[Do not merge] Identity templating support for allowed_domains-option for PKI secret engine's issue API call

[andrejvanderzee]

This MR applies identity templating to the allowed_domains option of the PKI secret engine's issue API call. For example, the PKI secret engine configuration below only allows domains that are equal to the auth method alias's name.

secret_engine "k8s-apiserver" {
   ...
  path "roles/devops" {
    allowed_domains = "{{identity.entity.aliases.auth_plugin_05c79452.name}}"
    enforce_hostnames = false
    allow_bare_domains = true
    server_flag = false
    client_flag = true
  }
}

This is an improvement over the allow_token_displayname, which is considered insecure and deprecated, in favor of using exported entity data with more attributes like aliases and metadata, from the authentication methods to secret engines.

We have tested the MR at our testing environment, and it works as a solution for #6457.

[andrejvanderzee]

@jefferai Does this PR cover what you suggested about applying identity templating to CN constraints? Thanks.

[andrejvanderzee]

@jefferai We still require a way to impose constraints on the CN of a PKI's issue API call. Would this MR based on identity templating cover what you suggested in #4157 (comment)?

Dont mind changing to explicit role parameters either. But the problem is at this moment is that we can only use the deprecated allow_token_displayname to mitigate impersonation via a false CN.

[jefferai]

The mechanics are fine, I think there is just a larger question on which parameters such templating should be activated (existing, new, or both), and whether by default or not.

[dustin-decker]

This PR looks good to me. It satisfies multiple feature requests and @jefferai's request for implementation via identity templating. I think it would be nice to enable identity templating on all RDNs, but CN is definitely the most common one, so can we start with that? I think enabled by default is fine, since it's controlled by the PKI role.

[jdollard]

I've got a need to use support for templated roles in the allowed_uri_sans field too. I'm happy to extend this pull request and add support for this, plus also a unit test, early next week.

[jdollard]

I created #7216 based off this PR. The new pull request includes template support for the allowed_uri_sans field and adds tests. It also avoids a null pointer dereference if EntityInfo returns nil, which may happen if token auth is being used.

I wasn't sure if creating a new PR or trying to get this one updated was the right approach. I decided to go ahead and make another PR, and can always cancel it if this PR is updated.

[carnei-ro]

Waiting for this feature!

[CH-rahulprabhu]

me too

[adammw]

What was blocking this feature going forward? Any way to unblock those discussions?

[ncabatoff]

Closing because the PR author has a newer PR that implements the same feature (#8509).

[pbernal]

Closing due to Nick's previous comment.