users@servlet-spec.java.net

[servlet-spec users] Re: Standardizing authentication modules in Servlet (via JASPIC)?

From: Mark Thomas <markt_at_apache.org>
Date: Sat, 01 Nov 2014 10:14:10 +0000

On 31/10/2014 13:39, Edward Burns wrote:
>>>>>> On Thu, 23 Oct 2014 22:52:36 +0200, arjan tijms <arjan.tijms_at_gmail.com> said:
>
> AT> This topic also came up a year ago on both the TomEE and Tomcat
> AT> mailing lists (see
> AT> http://tomee-openejb.979440.n4.nabble.com/Consider-support-for-the-Servlet-profile-of-JSR-196-JASPIC-in-TomEE-td4660480.html
> AT> and http://tomcat.10.x6.nabble.com/Consider-support-for-the-Servlet-profile-of-JSR-196-JASPIC-in-Tomcat-7-0-x-td4993387.html).
> AT> Responses there were fairly positive; with Mark and David eventually
> AT> saying:
>
> DB> If you wanted to roll up your sleeves, we'd be more than happy to
> DB> see [Geronimo's JASPIC] ported or reimplemented in TomEE. or Tomcat
> DB> :)
>
> MT> That is taking what I said rather out of context.
>
> MT> I recommend that folks read the entire discussion but the short
> MT> version is that there is very, very little user demand for it. To
> MT> date, Arjan is the only Tomcat user asking for JASPIC support in Tomcat.
>
> This is one of those features that most people don't need, but when they
> need it, they really really need it.
>
> MT> Comparing this to WebSocket, we saw much, much more demand for
> MT> WebSocket but no-one is talking about making WebSocket support
> MT> mandatory for a Servlet container.
>
> MT> I remain of the opinion that JASPIC support should be optional for a
> MT> Servlet container.
>
> Thanks for your definitive answer. Is there any circumstance where you
> can imagine supporting it?

Supporting it as in supporting the idea that it should be mandatory? No.

Supporting it as in Tomcat shipping with JASPIC support? Yes, with
caveats. Those caveats are:

- There needs to be an implementation on the table. We don't have that
  yet.
- The impact any such implementation has on Tomcat internals.
- The size of the implementation. (The larger it is, the more likely it
  would ship as an optional extra.)
- The demand for it.

> It it a resource question?

Partly. It is on the TODO list but fairly near the bottom due to the
lack of demand for it.

> Is it an architecture question?

No. I haven't looked at the architecture.

> Is it because you feel JASPIC needs some improvements first?

No. I haven't looked at JASPIC in any details at all.


There is also the ongoing issue of the ASF having access to the JavaEE
TCKs under terms that would enable us to continue release software
tested with the TCKs under the ALv2. I'd like to be able to test any
JASPIC implementation with the TCK before release and that doesn't look
like it is going to be an option any time soon.

Mark