dbeaver/pro#7343 add additional validation for token auth (#3876)

Co-authored-by: Evgenia <139753579+EvgeniaBzzz@users.noreply.github.com>

server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/auth/SMAuthProviderExternal.java

@@ -74,4 +74,8 @@ public interface SMAuthProviderExternal<AUTH_SESSION extends SMSession> extends
      */
     default void postAuthentication() {}
 
+    @Override
+    default boolean supportsOpeningSessionAsChild() {
+        return true;
+    }
 }

server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java

@@ -101,6 +101,11 @@ public class LocalAuthProvider implements SMAuthProvider<LocalAuthSession>, SMBr
 
     }
 
+    @Override
+    public boolean supportsOpeningSessionAsChild() {
+        return false;
+    }
+
     public static boolean changeUserPassword(@NotNull WebSession webSession, @NotNull String oldPassword, @NotNull String newPassword) throws DBException {
         String userName = webSession.getUser().getUserId();
 

server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java

@@ -2472,6 +2472,13 @@ public class CBEmbeddedSecurityController<T extends ServletAuthApplication>
                 if (autoAssign != null && CommonUtils.isNotEmpty(autoAssign.getAuthRoleAssignReason())) {
                     log.info(activeUserId + " authenticated with role " + autoAssign.getAuthRole() + ", reason: " + autoAssign.getAuthRoleAssignReason());
                 }
+            } else {
+                SMAuthProvider<?> authProviderInstance = authProvider.getInstance();
+                if (!authProviderInstance.supportsOpeningSessionAsChild()) {
+                    var error = "Auth provider '" + authProviderId + "' doesn't support opening as a child session";
+                    updateAuthStatus(authId, SMAuthStatus.ERROR, dbStoredUserData, error, null);
+                    return SMAuthInfo.error(authId, error, isMainAuthSession, null, authInfo.getAppSessionId());
+                }
             }
             dbStoredUserData.put(
                 authConfiguration,