Tomcat 的 NotSerializableException

Question

我已经使用 OpenSSO 提供的 SAML 库实现了一个安全模块，但是我的服务器没有正确关闭并出现异常:

java.io.NotSerializableException: com.sun.identity.saml2.assertion.impl.AssertionImpl
    at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1180)
    at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:346)
    at java.util.HashMap.writeObject(HashMap.java:1014)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:601)
    at java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java:975)
    at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1480)
    at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1416)
    at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1174)
    at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:346)
    at org.apache.catalina.session.StandardSession.writeObject(StandardSession.java:1671)
    at org.apache.catalina.session.StandardSession.writeObjectData(StandardSession.java:1077)
    at org.apache.catalina.session.StandardManager.doUnload(StandardManager.java:430)
    at org.apache.catalina.session.StandardManager.unload(StandardManager.java:351)
    at org.apache.catalina.session.StandardManager.stopInternal(StandardManager.java:516)
    at org.apache.catalina.util.LifecycleBase.stop(LifecycleBase.java:232)
    at org.apache.catalina.core.StandardContext.stopInternal(StandardContext.java:5655)
    at org.apache.catalina.util.LifecycleBase.stop(LifecycleBase.java:232)
    at org.apache.catalina.core.ContainerBase$StopChild.call(ContainerBase.java:1575)
    at org.apache.catalina.core.ContainerBase$StopChild.call(ContainerBase.java:1564)
    at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
    at java.util.concurrent.FutureTask.run(FutureTask.java:166)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
    at java.lang.Thread.run(Thread.java:722)

我的调用类已经序列化了，如何解决这个问题。

Answer 1

最可能的原因似乎是您试图将接收到的断言存储在 HttpSession 中，并且您的 Web 应用程序的 web.xml 具有 元素，该元素在您的容器中启用 HTTP session 集群(这会导致序列化尝试)。