cloudapi: Add x-rh-identity header filter

cmd/osbuild-composer/composer.go

@@ -111,17 +111,21 @@ func (c *Composer) InitAPI(cert, key string, l net.Listener) error {
 	c.api = cloudapi.NewServer(c.workers, c.rpm, c.distros)
 	c.koji = kojiapi.NewServer(c.logger, c.workers, c.rpm, c.distros)
 
-	tlsConfig, err := createTLSConfig(&connectionConfig{
-		CACertFile:     c.config.Koji.CA,
-		ServerKeyFile:  key,
-		ServerCertFile: cert,
-		AllowedDomains: c.config.Koji.AllowedDomains,
-	})
-	if err != nil {
-		return fmt.Errorf("Error creating TLS configuration: %v", err)
-	}
+	if len(c.config.ComposerAPI.IdentityFilter) > 0 {
+		c.apiListener = l
+	} else {
+		tlsConfig, err := createTLSConfig(&connectionConfig{
+			CACertFile:     c.config.Koji.CA,
+			ServerKeyFile:  key,
+			ServerCertFile: cert,
+			AllowedDomains: c.config.Koji.AllowedDomains,
+		})
+		if err != nil {
+			return fmt.Errorf("Error creating TLS configuration: %v", err)
+		}
 
-	c.apiListener = tls.NewListener(l, tlsConfig)
+		c.apiListener = tls.NewListener(l, tlsConfig)
+	}
 
 	return nil
 }
@@ -195,7 +199,7 @@ func (c *Composer) Start() error {
 			// Add a "/" here, because http.ServeMux expects the
 			// trailing slash for rooted subtrees, whereas the
 			// handler functions don't.
-			mux.Handle(apiRoute+"/", c.api.Handler(apiRoute))
+			mux.Handle(apiRoute+"/", c.api.Handler(apiRoute, c.config.ComposerAPI.IdentityFilter))
 			mux.Handle(kojiRoute+"/", c.koji.Handler(kojiRoute))
 
 			s := &http.Server{

cmd/osbuild-composer/config.go

@@ -15,6 +15,9 @@ type ComposerConfigFile struct {
 		AllowedDomains []string `toml:"allowed_domains"`
 		CA             string   `toml:"ca"`
 	} `toml:"worker"`
+	ComposerAPI struct {
+		IdentityFilter []string `toml:"identity_filter"`
+	} `toml:"composer_api"`
 }
 
 func LoadConfig(name string) (*ComposerConfigFile, error) {