Conceptual problem with security auto-mapping?

[David Jencks <dj...@apache.org>]

I think there is a conceptual problem with the current auto-mapping 
security code.

This should be done at deployment time (soon it will even be possible 
for web apps).

However, the realms needed are going to be part of the server 
configuration, not the ("static") deployment configuration.  Therefore 
they may or may not be started at deployment time.  It looks to me as 
if the automapping requires the realm to be running in order to get the 
default principal and set of principal classes.

So far I don't see a good solution to this problem.  Ideas?

thanks
david jencks