Extend Docker authorization with TLS user information

Currently Docker authorization framework does not use any user
information, which already available in the Docker context for TLS
connection.
The purpose of this CR is to complete the existing authz work by adding
the basic client certificate details (SUBJECT_NAME) and authentication
method (TLS) to the authz request.

We think this should be the default behavior when no extended
authorization module is specified (currently WIP under #20883).

Signed-off-by: Liron Levin <liron@twistlock.com>
Upstream-commit: 3c157713b31f542a4180e31da4cae7d677330a6f
Component: engine

components/engine/api/server/middleware/authorization.go

@@ -13,11 +13,19 @@ import (
 func NewAuthorizationMiddleware(plugins []authorization.Plugin) Middleware {
 	return func(handler httputils.APIFunc) httputils.APIFunc {
 		return func(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-			// FIXME: fill when authN gets in
-			// User and UserAuthNMethod are taken from AuthN plugins
-			// Currently tracked in https://github.com/docker/docker/pull/13994
+
 			user := ""
 			userAuthNMethod := ""
+
+			// Default authorization using existing TLS connection credentials
+			// FIXME: Non trivial authorization mechanisms (such as advanced certificate validations, kerberos support
+			// and ldap) will be extracted using AuthN feature, which is tracked under:
+			// https://github.com/docker/docker/pull/20883
+			if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
+				user = r.TLS.PeerCertificates[0].Subject.CommonName
+				userAuthNMethod = "TLS"
+			}
+
 			authCtx := authorization.NewCtx(plugins, user, userAuthNMethod, r.Method, r.RequestURI)
 
 			if err := authCtx.AuthZRequest(w, r); err != nil {