Add pki_delegatee to User metadata

[albertzaharovits]

This adds the pki_delegatee field to the User#metadata map. The field contains the authentication of the proxy client (eg. kibana_system). The intention is for the es-admin to be able to write role mapping rules that distinguish between users authenticated directly or by delegation.

Please review #44561 first, as this needs tests that require the HLRest client introduced there.

Relates #34396

[elasticmachine]

Pinging @elastic/es-security

[tvernum]

I haven't reviewed the code, but I don't think pki_delegatee is the right name for this field. I don't think anyone would understand what that means without the docs.

May something like pki_delegated_to / _by / _from / _via

[albertzaharovits]

Thank you for the feedback Tim!
It turned out that having the Authentication object in the metadata does not really work anyway (only simple types like Numbers, Strings and Collections are permitted).

I have went with one of your options, _from, and added the following fields pki_delegated_from_user and pki_delegated_from_realm to the user metadata.

I have also added tests for it. The tests will conflict with #44561 but it doesn't matter, I'll fix the merge conflict on whatever PR gets merge the second one.

[albertzaharovits]

@elasticmachine run elasticsearch-ci/2

[tvernum]

I did leave a suggestion about preventing an accidental null delegate.
I also prefer delegated_by rather than _from but that's a bikeshed, so it's up to you.

[tvernum]

WDYT of making this constructor private, and adding a factory method like:

public static X509AuthenticationToken delegatedToken(X509Certificate[] certificates, Authentication delegateeAuthentication) {
  Objects.requireNotNull(delegateeAuthentication);
 return new X509AuthenticationToken(certificates, delegateeAuthentication);
}

I worry about constructors where passing in a null is allowed, but completely changes the behaviour. You can't guard against null (because it's allowed) but if someone accidentally passes in a null value then they will get a behaviour that doesn't do what they want (and could end up being a security issue).

[albertzaharovits]

Great idea to make creating delegated tokens more explicit.

[bizybot]

LGTM, Thank you.

[albertzaharovits]

I went with delegated_by_* instead of delegated_from_*.