Issue #5064 - the OpenIdCredentials should be serializable

[lachlan-roberts]

Issue #5064

The OpenIdConfiguration now contains an HttpClient so it cannot be stored as a field on the OpenIdCredentials which needs to be serializable.

The OpenIdConfiguration is now passed in on OpenIdCredentials.redeemAuthCode().

[janbartel]

IMHO it seems a bit odd that something called xxxConfiguration has a HttpClient and some behaviour. Another (non-mandatory) suggestion is to make the class that has the HttpClient a HttpSessionActivationListener, so when you get the sessionWillPassivate() event, you can null out the HttpClient field, and then recreate it as necessary in a sessionDidActivate() event.

[lachlan-roberts]

@janbartel I remember having this conversation with Greg previously about the OpenIdConfiguration being more of a "Resources" rather than a "Configuration". But it is probably too late to change the name of it.

I don't think we want to create a HttpClient on every sessionDidActivate() event, it should be shared for all openid authentication requests on the server. So I think its best not to have it as a field on the OpenIdCredentials.