Authenticating unifiers

[netthier]

Preflight checklist

• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines."
• I have discussed this feature request with the community.

Describe the background of your feature request

In some cases it might be desirable to protect authenticated legacy or 3rd party services with Heimdall.
A specific case I had myself was restricting access to a 3rd party server to users with specific roles in my system but authenticating against the server using a service account.

Describe your idea

Heimdall already has functionality to authenticate against contextualizer services (https://dadrus.github.io/heimdall/v0.11.1-alpha/docs/configuration/reference/types/#_authentication_strategy).
My specific problem would be solved by having the possibility of using those same auth strategies against not only contextualizers but also regular Heimdall backends.
I propose doing this via a special unifier that is configurable via the auth strategies linked above and attaches the token to the request going to the backend, e.g.:

unifiers:
  - id: auth
    type: auth
    config:
      type: client_credentials
      config:
        token_url: https://my-auth.provider/token
        client_id: foo
        client_secret: bar
        scopes:
          - baz
          - zap

obviously the doubled config is bad, but I hope it gets the idea across.

Are there any workarounds or alternatives?

The workaround I'm currently using is executing the OAuth2 token request manually via a generic contextualizer, and then attaching the token to the request using a header unifier:

contextualizers:
  - id: auth
    type: generic
    config:
      endpoint:
        url: https://my-auth.provider/token
        method: POST
        headers:
          Content-Type: application/x-www-form-urlencoded
        payload: client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&grant_type=client_credentials
        cache_ttl: 7200s
unifiers:
  - id: auth
    type: header
    config:
      headers:
        Authorization: "Bearer {{ .Subject.Attributes.auth.access_token }}"

However, this is suboptimal due to the hardcoded cache_ttl (it should instead be set to whatever the /token endpoint returns).

Version

v0.11.1-alpha

Additional Context

This idea has first been suggested on the Discord server: https://discord.com/channels/1100447190796742698/1123233818543923220