SEC-2711: Improve access to property springSecurityContextKey in HttpSessionSecurityContextRepository

Odilo Oehmichen (Migrated from SEC-2711) said:

Due to issue SEC-1695 the HttpSessionSecurityContextRepository got the property springSecurityContextKey which makes it possible to set the key under which the spring security context should be stored in the session at deployment time. - That's a good feature ;-)

In my current project we need to handle different security contexts in one Http-Session. Since the number of contexts (and their names) is not fully defined at deployment time, we can not use the solution provided in SEC-1695 (i.e. having an own SecurityContextRepository for each security context): We have to create the key at runtime. (Note: The project is part of a WCM environment).

For the HttpSessionSecurityContextRepository I see two possible improvement-levels:

Always access the property springSecurityContextKey using the public getter => make it possible to overwrite the behaviour of returning a contextKey in a subclass.

Introduce a new component SecurityContextKeyProvider which is responsible for generating the key - the default implementation just returns a static (but configurable) key.

Begin with HttpSessionSecurityContextRepository and the SEC-1695 context-key behavior described in the issue. Resolve whether getter overriding or a SecurityContextKeyProvider is intended, then define tests showing that distinct security contexts can use runtime-generated keys within one session.