[ENH] ✨ Store certificate fingerprint without prefix in inseePropriete

[Mandrak-Kimigo]

Description

Closes #988

Keycloak's X.509 authentication module needs to look up a user from the raw SHA-256 fingerprint of the presented certificate, without knowing or reconstructing the existing certificateId$ prefix used in inseePropriete.

This PR adds the plain fingerprint <fingerprint> as a second value of the multivalued inseePropriete attribute, alongside the existing certificateId$<fingerprint> value:

• updateUserCertificate: adds both values when a new certificate is set, and deletes both values (old fingerprint) when replacing an existing certificate.
• deleteUserCertificate: deletes both values when removing a certificate.

Scope

• sugoi-api-ldap-store-provider/src/main/java/fr/insee/sugoi/store/ldap/LdapWriterStore.java

Out of scope

• No new configuration key added, no documentation update needed.
• No test added (none existed previously for these methods).

Checklist

• Linked to an issue (Store the certificate's SHA-256 fingerprint without prefix in inseePropriete (Keycloak X.509 authentication support) #988)
• mvn spotless:apply applied
• Commits signed-off (DCO)
• Tests updated/created (not applicable — no prior test coverage)

[clement-dufaure]

Does it work if one of both values doesnt exist ?

[Mandrak-Kimigo]

No, you're right
I'm splitting the plain fingerprint deletion into a separate request that tolerates NO_SUCH_ATTRIBUTE, so it won't break on existing data. Pushing a fix.

[clement-dufaure]

not working case : an existing account created before this pr with a certificate has only the certificateId$... property.
After PR, this line try to remove two values, one with, one without certificateId, but the one without certificateId doesnt exist, so the modification fails.

[clement-dufaure]

ok, so i think we can use your new method on the previous deletion of certificateId$ to be more readable

[Mandrak-Kimigo]

Fixed — both values now go through the same tolerant deletion helper. Pushed.