First if this is
                                a road people wanted to go down then it
                                would first have to be deprecated from
                                Web profile as it is a major breaking
                                change so Jakarta EE 11 is too soon.
                           
                         
                      
                      
                      
                      It would be deprecated in EE 11 indeed, not
                        yet removed as a requirement for that profile.
                      
                      
                       
                      
                        
                          
                             Second there
                                isn’t currently a CDI mechanism for
                                doing every thing that is done with
                                EJB-lite. Therefore I think we need to
                                have CDI equivalents for capabilities of
                                Session beans. These could be spread
                                between different specifications e.g.
                                @Pooled into concurrency.
                           
                         
                      
                      
                      
                      Indeed, there's a handful of features /
                        services not readily available yet. Reza Rahman
                        enumerated them all the way back in 2012, and
                        that list can still be used as a tracker.
                        Essentially this one at the time was created in
                        response of Reza's list: 
https://github.com/omnifaces/omniservices
                      
                      It indeed contains the @Pooled. After 9 years
                        (7 since commit) it could be updated a little
                        bit, but not that much as the underlying CDI
                        APIs didn't change much. That one can be used as
                        a prototype.
                      
                      
                      
                      
                      
                      Both these could be used as a starting point
                        to define a spec based version on.
                      
                      
                       
                      
                        
                          
                             Finally use of
                                the @RunAs, @RolesAllowed etc. needs to
                                be normalised across specs to ensure
                                behaviour would be equivalent on a CDI
                                bean as it would be on an EJB in all
                                specifications.
                           
                         
                      
                      
                      
                      True. This had been on the radar for Security
                        3.0, see 
https://projects.eclipse.org/projects/ee4j.es/releases/3.0
                        Unfortuantely it just didn't happen, but it's
                         there. The bar for just emulating how EJB does
                        it is fairly low, but we'd likely want to give
                        it a little more of a kick in a CDI version. For
                        instance, especially for Jakarta REST / JAX-RS
                        and potentially Servlet we probably want an
                        option to have an authentication mechanism
                        invoked when the caller appears to be not
                        authenticated. We might use our experience with
                        the @RolesAllowed interpretation in MP/JWT
                        there.
                      
                       
                      
                        
                          
                             
                            Ultimately it may be
                              possible to replace @Stateless with a
                              stereotype that includes a bunch of other
                              relevant interceptor annotations to get
                              the same behaviour as a Stateless EJB on a
                              CDI bean.
                           
                         
                      
                      
                      
                      
                      
                      
                      Kind regards,
                      Arjan Tijms