Spring openid + remember me

Question

public void afterPropertiesSet() { super.afterPropertiesSet(); if (consumer == null) { try { consumer = new OpenID4JavaConsumer(); } catch (ConsumerException e) { throw new IllegalArgumentException("Failed to initialize OpenID", e); } } if (returnToUrlParameters.isEmpty() && getRememberMeServices() instanceof AbstractRememberMeServices) { returnToUrlParameters = new HashSet<String>(); returnToUrlParameters.add(((AbstractRememberMeServices)getRememberMeServices()).getParameter()); } } 

Inside the Spring OpenIDAuthenticationFilter, I see above what the use of returnToUrlParameters.add(((AbstractRememberMeServices)getRememberMeServices()).getParameter()); ?

What does MeService remember about the returnto page after running openid?

Answer 1

You can read this article written by Peter Mularien, author of spring security http://www.packtpub.com/article/opening-up-to-openid-with-spring-security

quote "You’ll notice that we don’t offer the" remember me "option using the OpenID login. This is because redirecting to and from the provider loses the value of the" Remember me "check box, so when the user has successfully authenticated, I don’t have a pointer to remember anymore. This is unfortunate, but ultimately increases the security of OpenID as a login mechanism for our site, since OpenID forces the user to establish trust relationships through the provider with each and every login. "