CrowdSSOAuthenticationToken is not serializable, which can lead to errors when using a session-replicating springsecurity integration

XMLWordPrintable

    • 2
    • Severity 3 - Minor
    • 2

      CrowdSSOAuthenticationToken is declared serializable, but the Principal it stores (CrowdUserDetails) is not.

      This gets saved to the HTTP session, and can lead to errors when trying to use Crowd's Spring Security integration with a solution that does attempt to serialize the session (for example for session replication)

            Assignee:
            Konrad Paniec (Inactive)
            Reporter:
            Lukasz Pater
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: