Extend Docker authorization with TLS user information

[liron-l]

- What I did
For TLS connections, add client subject name to authorization request
- How to verify it
Add integration test, validated manually

Currently Docker authorization framework does not use any user
information, which already available in the Docker context for TLS
connection.
The purpose of this CR is to complete the existing authz work by adding
the basic client certificate details (SUBJECT_NAME) and authentication
method (TLS) to the authz request.

We think this should be the default behavior when no extended
authorization module is specified (currently WIP under #20883).

Signed-off-by: Liron Levin liron@twistlock.com

[liron-l]

@jfrazelle , @thaJeztah , @NathanMcCauley , @diogomonica, @nalind
I will appreciate your input on this change.

[jessfraz]

LGTM

[calavera]

LGTM

[thaJeztah]

Does this need changes in the authorization-plugin docs? https://github.com/docker/docker/blob/master/docs/extend/plugins_authorization.md

[diogomonica]

@liron-l what about adding the whole SubjectDN from the cert? CN feels unnecessarily restrictive.

[liron-l]

Thanks all, @thaJeztah I will update the authorization documentation in another PR.
@diogomonica do you mean taking all the values under DNSNames?

[diogomonica]

@liron-l I mean taking the whole Subject pkix.Name

[liron-l]

@diogomonica you mean running asn1.Marshal(name)?
What are you expecting to be the value of the user in the request?

[diogomonica]

@liron-l I guess I would like to have a user that is just more than a string.

[liron-l]

I agree @diogomonica, I think it is covered by the authentication plugin suggested in #20883 (which passes the full client certificate to the plugin).

[eungjun-yi]

Is it possible to make this feature works with swarm? Currently it seems that CN of swarm manager, instead of CN of docker client, goes to the each swarm node.

Should I wait for docker-archive/classicswarm#1366?

[doronp]

@npcode Yes, And in general I plan to align Swarm support in AtuhZ+AuthN with Dockers. When and what is merged is not solely depends on me though.

[eungjun-yi]

Thank you for your effort, @doronp. I seriously need swarm authz+authn.