Allow mapping of UserSessionNotes into UserInfo

[sonOfRa]

Fixes #15369

Simply adds the interface as a marker, which is then picked up by OIDCAttributeMapperHelper#addIncludeInTokensConfig to add the configuration option automatically.

[thomasdarimont]

This seems to be a duplicate of #15263

[mposolda]

@thomasdarimont Thanks for pointing that!

@sonOfRa This PR may require test (see #15263 for the details). I am keeping this PR open for now. When test is added, we can merge that one PR, which will first add a test :-) Another hint: AbstractKerberosSingleRealmTest.credentialDelegationTest() uses UserSessionNote mapper under the covers. Maybe it helps to just add userInfo request into that test to make sure that claim is returned in userInfo?

[sonOfRa]

I added a test as an additional test in AbstractKerberosSingleRealmTest, thanks for pointing me in the right direction.

That required a bit of fiddling with the SPNEGO helper methods so I could actually get the access token as a string, rather than just the parsed object.

I also added an overload to UserSessionNoteMapper.createClaimMapper(...) which retains the old behaviour for the old method call (no adding of claims to the userinfo endpoint by default), and adds a userInfo parameter so the behaviour can be toggled.

[mposolda]

@sonOfRa Thanks! Overaly looks like you're in good direction. Would be just good to avoid introducing so much code duplicities and instead re-use as much as possible for various tests - added some inline comments regarding that.

[mposolda]

IS it possible to update existing method assertSuccessfulSpnegoLogin to use your newly added method to avoid so much code duplications?

I am thinking about something around:

 protected AccessToken assertSuccessfulSpnegoLogin(String clientId, String loginUsername, String expectedUsername, String password) throws Exception {
        OAuthClient.AccessTokenResponse tokenResponse = assertSpnegoLoginTokenResponse(.. arguments of your new method here ...;

        AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
        Assert.assertEquals(userId, token.getSubject());
        Assert.assertEquals(expectedUsername, token.getPreferredUsername());
         return token;
}

[sonOfRa]

I got rid of that method entirely. The return value AccessToken is only used in one other test, which I adjusted by adding an addition oauth.verifyToken(response.getAccessToken()) call there.

This feels much cleaner to me, and with relatively minimal overhead of running an extra token verification in a few cases.

[mposolda]

Is it possible to use existing method credentialDelegationTest() and just add the call to userInfo to that method?

I know that you need to use AccessTokenResponse, but you can possibly just use your new method to retrieve AccessTokenResponse and then do simply:

AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());

And then you have both tokenResponse and token though?

[sonOfRa]

Done, integrated the test into the existing credentialDelegationTest()

[mposolda]

@sonOfRa That works, Thanks! I hope to merge once tests are OK