Code review comment: And did you test it? Whether `DefaultOidcUser` serialize / deserialize well?

Code under review:
public OidcUser loadUser(OidcUserRequest userRequest) throws OAuth2AuthenticationException {
        
        OidcUser oidcUser = oidcUserService.loadUser(userRequest);
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

        if (authentication != null) {
            DefaultOidcUser defaultOidcUser = (DefaultOidcUser) session.getAttribute("defaultOidcUser");
            return defaultOidcUser;
        }

        Set<String> groups = Optional.of(userRequest)
                                     .map(OAuth2UserRequest::getAccessToken)
                                     .map(AbstractOAuth2Token::getTokenValue)
                                     .map(graphClient::getGroupsFromGraph)
                                     .orElseGet(Collections::emptySet);
        Set<String> groupRoles = groups.stream()
                                       .filter(properties::isAllowedGroup)
                                       .map(group -> ROLE_PREFIX + group)
                                       .collect(Collectors.toSet());
        Set<SimpleGrantedAuthority> authorities = groupRoles.stream()
                                                            .map(SimpleGrantedAuthority::new)
                                                            .collect(Collectors.toSet());
        if (authorities.isEmpty()) {
            authorities = DEFAULT_AUTHORITY_SET;
        }
        String nameAttributeKey =
            Optional.of(userRequest)
                    .map(OAuth2UserRequest::getClientRegistration)
                    .map(ClientRegistration::getProviderDetails)
                    .map(ClientRegistration.ProviderDetails::getUserInfoEndpoint)
                    .map(ClientRegistration.ProviderDetails.UserInfoEndpoint::getUserNameAttributeName)
                    .filter(StringUtils::hasText)
                    .orElse(AADTokenClaim.NAME);
        
        DefaultOidcUser defaultOidcUser = new DefaultOidcUser(authorities, oidcUser.getIdToken(), nameAttributeKey);

        session.setAttribute("defaultOidcUser", defaultOidcUser);
        return defaultOidcUser;
    }

Line commented on: DefaultOidcUser defaultOidcUser = (DefaultOidcUser) session.getAttribute("defaultOidcUser");

Revised code:
public OidcUser loadUser(OidcUserRequest userRequest) throws OAuth2AuthenticationException {
        
        OidcUser oidcUser = oidcUserService.loadUser(userRequest);
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        ServletRequestAttributes attr = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();
        HttpSession session = attr.getRequest().getSession(true);

        if (authentication != null) {
            return (DefaultOidcUser) session.getAttribute(DEFAULT_OIDC_USER);
        }

        Set<String> groups = Optional.of(userRequest)
                                     .map(OAuth2UserRequest::getAccessToken)
                                     .map(AbstractOAuth2Token::getTokenValue)
                                     .map(graphClient::getGroupsFromGraph)
                                     .orElseGet(Collections::emptySet);
        Set<String> groupRoles = groups.stream()
                                       .filter(properties::isAllowedGroup)
                                       .map(group -> ROLE_PREFIX + group)
                                       .collect(Collectors.toSet());
        Set<SimpleGrantedAuthority> authorities = groupRoles.stream()
                                                            .map(SimpleGrantedAuthority::new)
                                                            .collect(Collectors.toSet());
        if (authorities.isEmpty()) {
            authorities = DEFAULT_AUTHORITY_SET;
        }
        String nameAttributeKey =
            Optional.of(userRequest)
                    .map(OAuth2UserRequest::getClientRegistration)
                    .map(ClientRegistration::getProviderDetails)
                    .map(ClientRegistration.ProviderDetails::getUserInfoEndpoint)
                    .map(ClientRegistration.ProviderDetails.UserInfoEndpoint::getUserNameAttributeName)
                    .filter(StringUtils::hasText)
                    .orElse(AADTokenClaim.NAME);
        
        DefaultOidcUser defaultOidcUser = new DefaultOidcUser(authorities, oidcUser.getIdToken(), nameAttributeKey);

        session.setAttribute(DEFAULT_OIDC_USER, defaultOidcUser);
        return defaultOidcUser;
    }