APP-2846: Obo Certificate Authentication

[symphony-hong]

Create AuthSessionOboCerImpl implements the AuthSession to represent
a authsession after a bot authenticate OBO user

OboAuthenticatorCertImpl implements the OboAuthenticator for handling
the Obo authentication stuff for a bot using Certificate

In ApiClientFactory, create a method ApiClientFactory#getExtAppSessionAuthClient
to get a dedicated sessionauth client for extension app authentication configured
with the keystore of the extension app and the password

In AuthenticatorFactory, check if the extension app is configured with
certificate or not. If yes, AuthenticatorFactory#getOboAuthenticator returns
an OboAuthenticatorCertImpl, otherwise, returns an OboAuthenticatorRsaImpl

Unittest added

Javadoc added

[symphony-elias]

Could we find a way to extract this logic ? Only difference is the message in the AuthUnauthorizedException.

[symphony-hong]

I think we are fine with the current code. It's not a big block of code at all. 🤔

[thibauult]

LGTM 👍

[symphony-youri]

in term of configuration should'nt we have something like:

username: "mybot"
certificate:
path:
password

repeating the same prefix is often the sign that a sub structure should be used

but then to be consistent you would wonder if privateKeyPath should a privateKey item with a path sub item....
could we have other settings for a private key?

[symphony-youri]

do we have that NonNull annotation on purpose (vs the javax one)?
if so maybe we should explicit when we use that one vs the other

[thibauult]

Import issue I guess, should be javax.annotation.Nonnull

[symphony-youri]

NonNull from lombok actually helps us validate the configuration which could be useful here
(Although we perhaps want to provider our own validation for more complex use cases and checks or use javax validation)

[thibauult]

Following @symphony-youri's comment below, I also think that we should change our configuration model to:

bot:
  username: 'my-bot'
  rsa:
    privateKeyPath: 
    privateKeyContent: 
  certificate:
    path: 
    password: 

[symphony-youri]

but then should it be:

bot:
  username: 'my-bot'
  rsa:
    privateKey:
       path: / or content: 
  certificate:
    path: 
    password: 

😅

or maybe just rsa.path / rsa.content ? (and by the way is it really rsa or the notion of public/private keys? might be another algorithm)

so maybe just privateKey.path / privateKey.content?