Re: [jakartaee-platform-dev] Moving MicroProfile JWT to Jakarta Security

[arjan tijms <arjan.tijms@xxxxxxxxx>]

Hi

On Fri, Nov 11, 2022 at 6:15 PM Scott Stark <starksm64@xxxxxxxxx> wrote:

For specification projects in a related space, the existence of more than one needs to be justified. There is a reason everyone involved in specification/standards work raises this well trodden satire out at some point:

https://imgs.xkcd.com/comics/standards.png

So what do you propose instead then? Having a Jakarta Full-profile or so that includes both EE and MP?

As a Jakarta EE user, we can now freely use Form, Basic, Open ID Connect, but not JWT. Even when a MP profile JWT implementation is added, it's not necessarily based on Jakarta Security. Even in a Jakarta EE server that already includes MP components, its JWT implementation does not necessarily have to be Jakarta Security based. Meaning, things like additional identity stores, interceptors, etc are not being picked up for JWT or may even clash.

Kind regards,

Arjan Tijms