In `auth.Context`, the `Identity` field used to contain the original
caller identity and `User` field contained the mapped local user. These
are different, if the request comes from a remote trusted cluster.
Lots of code assumed that `auth.Context.Identity` contained the local
identity and used roles/traits from there.
To prevent this confusion, populate `auth.Context.Identity` with the
*mapped* identity, and add `auth.Context.UnmappedIdentity` for callers
that actually need it.
One caller that needs `UnmappedIdentity` is the k8s proxy. It uses that
identity to generate an ephemeral user cert. Using the local mapped
identity in that case would make the downstream server (e.g.
kubernetes_service) to treat it like a real local user, which doesn't
exist in the backend and causes trouble.
`ProcessKubeCSR` endpoint on the auth server was also updated to
understand the unmapped remote identities.
Co-authored-by: Andrew Lytvynov <andrew@goteleport.com>
The parameter `proxy_checks_host_keys` accepts only yes|no in the config file. If set to true you get the below error:
```
ERROR REPORT:
Original Error: *trace.BadParameterError proxy_checks_host_keys must be one of: yes,no
Stack Trace:
/go/src/github.com/gravitational/teleport/lib/services/clusterconfig.go:392 github.com/gravitational/teleport/lib/services.(*ClusterConfigV3).CheckAndSetDefaults
/go/src/github.com/gravitational/teleport/lib/services/clusterconfig.go:119 github.com/gravitational/teleport/lib/services.NewClusterConfig
/go/src/github.com/gravitational/teleport/lib/config/configuration.go:459 github.com/gravitational/teleport/lib/config.applyAuthConfig
/go/src/github.com/gravitational/teleport/lib/config/configuration.go:339 github.com/gravitational/teleport/lib/config.ApplyFileConfig
/go/src/github.com/gravitational/teleport/lib/config/configuration.go:1047 github.com/gravitational/teleport/lib/config.Configure
/go/src/github.com/gravitational/teleport/tool/teleport/common/teleport.go:170 github.com/gravitational/teleport/tool/teleport/common.Run
/go/src/github.com/gravitational/teleport/e/tool/teleport/main.go:22 main.main
/opt/go/src/runtime/proc.go:213 runtime.main
/opt/go/src/runtime/asm_amd64.s:1375 runtime.goexit
User Message: proxy_checks_host_keys must be one of: yes,no
```
