Re: [keycloak-dev] UserSession changes required for SAML

There's a few problems with UserSession and AccessCode and screen flows * UserSession and AccessCode is hard wired to oauth protocol * userSession is not created until credentials have been entered * SAML has state that needs to hang around until final redirect back to client * Final redirect needs to know the protocol that started the login. * Screen flows assume various query parameters are set (client_id, etc.) So here's the changes: * UserSessions will be created when the login page is first visited if the user hasn't already logged in. * ClientSession will also be created when login page is visited. setAuthMethod for the ClientSession will be set so that later on, when the final redirect happens, the auth server will know which protocol to use * ClientSession will have a generic string hashmap (ClientSession.getNotes()) where you can store arbitrary state. (i.e. like HttpSession, but specific to the client). * ClientSession.getState() will be removed and put in ClientSession.getNotes() * AccessCode needs to expose the ClientSession instead of hiding and delegating to it. * Screen flows will access the ClientSession for all information required.