Re: [jakartaee-platform-dev] Moving MicroProfile JWT to Jakarta Security

[arjan tijms <arjan.tijms@xxxxxxxxx>]

Hi,

On Sun, Nov 6, 2022 at 11:13 AM Romain Manni-Bucau <rmannibucau@xxxxxxxxx> wrote:

Hi,

I think that, as requiring jaspic for microprofile would be bad 

As replied in the previous response, there's no dependency on jaspic. Even so, the very thought that it's bad is, itself, bad.

It's a strong indicator of a failure of our process and indicator of a FUD campaign that has somehow taken hold. What we essentially have is a special Servlet Filter that we call before all other Filters, and that can set the caller principal and its groups. This small piece of API would have been in Servlet itself, but because of historical reasons (the idea of EJB, SOAP, JMS, etc re-using it) it got moved to its own spec. There's however nothing inherently bad about it from a technical perspective.

Kind regards,

Arjan Tijms