The property [`UserInfoEndpoint.userNameAttributeName`](https://github.com/spring-projects/spring-security/blob/7.0.0-M1/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java#L302) is [used](https://github.com/spring-projects/spring-security/blob/7.0.0-M1/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/userinfo/OidcUserRequestUtils.java#L82) to resolve the username from the even when the user info endpoint is not invoked ([imperative](https://github.com/spring-projects/spring-security/blob/7.0.0-M1/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/userinfo/OidcUserService.java#L114) / [reactive](https://github.com/spring-projects/spring-security/blob/7.0.0-M1/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/userinfo/OidcReactiveOAuth2UserService.java#L116)). The attribute should either: 1) Only be used when the user info endpoint is invoked (when not invoked it would always use `IdTokenClaimNames.SUB`). This would be a breaking change or 2) Be relocated to a place that is not specific to the user info endpoint. In this case, we could address this at the same time as the deprecation in gh-16857 Note that this decision blocks gh-16857 since the [`usernameExpression`](https://github.com/spring-projects/spring-security/pull/16857/files#diff-c6947080fb4a385966afee5999dac1b734c5869f84c155e25b1390eacb65187aR306) might need moved off of the `UserInfoEndpoint`. cc @jgrandja