Add thumbprint user mapping support

[sahandilshan]

Proposed changes in this pull request

$subject

With this support, we need to add the thumbprint-user mapping as below in deployment.toml

Provided the support for below configs

[admin_console.authenticator.mutual_ssl_authenticator.config]
allowed_issuers="issuer01|issuer02"
"issuer_<issuer01>"="admin1,admin2"
"issuer_<issuer02>"="*"
"cert_thumbprint_<thumbpirnt01>"="admin1"
"cert_thumbprint_<thumbpirnt02>"="admin2"
"cert_thumbprint_<thumbpirnt03>"="*"

When authenticating a certificate, the system validates in the following order:

1. Certificate Thumbprint Check

   • If the certificate thumbprint is configured, validate against its user mapping.
   • If a match is found → authentication passes.

2. Issuer Check (if thumbprint not matched)

   • Check whether the certificate’s issuer is listed in allowed_issuers.
   • If yes, validate the issuer’s user mapping.
   • If a match is found → authentication passes.

3. Failure

   • If neither thumbprint nor issuer mapping matches, the request is rejected.

[darshanasbg]

If we use just the CN to indicate issuer, config will be much clear..

[admin_console.authenticator.mutual_ssl_authenticator.config]
"trusted_issuers" = "cn1, cn2"
"issuer_cn1" = "admin1,admin2"
"cert_thumbprint_91923be458ae255d76b37bedda8bf57e597e7dfb943cacf17931c71fd9f06ed5" = "admin"

[Copilot]

Pull Request Overview

This PR adds thumbprint-to-user mapping support for mutual SSL authentication. It enables certificate-based authentication to validate username bindings against both certificate thumbprints and trusted issuers, providing more granular control over authentication authorization.

• Enhanced mutual SSL authenticator with thumbprint and issuer-based user mapping validation
• Added support for trusted issuer configuration and validation
• Implemented certificate binding validation with wildcard support

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[1uffyD9]

We are currently reviewing the code change. Adding the concerns we found so far

[1uffyD9]

We are currently reviewing the code change. Adding the concerns we found so far

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️