Re: [jakarta.ee-community] Is Jakarta EE Security missing something?

[Reza Rahman <reza_rahman@xxxxxxxx>]

Looping in Jakarta Security mailing list.

 

---

From: jakarta.ee-community <jakarta.ee-community-bounces@xxxxxxxxxxx> on behalf of Ralph Soika via jakarta.ee-community <jakarta.ee-community@xxxxxxxxxxx>
Sent: Wednesday, April 23, 2025 2:55 AM
To: Jakarta EE community discussions <jakarta.ee-community@xxxxxxxxxxx>
Cc: Ralph Soika <ralph.soika@xxxxxxxxx>
Subject: [jakarta.ee-community] Is Jakarta EE Security missing something?

 

Hi,

I'm not sure if this is the right place for my question, but I'm a bit confused. It's about the new capabilities in Jakarta EE 10 regarding OpenID Integration (OIDC).

With the @OpenIdAuthenticationMechanismDefinition  annotation Jakarta EE supports a cool way to integrate the oidc authentication flow. But this annotation (supported by all actual platforms) is only for browser based authentication. I have always assumed that this mechanism also supports programmatic logins. But this is obviously not the case.

This means: If you add the @OpenIdAuthenticationMechanismDefinition to your Jakarta EE app you can connect your app easily with different Identity provider platforms (e.g. Keycloak) and users can authenticate in a secure way via Web browsers. But if you need to perform a programmatic login - for example in a microservice architecture where an external service need to access your applications API you are totally lost. I can't believe that I'm the only one who makes this requirement? 

Wildfly offers its own proprietary solution (I think based on soteria) that supports exactly this feature. But this means that the application is no longer platform-neutral and you are forced to use the elytron library "wildfly-elytron-http-oidc" to get out user attributes from the users claim.
I have written a blog about this feature here: https://ralph.blog.imixs.com/2025/03/26/wildfly-29-oidc-bearer-token-authentication/

I guess your answer in this forum will be that Jakarta EE is just a specification and if I need such a feature I can implement my own jaspi login module. But can that really be true? Not every developer writes his own jaspi Login module. I myself shy away from it, because I expect that I will very quickly reach a point where I am no longer platform independent.

Can anyone help me with this question? Or am I missing an important concept of Jakarta EE all the time?
I have already written issues about this at Wildfly and soteria and on Stackoverflow. But somehow the community is silent on this topic.

• https://issues.redhat.com/browse/WFLY-20498
• https://github.com/eclipse-ee4j/soteria/issues/393
• https://stackoverflow.com/questions/79500287/how-to-access-a-jakarta-ee-rest-application-secured-by-keycloak-in-java
• https://stackoverflow.com/questions/76394897/how-to-use-oidc-in-jakarta-ee

Thanks for your help in advance

===
Ralph

--

Imixs Software Solutions GmbH
Web: www.imixs.com Phone: +49 (0)89-452136 16
Timezone: Europe/Berlin - CET/CEST
Office: Frei-Otto-Str. 4, 80797 München
Registergericht: Amtsgericht München, HRB 136045
Geschäftsführer: Gaby Heinle u. Ralph Soika

Imixs is an open source company, read more: www.imixs.org