feat: add authentication client with middleware integration

Implement complete authentication system with challenge-response protocol,
TPM2_Certify-based proof-of-possession, automatic token management, and
configurable TLS security (secure by default).

- AuthenticationClient with configurable API versioning (default: v3.0)
- Authentication middleware for ResilientClient with auto token refresh
- Async TPM operations trait with mock and real implementations
- JSON:API compliant serialization and graceful unenrolled agent handling
- Automatic retry with exponential backoff on authentication failures
- Configurable TLS certificate validation (default: secure, opt-in insecure for testing)
- Security warnings emitted once at agent startup when insecure TLS settings enabled

Assisted-by: Claude 4 Sonnet
Signed-off-by: Sergio Correia <[email protected]>

Author: sergio-correia

Cargo.lock

@@ -368,3 +368,13 @@ measuredboot_ml_path = "default"
 # To override attestation_interval_seconds, set
 # KEYLIME_AGENT_ATTESTATION_INTERVAL_SECONDS environment variable.
 attestation_interval_seconds = 60
+
+# Enable challenge-response authentication for push model attestation.
+# When enabled, the agent will authenticate with the verifier using TPM-based
+# proof of possession before sending attestation evidence.
+# This option is specific to the push attestation model.
+# The default is false (disabled).
+#
+# To override enable_authentication, set
+# KEYLIME_AGENT_ENABLE_AUTHENTICATION environment variable.
+enable_authentication = false

keylime-agent.conf

@@ -31,6 +31,9 @@ url.workspace = true
 actix-rt.workspace = true
 tempfile.workspace = true
 wiremock = {version = "0.6"}
+# Dependencies for examples (auth_test)
+tracing = "0.1"
+tracing-subscriber = "0.3"
 
 
 [features]

keylime-push-model-agent/Cargo.toml

@@ -29,6 +29,8 @@ pub struct NegotiationConfig<'a> {
     pub avoid_tpm: bool,
     pub ca_certificate: &'a str,
     pub client_certificate: &'a str,
+    pub enable_authentication: bool,
+    pub agent_id: &'a str,
     pub ima_log_path: Option<&'a str>,
     pub initial_delay_ms: u64,
     pub insecure: Option<bool>,
@@ -39,6 +41,8 @@ pub struct NegotiationConfig<'a> {
     pub uefi_log_path: Option<&'a str>,
     pub url: &'a str,
     pub verifier_url: &'a str,
+    pub tls_accept_invalid_certs: bool,
+    pub tls_accept_invalid_hostnames: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -59,22 +63,47 @@ impl AttestationClient {
                     key: config.key.to_string(),
                     insecure: config.insecure,
                     timeout: config.timeout,
+                    accept_invalid_hostnames: config
+                        .tls_accept_invalid_hostnames,
                 },
             )?)
         } else {
             None
         };
 
-        debug!("ResilientClient: initial delay: {} ms, max retries: {}, max delay: {:?} ms", 
+        debug!("ResilientClient: initial delay: {} ms, max retries: {}, max delay: {:?} ms",
             config.initial_delay_ms, config.max_retries, config.max_delay_ms);
-        let client = ResilientClient::new(
+
+        // Create authentication config if enabled
+        let auth_config = if config.enable_authentication {
+            info!("Authentication ENABLED - creating auth middleware");
+            Some(keylime::auth::AuthConfig {
+                verifier_base_url: config.verifier_url.to_string(),
+                agent_id: config.agent_id.to_string(),
+                api_version: None, // Use default v3.0
+                avoid_tpm: config.avoid_tpm,
+                timeout_ms: keylime::config::DEFAULT_AUTH_TIMEOUT_MS,
+                max_auth_retries: keylime::config::DEFAULT_AUTH_MAX_RETRIES,
+                accept_invalid_certs: config.tls_accept_invalid_certs,
+                accept_invalid_hostnames: config.tls_accept_invalid_hostnames,
+            })
+        } else {
+            debug!("Authentication DISABLED - no auth middleware");
+            None
+        };
+
+        let client = ResilientClient::new_with_auth(
             base_client,
+            auth_config,
             Duration::from_millis(config.initial_delay_ms),
             config.max_retries,
             // The success codes that stop retries
             &[StatusCode::OK, StatusCode::CREATED, StatusCode::ACCEPTED],
             config.max_delay_ms.map(Duration::from_millis),
-        );
+        )
+        .map_err(|e| {
+            anyhow::anyhow!("Failed to create resilient client: {}", e)
+        })?;
 
         Ok(AttestationClient { client })
     }
@@ -244,6 +273,8 @@ mod tests {
             avoid_tpm: true,
             ca_certificate: ca_path,
             client_certificate: cert_path,
+            enable_authentication: false, // Disabled by default for tests
+            agent_id: "test-agent-id",
             ima_log_path: None,
             initial_delay_ms: 0, // No initial delay in the old tests
             insecure: Some(false),
@@ -254,6 +285,8 @@ mod tests {
             uefi_log_path: None,
             url,
             verifier_url: "http://verifier.example.com",
+            tls_accept_invalid_certs: false,
+            tls_accept_invalid_hostnames: false,
         }
     }