Add Multi-factor Authentication Support

[jzheaux]

Related to spring-projects/spring-security-samples#351

Implement N authentication factors and they will be required in the order that they are declared:

http
    .authorizeHttpRequests((authorize) -> authorize.anyRequest()
        .access(allOf(hasAuthority("FACTOR_PASSWORD"), hasAuthority("FACTOR_OTT")))
    )
    .formLogin(Customizer.withDefaults())
    .oneTimeTokenLogin(Customizer.withDefaults())
    // ...

This will ask for a username/password first and a one-time token second. Thereafter, the user will be considered sufficiently authenticated.

Note that you can also publish an AuthorizationManagerFactory<Object> bean that checks for FACTOR_PASSWORD and FACTOR_OTT; however, this has not been added to this PR.

You can also specify a custom action to perform when a given factor is missing:

http
    .authorizeHttpRequests((authorize) -> authorize.anyRequest()
        .access(allOf(hasAuthority("FACTOR_PASSWORD"), hasAuthority("FACTOR_WEBAUTHN")))
    )
    .formLogin(Customizer.withDefaults())
    .webauthn((webauthn) -> ...)
    .exceptionHandling((exceptions) -> exceptions
        .defaultAuthenticationEntryPointFor(new LoginUrlAuthenticationEntryPoint("/webauthn"), "FACTOR_WEBAUTHN")
    )
    // ...

Note that authentication factors already integrate with defaultAuthenticationEntryPointFor in this PR. The above is needed for WebAuthn since it doesn't expose a custom entry point page in its DSL.

[rwinch]

Thanks for the PR @jzheaux! I've provided feedback inline.

[rwinch]

I've provided some additional feedback based upon your changes

[rwinch]

Thanks for the updates. I've provided some additional feedback inline

[rwinch]

I think we are very close now. I've provided feedback inline. In addition, can you please log a ticket to provide static constants for common factors?

[jzheaux]

Merged in 28aad88