v1.5.0

Updates handling of client certificates.

The application assumes an upstream ssl terminator validates any client certificate and adds headers with client cert data. While the app can receive the client certificate as a header value, this has drawbacks because 1) passing multiline header values isn't standard, and 2) that work has generally already been done by the upstream terminator.

For security reasons, the operator MUST ensure that configured ssl client cert headers are ONLY set by the upstream ssl terminator.

Changes:

• parses x500 distinguished names in addition to the existing ldapv3 formatted DNs.
• removed the default (nginx) header names. Operators must configure with expected header names.
• allows multiple client cert header options (changed from string to array of string)

## Header values for certificate data received from reverse proxy (i.e. nginx)
## ** These are NOT defaults. You must include your values.  Nginx values are shown.
# Account__Authentication__ClientCertHeader = X-ARR-ClientCert
# Account__Authentication__ClientCertSubjectHeaders__0 = ssl-client-subject-dn
# Account__Authentication__ClientCertIssuerHeaders__0 = ssl-client-issuer-dn
# Account__Authentication__ClientCertSerialHeaders__0 = ssl-client-serial
# Account__Authentication__ClientCertVerifyHeaders__0 = ssl-client-verify

"Security" enhancement

• removed anonymous access from the public /api/version and /api/stats endpoints.