Enable resetting application context user to null

[StefanOssendorf]

Set application context user to an unauthenticated claims principal when FlowSecurityPrincipalFromClient is enabled.

Fixes #4410

[rockfordlhotka]

This is in the clear context method - which is there to ensure nothing is left on the server once the data portal operation is complete.

I'm wondering why it matters if the value is left as a null, because nobody should be using it anyway - we're just cleaning up at this point, immediately before leaving the server to return to the client.

[StefanOssendorf]

This is in the clear context method - which is there to ensure nothing is left on the server once the data portal operation is complete.

I'm wondering why it matters if the value is left as a null, because nobody should be using it anyway - we're just cleaning up at this point, immediately before leaving the server to return to the client.

It matters because we have implementations which don't accept null as a new principal on the application context.

Edit: I'll make it null again, because with my Core-NRT changes it'll be null too 😅

[StefanOssendorf]

Converted the PR to draft.
I'm adding tests to ensure the context managers can handle null as a value.
But the InMemory Contextmanager can't handle that case. Only a ClaimsPrincipal. I think we should default to an empty/unauthenticated ClaimsPrincipal to reduce the error cases.

[StefanOssendorf]

So. I kept the User = null; to make it less impactful on our users. The ApplicationContext now handles the null and translates it into a ClaimsPrincipal(PrincipalIdentity).

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.