Update TO to handle Client-Cert-Subject HTTP header for client cert authentication.

[jagan-parthiban]

Overview,

Traffic Ops needs to accept Impersonation Certificates as described in the blueprint: https://github.com/apache/trafficcontrol/blob/master/blueprints/client-certificate-auth.md#traffic-ops-impact

Currently, TO only accepts a UID presented directly in the Subject of a client certificate. TO MUST accept a UID presented in the Client-Cert-Subject field as well. If a client certificate with an empty UID in the Subject field is presented in a request that also contains a Client-Cert-Subject HTTP header, TO MUST use the contents of the Client-Cert-Subject header to determine the UID of the client.

---

Which Traffic Control components are affected by this PR?

• Traffic Ops

What is the best way to verify this PR?

Manual Testing,

1. Test certificates can be created using the file located at,

trafficcontrol/experimental/certificate_auth/certs/generate_certs.go

2. Ensure that the UID field is empty at line,

   trafficcontrol/experimental/certificate_auth/certs/generate_certs.go

   Line 58 in a892235

   uid = "userid"

   
   uid = ""

3. Running go run generate_certs.go will produce private keys and certificates for Root, Intermediate, and Client. Place the Root certificate in the directory location specified in the cdn.conf file,

"client_certificate_authentication" : {
    "root_certificates_directory" : "/etc/pki/tls/certs/"
}

5. Launch a Traffic Ops instance.

6. In the trafficcontrol/experimental/certificate_auth/example/client.go file, uncomment the following line to set UID via Client-Cert-Subject header and change the UID value to match the user you want to authenticate,

req.Header.Set("Client-Cert-Subject", "CN=client,OU=client,O=client,L=client,ST=client,C=US,UID=userID")

7. run the client.go file to send a request to the user/login Traffic Ops with the Client and Intermediate certs along with the http header Client-Cert-Subject ,

go run client.go

9. Upon success, a 200 OK status code will be returned along with the following body:

{
    "alerts": [
        {
            "text": "Successfully logged in.",
            "level": "success"
        }
    ]
}

If this is a bugfix, which Traffic Control versions contained the bug?

PR submission checklist

• This PR has tests
• This PR has documentation
• This PR has a CHANGELOG.md entry
• This PR DOES NOT FIX A SERIOUS SECURITY VULNERABILITY (see the Apache Software Foundation's security guidelines for details)

[ericholguin]

We should remove this otherwise it will fill up our logs every time someone tries to authenticate

[jagan-parthiban]

Fixed.

[ericholguin]

In the case that cert authentication isn't tried (triedAuthentication = false) the code will not enter this conditional, which means form auth wont work unless a user tries to authenticate with a certificate.

[jagan-parthiban]

Thanks. Missed it. Fixed.

[jagan-parthiban]

Not Planned For Now