| Re: [jakartaee-platform-dev] Moving MicroProfile JWT to JakartaSecurity? |
The biggest issue thinking of even referencing the MP JWT API in the Jakarta Security Spec/API are circular dependencies to usually different versions. Even if it’s currently just a few like Jakarta JSON Processing or CDI. Using it in Soteria also bears the risk of API differences, because most of the time MP won’t yet be on the same Version level as Jakarta EE, but using it in the API could make this worse, also given the MP JWT API relies on a particular implementation using certain JWT Frameworks of different Kinds. A good starting point would be Looking at the actual issue https://github.com/jakartaee/security/issues/277 and a proposed PR https://github.com/jakartaee/security/pull/278. That involves the Nimbus JOSE Framework which I believe also could be used by some MP JWT implementations, but it uses Elements that don’t even exist in the MP API yet, especially JWSHeader. I doubt the way it is proposed would work for the API but currently that is just a proposed addition to the TCK, where as discussed here earlier MP JWT also uses Jakarta Authentication or <version.jose4j>0.7.9</version.jose4j> without exposing them in the API. Werner Von: David Blevins > On Nov 11, 2022, at 12:06 PM, arjan tijms <arjan.tijms@xxxxxxxxx> wrote: > > Do you mean that the Jakarta security spec, and specifically the Jakarta Security API jar directly has the MP JWT spec / api as a dependency? It's worth exploring at the very least. It's not something I've typically endorsed in the past, but I'm starting to soften to the idea if it can avoid a trend of having two copies of every api. There are possibly other avenues that could be explored as well. I think this thread is great, but would people be open to getting together for an hour and just talking out some options? I.e. we get us Jakarta Security and MicroProfile JWT folks together and see what we can come up with. Thoughts? -David _______________________________________________ jakartaee-platform-dev mailing list jakartaee-platform-dev@xxxxxxxxxxx To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jakartaee-platform-dev |