[
https://issues.apache.org/jira/browse/CXF-5179?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13730647#comment-13730647
]
Sergey Beryozkin commented on CXF-5179:
---------------------------------------
Hi,
I wonder, should the system invalidate the access token records if a given
user's login name changes ? Or at the very least refresh them ?
Adding an explicit 'id' will allow multiple UserSubjects representing the same
user to exist: I wonder if it is something that our model should support
directly, I'm not saying the system can not support it out of band (ex, via the
oldname -> id -> newName association or similar), I'm just wondering what is
the correct course of action from the OAuth2 implementation framework is...I'll
ask on the OAuth2 list
> Add optional id field to UserSubject
> ------------------------------------
>
> Key: CXF-5179
> URL: https://issues.apache.org/jira/browse/CXF-5179
> Project: CXF
> Issue Type: Improvement
> Components: JAX-RS Security
> Affects Versions: 2.7.6
> Reporter: Thorsten Hoeger
> Priority: Minor
> Labels: OAuth2
> Attachments: 0001-adding-optional-user-id-to-UserSubject.patch
>
>
> As the user's login name my change over time it might be a good idea to
> assign a unique, non-changing user id. To reflect this within the auth module
> the class USerSubject needs an additional field.
> The OAuthContextUtils the may resolve the user's id.
> A patch implementing this improvement is attached.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
