UsernamePrincipal implements Serializable ?

[Cantor, Scott]

> I read the purposeful removing of Serializable as us saying we are not
> going to serialize that class, which I can not object to, because I do
> not grok our current approach to serialization. Mostly I am noting my
> lack of clarity.

That's exactly why I removed it. I don't like or trust Java object serialization, and I think it is brittle. So I don't want anything serializing objects to accidentally work.

My approach is simply "if I need serialization, write code to do so". Because I know that will work, and it will be understandable what the versioning issues are if and when that becomes an issue later.

I do think we need to look at pulling in a JSON library as a compact serialization format, though in most cases, XML will do fine for now.

The main model for serialization is the StorageSerializer<> interface I designed. That will work directly with the storage layer, or can be used to generate just part of an overall stored record and put together by a higher level piece of code.

So if you look at the AuthenticationWorkflowDescriptor class, it carries a slot for a StorageSerializer that would be injected to handle serializing any data that makes up an AuthenticationEvent produced by that workflow. That's what will handle serializing the Subject. Of course, a simple one that handles the built-in objects we define will be provided that won't require custom work.

-- Scott