Requirements for supporting JSR 375: Java EE Security API

[starksm64]

Define the requirements for aligning MP-JWT authentication with JSR 375.

[rmannibucau]

Would be great to not directly depend on JSR 375, current spec is light and efficient whereas JSR 375 is already quite heavy for end users.

[radcortez]

What are we looking for to include JSR 375?

[rmannibucau]

Adoption? What would it bring? Jsr375 is programmatic whereas jwtauth is contextual and selfsufficient, dont think it would be sane to make MP fatter to no new feature.

[radcortez]

That what I'm asking. I don't think we will benefit from this, but I was interested if there was anything that people were interested in.

[rdebusscher]

If I remember correctly, this issue was how the definition of the security mechanism (like @LoginConfig) would be more aligned with how Security API works.

But I do not remember the details anymore and this issue doesn't list them.

[radcortez]

BTW, the Security Spec requires the Servlet spec. Not every MP implementation includes Servlet, so this might be an issue.

[rmannibucau]

@radcortez Microprofile requires servlet too ;) (it relies on JAX-RS and JAX-RS defines SE and >= Servlet environments - others are not spec-ed so not an option for MP which does not define anything about that. SE case is excluded cause it is a programmatic registration of endpoints which is against MP too, so MP includes Servlet transitively whatever some vendor can say).