Update subject on client session if it deviates from the on RunContext

This happens if an AccessController updates the subject.

393222

Author: work-lto

org.eclipse.scout.rt.server.commons/src/main/java/org/eclipse/scout/rt/server/commons/authentication/IAccessController.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2023 BSI Business Systems Integration AG
+ * Copyright (c) 2010, 2026 BSI Business Systems Integration AG
  *
  * This program and the accompanying materials are made
  * available under the terms of the Eclipse Public License 2.0
@@ -38,13 +38,7 @@
  */
 @Bean
 public interface IAccessController {
-
-  /**
-   * Allows to inform the {@link org.eclipse.scout.rt.ui.html.IUiSession} that a new Subject is created by an
-   * {@link IAccessController} that should be updated on the {@link org.eclipse.scout.rt.client.IClientSession}
-   */
-  String UPDATED_SUBJECT = "scout.authentication.updatedSubject";
-
+  
   /**
    * Invoke to authenticate the given {@link HttpServletRequest}.
    * <p>

org.eclipse.scout.rt.ui.html/src/main/java/org/eclipse/scout/rt/ui/html/UiSession.java

@@ -63,7 +63,6 @@
 import org.eclipse.scout.rt.platform.util.concurrent.FutureCancelledError;
 import org.eclipse.scout.rt.platform.util.concurrent.ThreadInterruptedError;
 import org.eclipse.scout.rt.platform.util.concurrent.TimedOutError;
-import org.eclipse.scout.rt.server.commons.authentication.IAccessController;
 import org.eclipse.scout.rt.server.commons.servlet.CookieUtility;
 import org.eclipse.scout.rt.server.commons.servlet.HttpClientInfo;
 import org.eclipse.scout.rt.server.commons.servlet.UrlHints;
@@ -812,8 +811,7 @@ public JSONObject getAlreadyProcessedResponse(JsonRequest jsonRequest) {
 
   /**
    * Verifies if an access controller has created a new {@link Subject} and replaces the current one on the
-   * {@link IClientSession} with the new one. An {@link IAccessController} can request this by setting the
-   * {@link IAccessController#UPDATED_SUBJECT} attribute on the request.
+   * {@link IClientSession} with the new one.
    */
   @Override
   public void verifySubject(HttpServletRequest request) {
@@ -824,7 +822,7 @@ public void verifySubject(HttpServletRequest request) {
     if (subject == null) {
       return;
     }
-    if (request.getAttribute(IAccessController.UPDATED_SUBJECT) != null) {
+    if (!ObjectUtility.equals(subject, m_clientSession.getSubject())) {
       m_clientSession.setSubject(subject);
     }
   }