Hi,
We recently had a discussion on the OpenLiberty mailing
list [] whether Java EE application servers are required to
bundle a default JACC provider.
My reading of Section 2.5 of the spec [2] is that
application servers must provide an implementation of the
PolicyConfigurationFactory and the PolicyConfiguration
components, which effectively would mean that a JACC provider
is present on the classpath: "Each JRE of an application
server must be provided with classes that implement the
PolicyConfigurationFactory class and PolicyConfiguration
interface. These classes must be compatible with the Policy
implementation class installed for use by the JRE."
If we look at the recently open sourced TCK, there's a test
for that assertion [3][4], but from what I can see, it is
broken: it installs the PolicyConfigurationFactory and
PolicyConfiguration implementations before checking they were
already there, always passing.
The spec uses a somewhat cumbersome language and there's no
clear hint that such default provider is required to be
enabled. The JACC mailing list archives are available only
from 2013 [5] but the spec haven't received much development
after that time.
So my question is, was any public clarification made on
what the spec actually meant? Did the EG reach a consensus on
it?
Regards,
Guillermo González de Agüero
[1]
https://groups.io/g/openliberty/topic/contributing_a_liberty_bundle/25512336?p=,,,20,0,0,0::recentpostdate%2Fsticky,,,20,2,0,25512336