Bearer Token Authentication

[cimnine]

Summary

This PR implements JWT Bearer token authentication alongside Basic auth.
It's implemented as middleware and adds information to the Request's Context:

• authentication-method is either Bearer or Basic
• bearer-token allows access to the jwt.Claims instance if authentication-method=Bearer
• user allows access to the user's name if authentication-method=Basic

The endpoints /healthz and /metrics (new) don't require authentication.
Every other endpoint does and if no valid credentials or tokens are provided, then an HTTP 403 error is returned.

I've added the promtheus library for metrics collection to the project. Besides the metrics it collects automatically I've created the following two manual metrics:

• osb_total_broker_api_requests_total:
  The total number of processed service broker api requests, not including healthz and metrics requests.
• osb_failed_authentication_attempts_total:
  The total number of failed authentication attempts.

I've manually reviewed the library I used whether https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ would be a problem. I conclude it's not a problem: (1) The none algorithm results in an error. (2) The secrets are always associated to a specific algorithm. It's therefore not possible to use a public key as signature for an HMAC.

TODO

• Adjust and extend E2E Tests
• Organize commits into meaningful pieces
• Allow JWK store be fetched from an URL

Checklist

• Keep pull requests small so they can be easily reviewed.
• Categorize the PR by setting a good title and adding one of the labels:
  bug, enhancement, documentation, change, breaking,
  as they show up in the changelog
• Update the documentation.
• Update tests.
• Link this PR to related issues.

[simu]

The implementation itself LGTM, I concur that the JWT library that we're using isn't affected by https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

[ccremer]

What is the current test strategy in order to verify the new auth stack? The PR doesn't seem to ship testing for JWT or I missed it

[cimnine]

Thank you for the feedback. I've extended the existing Auth-tests to also test for Bearer-Token based Auth. The coverage of the auth process should thereby be pretty solid.