users@servlet-spec.java.net

[servlet-spec users] Re: Standardizing authentication modules in Servlet (via JASPIC)?

From: arjan tijms <arjan.tijms_at_gmail.com>
Date: Tue, 4 Nov 2014 16:24:12 +0100

Hi,

On Mon, Nov 3, 2014 at 12:01 AM, Stuart Douglas <sdouglas_at_redhat.com> wrote:
> I think the test suite was expanded a bit for EE7, but it is still only about 40 tests. I know Wildfly's JASPIC implementation was broken for a long time, and it was not until Arjan contacted us about it that it got fixed.

You and Stefan have been very helpful there and provided some
impressive fixes. Really appreciated the great response there :)

> In terms of user demand we have not really seen much, although it sounds like there have been lots of incompatibilities and problems with the existing implementations so perhaps this is not surprising. If this was more widely supported and there was greater compatibility between containers maybe demand would increase, but I would not want to put money on it.

Well, there sure is some general demand for custom authentication
modules. You just have to scroll down the list of the support forums
of the various servers to see the topic coming up with some frequency.

I just looked at the WildFly forum and found this one for example,
right at the second page: https://developer.jboss.org/thread/238095
(Does WildFly support SPNego Authetication?).

Someone there wrote a Filter solution after some time, and then yet
after some more time someone else created a version using the
WildFly/Undertow specific interfaces. So this particular auth module
is now available for WildFly (see
https://github.com/dstraub/spnego-wildfly), but not for any of the
other servers. The same situation is true the other way around.

Had this been written using the JASPIC interfaces, then it would be
available for all other servers. Eventually the pool of available
authentication modules for everyone would be larger, which would be
more beneficial I think then everyone having a separate pool.

Kind regards,
Arjan