Even though io.undertow.security.api.AuthenticatedSessionManager.AuthenticatedSession implements java.io.Serializable, it cannot be serialized unless the associated io.undertow.security.idm.Account, as well as the java.security.Principal it contains, are serializable.