Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [jakartaee-platform-dev] Moving MicroProfile JWT to JakartaSecurity?


On Tue, Nov 15, 2022 at 4:01 PM Werner Keil <werner.keil@xxxxxxx> wrote:

>Isn't that an opportunity where Jakarta Security could reference MP JWT?

 

>i.e. the MP JWT specification doesn't specify how it is implemented, but the Jakarta Security specification could reference the MP JWT APIs and configuration and define how these are >implemented in Jakarta Security?

 

It would lead to cyclic dependencies, for Jakarta Security alone both CDI and JSON Processing, and assuming multiple Jakarta EE APIs wanted to consume MP APIs, that potentially gets worse.

https://microprofile.io/2021/12/07/microprofile-5-0-release/ lags behind Jakarta EE 10 until at least 10, so a Security API Catering towards Jakarta EE 11 already had to use a MP JWT API based on much older APIs like CDI 3 etc.

 

Don't just reference the one year old release to comment they are old. MP is working on MP 6.0 and all of the MP specs should work with either Jakarta EE 10 and EE 9.1. We will be able to work out a way if Jakarta EE spec is willing to use MP specs.
 

Then there are even some „outside the umbrella“ like MP GraphQL 1.1 that were not even upgraded and are still on the API Level of MP 4.1, hence if they consume any Jakarta EE APIs then it gets even worse using those as well.


It looks like you missed the MP GraphQL 2.0 release, which aligns with Jakarta EE 9.1. 

Werner

 

Von: Darran Lofthouse
Gesendet: Dienstag, 15. November 2022 14:17
An: jakartaee-platform developer discussions
Betreff: Re: [jakartaee-platform-dev] Moving MicroProfile JWT to JakartaSecurity?

 

 

 

On Fri, Nov 11, 2022 at 6:32 PM arjan tijms <arjan.tijms@xxxxxxxxx> wrote:

Hi

 

On Fri, Nov 11, 2022 at 6:15 PM Scott Stark <starksm64@xxxxxxxxx> wrote:

For specification projects in a related space, the existence of more than one needs to be justified. There is a reason everyone involved in specification/standards work raises this well trodden satire out at some point:

 

So what do you propose instead then? Having a Jakarta Full-profile or so that includes both EE and MP?

 

As a Jakarta EE user, we can now freely use Form, Basic, Open ID Connect, but not JWT. Even when a MP profile JWT implementation is added, it's not necessarily based on Jakarta Security. Even in a Jakarta EE server that already includes MP components, its JWT implementation does not necessarily have to be Jakarta Security based. Meaning, things like additional identity stores, interceptors, etc are not being picked up for JWT or may even clash.

 

Isn't that an opportunity where Jakarta Security could reference MP JWT?

 

i.e. the MP JWT specification doesn't specify how it is implemented, but the Jakarta Security specification could reference the MP JWT APIs and configuration and define how these are implemented in Jakarta Security?

 

 

Kind regards,

Arjan Tijms

 

 

_______________________________________________
jakartaee-platform-dev mailing list
jakartaee-platform-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jakartaee-platform-dev

 

_______________________________________________
jakartaee-platform-dev mailing list
jakartaee-platform-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jakartaee-platform-dev


--
Thanks
Emily

Back to the top