",
+          "description": "The id of the requested resource",
+          "name": "id",
+          "in": "path",
+          "required": true
+        }
+      ]
+    },
     "/identities/{id}/edge-router-policies": {
       "get": {
         "security": [

rest_management_api_server/operations/identity/get_identity_authenticators.go

@@ -0,0 +1,96 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package identity
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// GetIdentityAuthenticatorsHandlerFunc turns a function with the right signature into a get identity authenticators handler
+type GetIdentityAuthenticatorsHandlerFunc func(GetIdentityAuthenticatorsParams, interface{}) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn GetIdentityAuthenticatorsHandlerFunc) Handle(params GetIdentityAuthenticatorsParams, principal interface{}) middleware.Responder {
+	return fn(params, principal)
+}
+
+// GetIdentityAuthenticatorsHandler interface for that can handle valid get identity authenticators params
+type GetIdentityAuthenticatorsHandler interface {
+	Handle(GetIdentityAuthenticatorsParams, interface{}) middleware.Responder
+}
+
+// NewGetIdentityAuthenticators creates a new http.Handler for the get identity authenticators operation
+func NewGetIdentityAuthenticators(ctx *middleware.Context, handler GetIdentityAuthenticatorsHandler) *GetIdentityAuthenticators {
+	return &GetIdentityAuthenticators{Context: ctx, Handler: handler}
+}
+
+/* GetIdentityAuthenticators swagger:route GET /identities/{id}/authenticators Identity getIdentityAuthenticators
+
+Retrieve the curent authenticators of a specific identity
+
+Returns a list of authenticators associated to the idetity specified
+
+
+*/
+type GetIdentityAuthenticators struct {
+	Context *middleware.Context
+	Handler GetIdentityAuthenticatorsHandler
+}
+
+func (o *GetIdentityAuthenticators) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewGetIdentityAuthenticatorsParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal interface{}
+	if uprinc != nil {
+		principal = uprinc.(interface{}) // this is really a interface{}, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}

rest_management_api_server/operations/identity/get_identity_authenticators_parameters.go

@@ -0,0 +1,95 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package identity
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewGetIdentityAuthenticatorsParams creates a new GetIdentityAuthenticatorsParams object
+//
+// There are no default values defined in the spec.
+func NewGetIdentityAuthenticatorsParams() GetIdentityAuthenticatorsParams {
+
+	return GetIdentityAuthenticatorsParams{}
+}
+
+// GetIdentityAuthenticatorsParams contains all the bound params for the get identity authenticators operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters getIdentityAuthenticators
+type GetIdentityAuthenticatorsParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*The id of the requested resource
+	  Required: true
+	  In: path
+	*/
+	ID string
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewGetIdentityAuthenticatorsParams() beforehand.
+func (o *GetIdentityAuthenticatorsParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	rID, rhkID, _ := route.Params.GetOK("id")
+	if err := o.bindID(rID, rhkID, route.Formats); err != nil {
+		res = append(res, err)
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// bindID binds and validates parameter ID from path.
+func (o *GetIdentityAuthenticatorsParams) bindID(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: true
+	// Parameter is provided by construction from the route
+	o.ID = raw
+
+	return nil
+}

rest_management_api_server/operations/identity/get_identity_authenticators_responses.go

