Spring Security OAuth2-存储的身份验证对象

Question

I am currently using a fairly vanilla setup of Spring Security Oauth2 version 2.0.7.RELEASE with a JdbcTokenStore and have recently encountered an interesting issue.

I understand that as an access token is created and stored, the Authentication object is serialized and also persisted to the database. I understand that this is necessary and used when an access token is later used in a request. The issue is that my Authentication object (a custom impl of Spring Security's UserDetails interface) has is associated to other objects in my application's domain. (sample object graph might look like Authentication -> com.myapp.User -> com.myapp.PhoneNumber)

I've had to make some changes to the implementation said objects and noticed that Authentication objects serialized and stored to the database prior to my change no longer deserialize, which make sense because my object model has changed.

What is a recommended way for managing this scenario? Is there a way to get the Authentication object to serialize to JSON and not binary? I am leaning towards removing my custom information from my Authentication object but am wondering if there is a better approach?

Answer 1

To close the loop - the approach I ended up using was to extend JdbcTokenStore and to override the methods serializeAuthentication and deserializeAuthentication to perform serialization / deserialization using Jackson. Then in my object model, I @JsonIgnore 'd the entities that are not really needed in authenticating a user.