}

	return &security.Caller{
		AuthSource: security.AuthSourceClientCertificate,
		Identities: ids,
	}, nil
}

// authenticateHTTP performs mTLS authentication for http requests. Requires having the endpoints on a listener
// with proper TLS configuration.
func (cca *ClientCertAuthenticator) authenticateHTTP(req *http.Request) (*security.Caller, error) {
	if req.TLS == nil || req.TLS.VerifiedChains == nil {

	if authCtx.GrpcContext != nil {
		return f.authenticateGrpc(authCtx.GrpcContext)
	}
	if authCtx.Request != nil {
		return f.authenticateHTTP(authCtx.Request)
	}
	return nil, nil
}

func (f *FakeAuthenticator) authenticateHTTP(req *http.Request) (*Caller, error) {
	return nil, errors.New("not implemented")
}

func (f *FakeAuthenticator) authenticateGrpc(ctx context.Context) (*Caller, error) {

	if authRequest.GrpcContext != nil {
		return a.authenticateGrpc(authRequest.GrpcContext)
	}
	if authRequest.Request != nil {
		return a.authenticateHTTP(authRequest.Request)
	}
	return nil, nil
}

func (a *KubeJWTAuthenticator) authenticateHTTP(req *http.Request) (*security.Caller, error) {
	targetJWT, err := security.ExtractRequestToken(req)
	if err != nil {