Spring Session integration only supports User as the principal

[fpavageau]

Summary

In a Spring Boot application using both Spring Security and Spring Session (with Redis and JSON serialization), a UsernamePasswordAuthenticationToken with a custom class as the principal can be serialized, but not deserialized.

Actual Behavior

The deserialization produces the following error:

Could not read JSON: Unexpected token (END_OBJECT), expected FIELD_NAME: missing property '@Class' that is to contain type id (for class java.lang.Object)\n at [Source: N/A; line: -1, column: -1] (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]); nested exception is com.fasterxml.jackson.databind.JsonMappingException: Unexpected token (END_OBJECT), expected FIELD_NAME: missing property '@Class' that is to contain type id (for class java.lang.Object)
at [Source: N/A; line: -1, column: -1] (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"])

Expected Behavior

Not getting an error when the session is deserialized from Redis.

Configuration

N/A

Version

Spring Security 4.2.2
Spring Session 1.3.0

Sample

N/A