What's New in Java EE Security: JSR-375 and Beyond
summary
JSR‑375 is at early draft public review (Apr 17–May 16, 2017) and targets EE8 with a reference implementation update (Soteria) and GlassFish 5 integration plus TCK work. It defines a single pluggable HTTP Authentication Mechanism interface that apps deploy via CDI while the container supplies a wrapper JASPIC SAM; a portable IdentityStore (LDAP + RDBMS) with annotations and injectable implementations; and a default IdentityStoreHandler algorithm that aggregates VALID/INVALID/NOT_VALIDATED results (lower numeric priority wins). Future work lists OAuth2/OpenID Connect, secrets management and authorization interceptors.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 0:34Agenda
- 1:05Expert Group
- 1:22JSR375 History
- 3:46Manage Control Security
- 4:36What was originally proposed
- 5:30Whats left to do
- 6:38Common Principles
- 7:03HTTP Authentication Mechanism
- 9:56HTTP Authentication Container
- 11:36Secure Responses
- 12:08Identity Store
- 16:06Identity Store Handler
- 17:53Identity Store Handler Algorithm
- 25:40Identity Store Discussion
- 28:00Security Context
- 28:52Authentication
- 31:01SecurityContext
- 35:45Whats Next
- 36:28Java EE Survey
- 36:47Secrets Management Encryption
- 37:37OAuth II
- 39:01Scopes
- 39:18Requirements
- 44:50Authorization Interceptor
- 45:55Secrets Interceptor
- 46:43Secrets aliases
- 47:31More information
- 48:23How to contribute
- 49:05OpenID Connect
related talks
42mWhat's New in Java EE 8: the Java EE Security API
53mJava EE 8 and the Open Future of Java EE - What You Need to Know!
42mWhat's Coming in Java EE 8
32mJakarta EE Security - Sailing Safe in Troubled Waters
50mJava EE 8: What's New in the Java EE 8 Release
50mJava EE 8 - What's coming?
01h 02mJava EE 7, 8 and beyond
46mJava EE 8: What’s New in the Java EE 8 Release