identity propagation in ssh secrets engine

[fredrikhgrelland]

Is your feature request related to a problem? Please describe.
At the moment it is not possible to enforce identity mapping from vault to ssh login using the ssh secrets engine for CA authentication. When creating a ssh signing role; setting allowed_users to '*' enables anyone attached to this role to impersonate any os user.

Describe the solution you'd like
Extending the allowed_users field with a new special character '?'
In path_sign.go we test the valid_principals filed against the authenticated users name.
The resulting signed public key will contain only the authenticated users name.

Describe alternatives you've considered
In order to enforce vault user to os user mapping we must create one role pr user. This does not scale and requires puppet or the like to update the trusts in each and every server.

Additional context
Implementation in PR relies on parsing the request DisplayName, as I could not find any way of accessing Identity alias or the like from this context.

[fredrikhgrelland]

PR: #7548

[jefferai]

More or less a duplicate of #6056.

[michelvocks]

Closing this in favor of #6056