SEC-1892: Make the client certificate authentication enterprise ready

Michael Furman (Migrated from SEC-1892) said:

Dear Luke,
During my work with our enterprise customers I have found the following:

1. It is common case when the client certificate authentication performed by a front end web server (IIS or Apache)
2. It is common case when the user identifier is stored in the Subject Alternative Name of the client certificate.
3. When the user identifier is stored in the Subject of the client certificate it can be stored in e-mail, CN or in the hold Subject
   See the attached x509Examples.docx
   I recommend to improve the Spring Security client certificate authentication:
4. Use ClientCertificateRetriever to be able to get X509Certificate from the String attribute
   Note: When authentication is performed by IIS or Apache it can come as the String type (not as X509Certificate type)
5. Use SubjectAlternativeNameRetriever and SubjectDnRetriever to extract the user identifier from Subject Alternative Name or Subject respectively
6. The configuration of SubjectAlternativeNameRetriever and SubjectDnRetriever is very simple - the end user need to configure what he / she see in the client certificate window (as in attached examples)
   The attached code already works more than year at production in more than one customer.
   If you will agree for my contribution I will continue the refactoring:
7. Will update the configuration schema (with your help)
8. Will update AuthenticationConfigBuilder to create SubjectAlternativeNameRetriever or SubjectDnRetriever depends on the configuration
9. Will change names from *Retriever to *Extractor
10. Will create the first draft of the documentation
    Waiting for your comments.
    Best regards,
    Michael

The issue names client certificate authentication and AuthenticationConfigBuilder but provides no repository file or test paths. Start by locating those entry points and reviewing the attached x509Examples.docx; completion would span certificate retrieval, configuration schema, builder changes, naming updates, and documentation, subject to maintainer agreement.