Add XFCC request authorization support

[tsaarni]

This change introduces new command line parameter for ensuring that only authorized clients can send XFCC header.

Authorization is configured by specifying the expected list of X509 subject names in the client certificate chain:

--spi-x509cert-lookup-envoy-cert-path-verify="[ [ <leaf-cert>, <intermediate-cert>, ... ], ... ]"

For example:

--spi-x509cert-lookup-envoy-cert-path-verify='[["CN=envoy, O=example.com", "CN=intermediate, O=example.com"]]'

This ensures that the XFCC header is accepted only from clients presenting a certificate chain that matches the specified subject names.

The configuration is provided as a JSON array of arrays. Multiple chains of subject names can be specified. Each inner array represents a certificate chain, where the first element is the subject name of the leaf certificate, followed by the intermediate certificates. The subject name of the root certificate is not included.

If the specified path has fewer subject names than the client certificate chain, the client chain is compared only up to the length of the specified path, and the remaining certificates are ignored during the authorization check.

Fixes #19

[tsaarni]

In older Keycloak versions, when using --spi-x509cert-lookup-envoy-cert-path-verify=xyz, the kc.sh script did not quote the user-provided parameters before calling eval, which led to issues with parameters containing e.g. spaces and quotes. This was resolved by keycloak/keycloak#22585 in Keycloak 23.0.0.

For earlier versions, applying the following minimal patch to kc.sh will address the issue:

diff --git a/quarkus/dist/src/main/content/bin/kc.sh b/quarkus/dist/src/main/content/bin/kc.sh
old mode 100644
new mode 100755
index 80ed3e80e3..305641bb06
--- a/quarkus/dist/src/main/content/bin/kc.sh
+++ b/quarkus/dist/src/main/content/bin/kc.sh
@@ -48,6 +48,10 @@ DEBUG_SUSPEND="${DEBUG_SUSPEND:-n}"
CONFIG_ARGS=${CONFIG_ARGS:-""}
+esceval() {
+    printf '%s\n' "$1" | sed "s/'/'\\\\''/g; 1 s/^/'/; $ s/$/'/"
+}
+
while [ "$#" -gt 0 ]
do
     case "$1" in
@@ -67,7 +71,7 @@ do
             if [[ "$1" = "start-dev" ]]; then
               CONFIG_ARGS="$CONFIG_ARGS --profile=dev $1"
             else
-              CONFIG_ARGS="$CONFIG_ARGS $1"
+              CONFIG_ARGS="$CONFIG_ARGS $(esceval "$1")"
             fi
           else
             SERVER_OPTS="$SERVER_OPTS $1"

This patch applies at least on Keycloak 22.