Missing sid- and auth_time-claims in ID-token in case of WebAuthn

[alsha]

Describe the bug
After signing in with WebAuthn, the OIDC id_token is missing the sid and auth_time claims.
In the same setup, a username/password login includes both claims as expected.
This leads to inconsistent ID token contents depending on the authentication method.

To Reproduce

1. git clone https://github.com/alsha/sas-webauthn-idtoken-repro
2. cd sas-webauthn-idtoken-repro
3. mvn test

Cause of the issue
The problem appears to be related to the implementation of the SpringSessionBackedSessionRegistry.name(...) method.
SessionRegistryImpl behaves correctly.

Expected behavior
sid and auth_time should be present in the OIDC id_token after successful WebAuthn login as well, same as after username/password login.

Sample

https://github.com/alsha/sas-webauthn-idtoken-repro

[jyx-07]

I was able to reproduce this issue with the provided sample project.

From initial debugging, this seems related to how SpringSessionBackedSessionRegistry resolves the authenticated principal after WebAuthn login, which may prevent sid and auth_time from being added during ID token generation.

I’m investigating further and may open a PR if I can identify a proper fix.