type AuthenticatorConfig struct {
	Anonymous                   bool
	AnyToken                    bool
	BasicAuthFile               string
	ClientCAFile                string
	TokenAuthFile               string
	OIDCIssuerURL               string
	OIDCClientID                string
	OIDCCAFile                  string
	OIDCUsernameClaim           string
	OIDCGroupsClaim             string
	ServiceAccountKeyFiles      []string
	ServiceAccountLookup        bool
	ServiceAccountTokenGetter   serviceaccount.ServiceAccountTokenGetter
	KeystoneURL                 string
	KeystoneCAFile              string
	WebhookTokenAuthnConfigFile string
	WebhookTokenAuthnCacheTTL   time.Duration

	RequestHeaderConfig *RequestHeaderConfig
}

type RequestHeaderConfig struct {
	// UsernameHeaders are the headers to check (in order, case-insensitively) for an identity. The first header with a value wins.
	UsernameHeaders []string
	// ClientCA points to CA bundle file which is used verify the identity of the front proxy
	ClientCA string
	// AllowedClientNames is a list of common names that may be presented by the authenticating front proxy.  Empty means: accept any.
	AllowedClientNames []string
}