feat: Authenticate with client certificate for /apidoc/** routes

[CarsonCook]

Description

Allow certificate to be used to authenticate to /apidoc/** routes on the API Catalog.

Linked to #1523

Type of change

Please delete options that are not relevant.

• (fix) Bug fix (non-breaking change which fixes an issue)
• (feat) New feature (non-breaking change which adds functionality)
• (docs) Change in a documentation
• (refactor) Refactor the code
• (chore) Chore, repository cleanup, updates the dependencies.
• (BREAKING CHANGE or !) Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works

For more details about how should the code look like read the Contributing guideline

[jandadav]

Minor comments, otherwise looks good.
There is this point:
Note: Since some services might be already providing a client certificate that is ignored during authentication, the solution needs to take this into account and preserve current behavior in cases when user credentials are provided together with the client certificate.

I wonder whether we don't need a test to prove this?

[CarsonCook]

Minor comments, otherwise looks good.
There is this point:
Note: Since some services might be already providing a client certificate that is ignored during authentication, the solution needs to take this into account and preserve current behavior in cases when user credentials are provided together with the client certificate.

I wonder whether we don't need a test to prove this?

Added integration tests for cert + basic auth for GW URL to apidoc and not-apidoc route, as well as for service URL to apidoc route.

[jandadav]

I am looking into the failing test, as I can run container setup and hit the same problem.

Edit: Through debug, it doesn't seem that the x509 filter in Catalog filter chain sees any certificate in request under javax.servlet.request.X509Certificate attribute. I'll keep on digging.

[sonarcloud]

SonarCloud Quality Gate failed.

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
5.0% Duplication

[jandadav]

Thank you!