Support Bearer token authentication

Rather than relying on underlying SSH and username/password authentication it would be nice to tie into existing SSO systems that enforce stronger authentication like MFA, password strength/rotation requirements etc.

OAuth2 access tokens are one way to do this.

The chisel server could validate a bearer JWT on the request, given a JWKS / well-known URL, and possibly a set of claims to check for authorization.

The best way to do this would be through go plugins, where you would specify the path to a plugin as a server argument.
That would give more flexibility to supply custom validation logic, where anyone can write and supply their own plugin without having to fork Chisel itself.

I'm not sure where I'd draw the line between plugin and chisel though. Custom logic for checking claims etc. would live in the plugin. It might be reasonable to have base checks for a bearer token itself in Chisel though (valid signature, not expired etc.)

The client would not need to change itself, as the client already supports passing custom headers at runtime.
So you would have some kind of wrapper that handles authorization and then passes a header to the Chisel client for the bearer token.

The issue names no files or tests. Start at the Chisel server authentication entry point and evaluate the proposed Go plugin boundary, JWT validation through a JWKS or well-known URL, and claim checks; the client already supports custom headers. Done would require a settled server-side design and implementation without client changes.