Allow retrieving username from SAML Assertion Attributes

[palakova]

Expected Behavior

Username (in the sense of Principal Name) can be released by IdP AuthnRequest's Assertion in NameID element or one of the Attribute element instead. NameID, if present (as it is even optional, as also discussed in #11463), can be of different Format, holding different kind of values.

It would be nice to have a more convenient way to configure where to retrieve the username from - NameID element versus providing a Name of an Assertion Attribute that is expected to hold the username.

Current Behavior

Spring SAML considers only NameID element to hold username, and populates Saml2AuthenticatedPrincipal#name with NameID value in OpenSaml4AuthenticationProvider.

Context

Example for integration with Shibboleth: IdP releases NameID Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient (according to SAML spec, this indicates that the content of the element is an identifier with transient semantics and SHOULD be treated as an opaque and temporary value by the relying party). Username is released in one of Assertion Attribute instead.

Workaround: custom responseAuthenticationConverter to retrieve username from Attribute

[AkashB23]

@jzheaux in which version will the changes be available for adoption ?