@@ -0,0 +1,170 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package identity
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// GetIdentityAuthenticatorsOKCode is the HTTP code returned for type GetIdentityAuthenticatorsOK
+const GetIdentityAuthenticatorsOKCode int = 200
+
+/*GetIdentityAuthenticatorsOK A list of authenticators
+
+swagger:response getIdentityAuthenticatorsOK
+*/
+type GetIdentityAuthenticatorsOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.ListAuthenticatorsEnvelope `json:"body,omitempty"`
+}
+
+// NewGetIdentityAuthenticatorsOK creates GetIdentityAuthenticatorsOK with default headers values
+func NewGetIdentityAuthenticatorsOK() *GetIdentityAuthenticatorsOK {
+
+	return &GetIdentityAuthenticatorsOK{}
+}
+
+// WithPayload adds the payload to the get identity authenticators o k response
+func (o *GetIdentityAuthenticatorsOK) WithPayload(payload *rest_model.ListAuthenticatorsEnvelope) *GetIdentityAuthenticatorsOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the get identity authenticators o k response
+func (o *GetIdentityAuthenticatorsOK) SetPayload(payload *rest_model.ListAuthenticatorsEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *GetIdentityAuthenticatorsOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// GetIdentityAuthenticatorsUnauthorizedCode is the HTTP code returned for type GetIdentityAuthenticatorsUnauthorized
+const GetIdentityAuthenticatorsUnauthorizedCode int = 401
+
+/*GetIdentityAuthenticatorsUnauthorized The currently supplied session does not have the correct access rights to request this resource
+
+swagger:response getIdentityAuthenticatorsUnauthorized
+*/
+type GetIdentityAuthenticatorsUnauthorized struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewGetIdentityAuthenticatorsUnauthorized creates GetIdentityAuthenticatorsUnauthorized with default headers values
+func NewGetIdentityAuthenticatorsUnauthorized() *GetIdentityAuthenticatorsUnauthorized {
+
+	return &GetIdentityAuthenticatorsUnauthorized{}
+}
+
+// WithPayload adds the payload to the get identity authenticators unauthorized response
+func (o *GetIdentityAuthenticatorsUnauthorized) WithPayload(payload *rest_model.APIErrorEnvelope) *GetIdentityAuthenticatorsUnauthorized {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the get identity authenticators unauthorized response
+func (o *GetIdentityAuthenticatorsUnauthorized) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *GetIdentityAuthenticatorsUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(401)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// GetIdentityAuthenticatorsNotFoundCode is the HTTP code returned for type GetIdentityAuthenticatorsNotFound
+const GetIdentityAuthenticatorsNotFoundCode int = 404
+
+/*GetIdentityAuthenticatorsNotFound The requested resource does not exist
+
+swagger:response getIdentityAuthenticatorsNotFound
+*/
+type GetIdentityAuthenticatorsNotFound struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewGetIdentityAuthenticatorsNotFound creates GetIdentityAuthenticatorsNotFound with default headers values
+func NewGetIdentityAuthenticatorsNotFound() *GetIdentityAuthenticatorsNotFound {
+
+	return &GetIdentityAuthenticatorsNotFound{}
+}
+
+// WithPayload adds the payload to the get identity authenticators not found response
+func (o *GetIdentityAuthenticatorsNotFound) WithPayload(payload *rest_model.APIErrorEnvelope) *GetIdentityAuthenticatorsNotFound {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the get identity authenticators not found response
+func (o *GetIdentityAuthenticatorsNotFound) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *GetIdentityAuthenticatorsNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(404)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}

rest_management_api_server/operations/identity/get_identity_authenticators_urlbuilder.go

@@ -0,0 +1,123 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package identity
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+	"strings"
+)
+
+// GetIdentityAuthenticatorsURL generates an URL for the get identity authenticators operation
+type GetIdentityAuthenticatorsURL struct {
+	ID string
+
+	_basePath string
+	// avoid unkeyed usage
+	_ struct{}
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *GetIdentityAuthenticatorsURL) WithBasePath(bp string) *GetIdentityAuthenticatorsURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *GetIdentityAuthenticatorsURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *GetIdentityAuthenticatorsURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/identities/{id}/authenticators"
+
+	id := o.ID
+	if id != "" {
+		_path = strings.Replace(_path, "{id}", id, -1)
+	} else {
+		return nil, errors.New("id is required on GetIdentityAuthenticatorsURL")
+	}
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/edge/management/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *GetIdentityAuthenticatorsURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *GetIdentityAuthenticatorsURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *GetIdentityAuthenticatorsURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on GetIdentityAuthenticatorsURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on GetIdentityAuthenticatorsURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *GetIdentityAuthenticatorsURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_management_api_server/operations/ziti_edge_management_api.go

@@ -313,6 +313,9 @@ func NewZitiEdgeManagementAPI(spec *loads.Document) *ZitiEdgeManagementAPI {
 		CurrentIdentityGetCurrentIdentityHandler: current_identity.GetCurrentIdentityHandlerFunc(func(params current_identity.GetCurrentIdentityParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation current_identity.GetCurrentIdentity has not yet been implemented")
 		}),
+		IdentityGetIdentityAuthenticatorsHandler: identity.GetIdentityAuthenticatorsHandlerFunc(func(params identity.GetIdentityAuthenticatorsParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation identity.GetIdentityAuthenticators has not yet been implemented")
+		}),
 		IdentityGetIdentityFailedServiceRequestsHandler: identity.GetIdentityFailedServiceRequestsHandlerFunc(func(params identity.GetIdentityFailedServiceRequestsParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation identity.GetIdentityFailedServiceRequests has not yet been implemented")
 		}),
@@ -780,6 +783,8 @@ type ZitiEdgeManagementAPI struct {
 	CurrentAPISessionGetCurrentAPISessionHandler current_api_session.GetCurrentAPISessionHandler
 	// CurrentIdentityGetCurrentIdentityHandler sets the operation handler for the get current identity operation
 	CurrentIdentityGetCurrentIdentityHandler current_identity.GetCurrentIdentityHandler
+	// IdentityGetIdentityAuthenticatorsHandler sets the operation handler for the get identity authenticators operation
+	IdentityGetIdentityAuthenticatorsHandler identity.GetIdentityAuthenticatorsHandler
 	// IdentityGetIdentityFailedServiceRequestsHandler sets the operation handler for the get identity failed service requests operation
 	IdentityGetIdentityFailedServiceRequestsHandler identity.GetIdentityFailedServiceRequestsHandler
 	// IdentityGetIdentityPolicyAdviceHandler sets the operation handler for the get identity policy advice operation
@@ -1263,6 +1268,9 @@ func (o *ZitiEdgeManagementAPI) Validate() error {
 	if o.CurrentIdentityGetCurrentIdentityHandler == nil {
 		unregistered = append(unregistered, "current_identity.GetCurrentIdentityHandler")
 	}
+	if o.IdentityGetIdentityAuthenticatorsHandler == nil {
+		unregistered = append(unregistered, "identity.GetIdentityAuthenticatorsHandler")
+	}
 	if o.IdentityGetIdentityFailedServiceRequestsHandler == nil {
 		unregistered = append(unregistered, "identity.GetIdentityFailedServiceRequestsHandler")
 	}
@@ -1920,6 +1928,10 @@ func (o *ZitiEdgeManagementAPI) initHandlerCache() {
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
 	}
+	o.handlers["GET"]["/identities/{id}/authenticators"] = identity.NewGetIdentityAuthenticators(o.context, o.IdentityGetIdentityAuthenticatorsHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
 	o.handlers["GET"]["/identities/{id}/failed-service-requests"] = identity.NewGetIdentityFailedServiceRequests(o.context, o.IdentityGetIdentityFailedServiceRequestsHandler)
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)

