Andrew Swan (Migrated from SEC-1306) said:
SEC-935 adds the OpenIDAttribute class. Because the OpenIDAuthenticationToken class (which is Serializable) has a List, OpenIDAttribute should be Serializable too.
This interface should be no problem to add to the OpenIDAttribute class, because all its members are primitives or Strings and therefore already Serializable themselves.
P.S. while you're at it, OpenIDAttribute#toString() should probably be annotated with @Override (and in OpenIDAuthenticationStatus too).