Introduce new CUSTOM_LOOKUP and CUSTOM_LOOKUP_FULL Account Resolvers

[ghstahl]

issue

Signed-off-by: Your Name your.email@example.com

[aricart]

I made a proof of concept of implementing dynamic account creation using the callout feature. That would be a simpler mechanism without having to modify the server.

aricart/callout.go#11

[shaunco]

@aricart - Thanks for the example, but requiring every single IoT device in our environment to be pre-seeded with a sentinel.creds file, and potentially having 100k+ leaf-nodes drop offline if that file ever changes, seems extremely impractical. Why can't the sub, signing_keys, auth_users from the sentinel.creds file's JWT be specified in the cluster config just like we can with static accounts and an authorization block? Why make us distribute creds file to every leaf node when we only have 1? When we try we get:

nats-server: operators do not allow authorization callouts to be configured directly

Maybe I'm missing something here in the NATS auth design, but if we want to own auth_callout and the account resolver, why do we need to get involved in the operator/NSC/creds file complexity? We have a very different definition of "simpler mechanism" when we're looking to own all auth/accounts and your version brings in 13 nsc calls and a creds file that must be distributed to a large number of physically inaccessible devices.

[aricart]

@ghstahl can you reach out to me in slack?