OAuth2 tokens should be persisted to database, where the Authentication object should not be serialized in its entirety, but a form of descriptor should be serialized.

Example

• type: client, id: client_id

• type: user, id: user_id

• type: custom, data: JSON

Default handlers should be present for a User and Client descriptor. When deserializing a token, the principal would be fetched from the services instead of the serialized data.