Make the name of the client certificate attribute which is mapped to roles configurable

[sberyozkin]

Description

Currently, after #37269, it is possible to map the value of the certificate's CN attribute to the local roles.
@cescoffier has proposed to support other attributes such as the Subject Alternative Name (SAN) as CN may not always be set.

Implementation ideas

Add a property to let users customize the attribute name.
In meantime, it can be done with the custom SecurityIdentityAugmentor

[michalvavrik]

I'll take care of this in next few weeks.

[michalvavrik]

I'll have a look now.

Currently, it is possible to map roles from CN within DN. We can make easily configurable other DN attributes (not sure if it is really useful TBH).

We can also make it configurable for selected extensions like SubjectAlternativeName, but list of configurable options must be discrete and known. I don't think there is safe and effective algorithm to support mapping for all the extensions.

I vote for DNs and SAN.

@sberyozkin @cescoffier do you have concrete X.509 attribute / extensions apart of SAN / CN in mind?

[cescoffier]

Yeah, DN and SAN are the most important. Yesterday, I found your that Chrome does not allow certificates without SAN anymore. So, I would even say SAN first.

[michalvavrik]

Here is a PR: #40838. I went with discrete list (most frequent) DNs and SANs because I think enum is easier for users to understand as configuration property value and also I want to have tested supported variations to reasonable extent. Please comment if you want in that PR. Thanks