Allows to preserve the exsting authorization header when oauth2 filter is in the request path

[zhaohuabing]

In the current OAuth2 implementation, the Authorization header is sanitized by the OAuth2 filter when it's in the request path, as the following code shows:

envoy/source/extensions/filters/http/oauth2/filter.cc

Lines 292 to 295 in 416cd42

	// Sanitize the Authorization header, since we have no way to validate its content. Also,
	// if token forwarding is enabled, this header will be set based on what is on the HMAC cookie
	// before forwarding the request upstream.
	headers.removeInline(authorization_handle.handle());

In some scenarios, such as Multi-Factor Authentication (MFA), there may be a need to add another layer of authentication alongside oauth2. It can be helpful if a knob could be added to change this default behavior.

   // If set to true, preserve the existing authorization header when forward_bearer_token is false.
   bool preserve_authorization_header bool = 16;

Related EG issue: envoyproxy/gateway#3396

[derekargueta]

I thought we already had a GH issue for this but I guess not... sounds good to me

[zhaohuabing]

/assign

[repokitteh-read-only]

zhaohuabing is not allowed to assign users.

🐱

Caused by: a #34236 (comment) was created by @zhaohuabing.

see: more, trace.