[es-dev] Authorization modules / Authorization rules

[arjan tijms <arjan.tijms@xxxxxxxxx>]

Hi,

One of the things we left open for Jakarta EE Security 1.0 was the authorization topic, prioritising authentication first (which resulted in the HttpAuthenticationMechanism and IdentityStore).

I did a prototype back then for an authorization module, but we didn't discuss it further after running out of time.

In this article I'm discussing this prototype: 

https://arjan-tijms.omnifaces.org/2016/07/simplified-custom-authorization-rules.html

For Jakarta Security 3.0 this topic is on the plan again: https://projects.eclipse.org/projects/ee4j.es/releases/3.0

Thoughts?

Kind regards,

Arjan