Add revised filter config for proxy_wasm authn filter

envoy/config/filter/http/authn/v2alpha2/config.proto

@@ -0,0 +1,50 @@
+// Copyright 2020 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
+
+syntax = "proto3";
+
+import "security/v1beta1/request_authentication.proto";
+import "security/v1beta1/peer_authentication.proto";
+
+// $title: Internal API for authentication implementation on Envoy.
+
+package istio.envoy.config.filter.http.authn.v2alpha2;
+
+
+option go_package = "istio.io/api/envoy/config/filter/http/authn/v2alpha2";
+
+// FilterConfig is the config for Istio-specific filter that is used to enforce
+// authentication policy on Envoy.
+message FilterConfig {
+  // Filter configuration for RequestAuthentication, which supports Jwt authentication.
+  istio.security.v1beta1.RequestAuthentication request_authentication = 1;
+
+  // Filter configuration for PeerAuthentication, which supports 
+  // mTLS authentication for sidecar to sidecar workload.
+  istio.security.v1beta1.PeerAuthentication peer_authentication = 2;
+
+  // Map from issuer to location of the payload that is emitted by Jwt filter.
+  // This information is added by pilot when construct and add Jwt and
+  // authN filters.
+  map<string, string> jwt_output_payload_locations = 3;
+
+  // Skips validating the peer's trust domain.
+  // By default, the istio authn filter will reject the request if the peer and
+  // the local service is not in the same trust domain.
+  // Set this field to true to skip the validation and allows peers from any
+  // trust domains.
+  // Note, the istio authn filter only validates the trust domain when mTLS is
+  // used, In other words, this field has no effect for plaintext traffic.
+  bool skip_validate_trust_domain = 4;
+}