* fixesopenziti/ziti#3356 adds www-authenticate headers
- www-authenticate headers are returned on 401s from API requests
- www-authenticate headers are returned during authentication to signal
addtional JWT bearer tokens needed (secondary ext jwt)
- adds support for additional headers on API errors
- adds SecurityTokenCtx for centralized security header processing
(legacy, jwt, etc.)
- adds SecurityCtx for centralized identity, auth policy, MFA handling
- refactors existing JWT authentication methods (oidc, legacy) to use
centralized processing where possible
* fixesopenziti/ziti#2324 add token based enrollment
- allows enrollment to certificate auth
- allows enrollment to ext jwt token auth
- alters ext jwt claimsProperty (maps identity id) to support JSON
pointers, defaults to `/sub`
- adds ext jwt enrollToCert, enrollToToken to controller valid
enrollment end-authenticator state
- adds ext jwt enrollAuthPolicyId to map end identity auth policy to,
defaults to `default`
- adds ext jwt enrollAttributeSelector, supports single field name or
JSON pointer to point to a single string or array of string attributes
to give the identity, defaults to no selector
- adds ext jwt enrollNameSelector, supports single field name or JSON
pointer to a string field to use as the name, defaults to `/sub`
- add enrollment errors to determine if enrollment has occurred
- adds CLI support for ext jwt signer enroll flags
fixes#3084 adds events and improper chain flag
- splits cert resolution into root, legacy root + intermediate,
and third-party pool. Allowing the detection of client authentication
with incomplete chains if root + intermediate succeeds after root only fails
- adds `improperClientCertChain` to API Sessions and Current API Session.
Added for OIDC and legacy auth. Set to true when a client certificate is used
that was issued by the network and did not pass the root-only pool.
- adds REST API CA external id field
- adds rest api for external fields
- refactors authentication interfaces for federation
- alters authentication moduels to return AuthResult interfaces
- allows AuthResults to provide external x509 certs as session certs
- adds endpoint POST /edge/management/v1/authenticator/{id}/extend
- adds endpoint POST /edge/management/v1/authenticator/{id}/extend-verify
- adds endpoint POST /edge/client/v1/authenticator/{id}/extend
- adds endpoint POST /edge/client/v1/authenticator/{id}/extend-verify
- add logic that allows a client endpoint to extend the valid period for
their current certificate authenticator
- requires clients to use their existing client cetificate for extension
- requires clients to verify they have received the new public key
- allows clients to use a new private key if desired
- allows only 1st party certificate authenticators to extend
- adds authenticatorId to apiSession for persistence, model, api model
- add session cert to already authenticated session on extend
- removes empty test stub
- remove old JSON schema, unsused code
- remove unused variables from base router functions
- rework all API entities
- rework all links
- fix lint issues
- adds error conversion logic
- update tests as needed
- fix up go test
- fix backwards compat w/ non json enroller
Andrew Martinez