gateway/manta: Add support for RBAC (#5332)

Manta has the ability to allow users to authenticate with a 
username other than the main account. We want to expose 
this functionality to minio manta gateway.

vendor/github.com/joyent/triton-go/authentication/private_key_signer.go

@@ -9,6 +9,7 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"path"
 	"strings"
 
 	"github.com/hashicorp/errwrap"
@@ -20,15 +21,23 @@ type PrivateKeySigner struct {
 	keyFingerprint          string
 	algorithm               string
 	accountName             string
+	userName                string
 	hashFunc                crypto.Hash
 
 	privateKey *rsa.PrivateKey
 }
 
-func NewPrivateKeySigner(keyFingerprint string, privateKeyMaterial []byte, accountName string) (*PrivateKeySigner, error) {
-	keyFingerprintMD5 := strings.Replace(keyFingerprint, ":", "", -1)
+type PrivateKeySignerInput struct {
+	KeyID              string
+	PrivateKeyMaterial []byte
+	AccountName        string
+	Username           string
+}
 
-	block, _ := pem.Decode(privateKeyMaterial)
+func NewPrivateKeySigner(input PrivateKeySignerInput) (*PrivateKeySigner, error) {
+	keyFingerprintMD5 := strings.Replace(input.KeyID, ":", "", -1)
+
+	block, _ := pem.Decode(input.PrivateKeyMaterial)
 	if block == nil {
 		return nil, errors.New("Error PEM-decoding private key material: nil block received")
 	}
@@ -51,13 +60,17 @@ func NewPrivateKeySigner(keyFingerprint string, privateKeyMaterial []byte, accou
 
 	signer := &PrivateKeySigner{
 		formattedKeyFingerprint: displayKeyFingerprint,
-		keyFingerprint:          keyFingerprint,
-		accountName:             accountName,
+		keyFingerprint:          input.KeyID,
+		accountName:             input.AccountName,
 
 		hashFunc:   crypto.SHA1,
 		privateKey: rsakey,
 	}
 
+	if input.Username != "" {
+		signer.userName = input.Username
+	}
+
 	_, algorithm, err := signer.SignRaw("HelloWorld")
 	if err != nil {
 		return nil, fmt.Errorf("Cannot sign using ssh agent: %s", err)
@@ -80,7 +93,13 @@ func (s *PrivateKeySigner) Sign(dateHeader string) (string, error) {
 	}
 	signedBase64 := base64.StdEncoding.EncodeToString(signed)
 
-	keyID := fmt.Sprintf("/%s/keys/%s", s.accountName, s.formattedKeyFingerprint)
+	var keyID string
+	if s.userName != "" {
+
+		keyID = path.Join("/", s.accountName, "users", s.userName, "keys", s.formattedKeyFingerprint)
+	} else {
+		keyID = path.Join("/", s.accountName, "keys", s.formattedKeyFingerprint)
+	}
 	return fmt.Sprintf(authorizationHeaderFormat, keyID, "rsa-sha1", headerName, signedBase64), nil
 }