What are the implications of a JPA entity implementing Spring Security UserDetails?

Question

I have a JPA entity called Member. I would like for this entity to implement Spring Security UserDetails and implement a custom JPA-based UserService.

Before doing so, I have a few points of concern that I would like to sort:

• The Member entity has got quite a few properties. Can the fact that Member now implements UserDetails and is therefore stored into HttpSession (see HttpSessionSecurityContextRepository) impact session usage significantly?
• Can I retrieve the currently logged in Member by just calling: SecurityContextHolder.getContext().getAuthentication().getPrincipal(); and expect all its properties to remain synchronized properly when they are updated elsewhere?

Answer 1

impact session usage significantly?

No.

expect all its properties to remain synchronized properly when they are updated elsewhere?

No, you'll have to manage that yourself ..., ie when you update it somewhere, make sure you also update the instance in memory :

Member member = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
member.setYourField(yourValue); //