* identifier: add TLSBased
This is only the identifier, the server setup still has to be done.
Note that it diverges a little from what was proposed in the issue:
not every client cert needs to have a CN record -- so instead, we'll
use whatever is the cert's subject as client identity.
* Drive-by fix: identifier_test: don't use same package for TokenBased
tests.
* server: require and verify client cert for AuthenticationTLS
* server: allow setting CA pool via --tls-ca-cert-file
* server: expose new authentication via parameter
* [nit] server: simplify getListenerForHTTPServer
* server_test: use httptest for integration-y TLS tests
* book/security: mention TLS authn with example
Signed-off-by: Stephan Renatus <srenatus@chef.io>
With these changes, the identity will be undefined if a token is not
specified. This is less surprising than the empty string that would be
set prior to these changes.
Fixes#901
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Stephan Renatus