Spring UserDetailsService is not Serializable session attribute in google-apps-engine

Question

Here we have a Spring based webapp in google apps engine.

I've created a UserDetailService class to load the UserDetails from the GAE data store (assuming this is the best approach).

@Service("springUserDetailsService")
public class SpringUserDetailsService implements UserDetailsService {

    @Resource(name="userDao")
    private IUserDao userDao;
    //...

But GAE throws the following exception (apparently) when it tries to persist the session to the data store.

java.lang.RuntimeException: java.io.NotSerializableException: com.prepayproxy.servicelayer.SpringUserDetailsService
    at com.google.apphosting.runtime.jetty.SessionManager.serialize(SessionManager.java:387)
    at com.google.apphosting.runtime.jetty.SessionManager.createEntityForSession(SessionManager.java:364)

I first thought to Serialize the SprintUserDetailsService object, but it has a reference to my UserDao, which in turn has references to data source objects, at about that point I freaked out and decided to see if there's a better approach.

Answer 1

Two options:

• don't worry about the DataSource - spring, since version 3, serves a proxy which, when deserialized, gets a fresh data source, rather than the original (which is not relevant)

• don't put your service in the session. Perhaps it is referenced by something that is in session scope, so make it volatile there.

See also this question

Answer 2

On your second point, I am only assuming that spring security is storing a reference to the UserDetailsService in the session, which is how it gets tied up with the GAE serialization of the session. All beyond my control as far as I see unless I missed something.

There's no reason for SpringSecurity to put a reference to your application's UserDetailsStore into the session. A UserDetailsStore is not conceptually session scoped.

If the session manager is trying to serialize a UserDetailsService, it is probably a result of a reference to the UserDetailsService in some other session scoped object.