specs/management.yml

@@ -5318,6 +5318,64 @@ paths:
       name: id
       in: path
       required: true
+  /identities/{id}/authenticators:
+    get:
+      security:
+      - ztSession: []
+      description: |
+        Returns a list of authenticators associated to the idetity specified
+      tags:
+      - Identity
+      summary: Retrieve the curent authenticators of a specific identity
+      operationId: getIdentityAuthenticators
+      responses:
+        "200":
+          description: A list of authenticators
+          schema:
+            $ref: '#/definitions/listAuthenticatorsEnvelope'
+        "401":
+          description: The currently supplied session does not have the correct access
+            rights to request this resource
+          schema:
+            $ref: '#/definitions/apiErrorEnvelope'
+          examples:
+            application/json:
+              error:
+                args:
+                  urlVars: {}
+                cause: ""
+                causeMessage: ""
+                code: UNAUTHORIZED
+                message: The request could not be completed. The session is not authorized
+                  or the credentials are invalid
+                requestId: 0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f
+              meta:
+                apiEnrolmentVersion: 0.0.1
+                apiVersion: 0.0.1
+        "404":
+          description: The requested resource does not exist
+          schema:
+            $ref: '#/definitions/apiErrorEnvelope'
+          examples:
+            application/json:
+              error:
+                args:
+                  urlVars:
+                    id: 71a3000f-7dda-491a-9b90-a19f4ee6c406
+                cause: null
+                causeMessage: ""
+                code: NOT_FOUND
+                message: The resource requested was not found or is no longer available
+                requestId: 270908d6-f2ef-4577-b973-67bec18ae376
+              meta:
+                apiEnrolmentVersion: 0.0.1
+                apiVersion: 0.0.1
+    parameters:
+    - type: string
+      description: The id of the requested resource
+      name: id
+      in: path
+      required: true
   /identities/{id}/edge-router-policies:
     get:
       security:

specs/source/management.yml

@@ -120,6 +120,8 @@ paths:
     $ref: 'management/identities.yml#/paths/identities'
   '/identities/{id}':
     $ref: 'management/identities.yml#/paths/identities-id'
+  '/identities/{id}/authenticators':
+    $ref: "management/identities.yml#/paths/identities-id-authenticators"
   '/identities/{id}/edge-router-policies':
     $ref: 'management/identities.yml#/paths/identities-id-edge-router-policies'
   '/identities/{id}/service-configs':

specs/source/management/identities.yml

@@ -314,6 +314,25 @@ paths:
           $ref: '../shared/standard-responses.yml#/responses/notFoundResponse'
         '401':
           $ref: '../shared/standard-responses.yml#/responses/unauthorizedResponse'
+  identities-id-authenticators:
+    parameters:
+      - $ref: '../shared/parameters.yml#/id'
+    get:
+      summary: Retrieve the curent authenticators of a specific identity
+      description: |
+        Returns a list of authenticators associated to the idetity specified
+      security:
+        - ztSession: [ ]
+      tags:
+        - Identity
+      operationId: getIdentityAuthenticators
+      responses:
+        '200':
+          $ref: '../shared/authenticators.yml#/responses/listAuthenticators'
+        '404':
+          $ref: '../shared/standard-responses.yml#/responses/notFoundResponse'
+        '401':
+          $ref: '../shared/standard-responses.yml#/responses/unauthorizedResponse'
   identities-id-failed-service-requests:
     parameters:
       - $ref: '../shared/parameters.yml#/id'