Identity Restoration where the Principal is not quite enough.

Presently our authentication process is build around a SecurityRealm being able to create a RealmIdentity which we then convert to an AuthorizationIdentity which is then converted to a SecurityIdentity after applying appropriate SecurityDomain configured mappings.

Generally in a SecurityRealm one of two different methods tend to be used to create the RealmIdentity.

RealmIdentity getRealmIdentity(Principal principal) throws RealmUnavailableException

or

RealmIdentity getRealmIdentity(Evidence evidence) throws RealmUnavailableException

Generally from the realms we know about, where the Principal form of the method is used the realm will likely load the attributes that go into the AuthorizationIdentity from another source, however for the form that takes Evidence often the attributes can be derived from the evidence.

Where we persist identities to be restored later such as identity propagation, batch, clustering etc we persist the name of the identity and use it to restore the identity using the Principal form of the above methods. For cases where an identity was originally created using evidence we no longer have sufficient information to recreate the identity.

This Enhancement is to review how we can address this.