Return request.getSession().setAttribute(PRINCIPAL, facebookPrincipal) back. Make method handleAuthenticationResponse public, so applications, which don't need principal in httpSession to call it directly