You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Christopher Schultz <ch...@christopherschultz.net> on 2026/10/12 15:29:00 UTC
Re: [PROPOSAL] Deprecate JAAS Realm in 10.0.x and remove in 10.1.x
All,
I'm going to resurrect this proposal.
Is JAASRealm still relevant in Tomcat 10+?
-chris
On 4/26/21 12:17 PM, Mark Thomas wrote:
> In reviewing references to Java EE (and J2EE) remaining in the Tomcat 10
> repo I found the following:
>
> <quote source="webapps/docs/config/realm.xml">
> JAASRealm is prototype for Tomcat of the JAAS-based J2EE authentication
> framework for J2EE v1.4, based on the <a
> href="https://www.jcp.org/en/jsr/detail?id=196">JCP Specification
> Request 196</a> to enhance container-managed security and promote
> 'pluggable' authentication mechanisms whose implementations would be
> container-independent.
> </quote>
>
> JSR became JASPIC (now Jakarta Security) and Tomcat has an implementation.
>
> Searching through the mailing lists I found the following references to
> usage of the JAASRealm (going back ~5 years).
>
> [1] Tomcat 7 user using JAAS based auth to an LDAP server
> [2] Tomcat 9 user using SPNEGO with the JAAS realm
> [3] Tomcat 8.5 user using SPNEGO with the JAAS realm
> [4] Tomcat 7 users with custom CLIENT-CERT auth based on JAAS realm
> [5] User wanting access to HttpServletRequest during auth
>
> Most, if not all, of those have better solutions available than the JAAS
> Realm. And those wanting some form of custom auth do have the "proper"
> Jakarta Security API to work with.
>
> Therefore, I'm not currently seeing a good reason to keep the JAASRealm.
> Any objections to immediate deprecation with removal planned for 10.1.x?
>
> Mark
>
>
> [1] http://markmail.org/message/ndvr5ilxovoo4ins
> [2] http://markmail.org/message/5ocdnmqvvlvjsxas
> [3] http://markmail.org/message/wki275i5yhlg3yyo
> [4] http://markmail.org/message/av2sv6g4kgm6ouu4
> [5] http://markmail.org/message/fm4ggo3ge4r47gar
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PROPOSAL] Deprecate JAAS Realm in 10.0.x and remove in 10.1.x
Posted by Christopher Schultz <ch...@christopherschultz.net>.
All,
On 10/13/26 4:42 PM, Mark Thomas wrote:
> On 12/10/2026 16:29, Christopher Schultz wrote:
>> All,
>>
>> I'm going to resurrect this proposal.
>>
>> Is JAASRealm still relevant in Tomcat 10+?
>
> I don't think so.
>
> +1 to deprecate in 11.0.x and remove in 12.
Done.
-chris
>> On 4/26/21 12:17 PM, Mark Thomas wrote:
>>> In reviewing references to Java EE (and J2EE) remaining in the Tomcat
>>> 10 repo I found the following:
>>>
>>> <quote source="webapps/docs/config/realm.xml">
>>> JAASRealm is prototype for Tomcat of the JAAS-based J2EE authentication
>>> framework for J2EE v1.4, based on the <a
>>> href="https://www.jcp.org/en/jsr/detail?id=196">JCP Specification
>>> Request 196</a> to enhance container-managed security and promote
>>> 'pluggable' authentication mechanisms whose implementations would be
>>> container-independent.
>>> </quote>
>>>
>>> JSR became JASPIC (now Jakarta Security) and Tomcat has an
>>> implementation.
>>>
>>> Searching through the mailing lists I found the following references
>>> to usage of the JAASRealm (going back ~5 years).
>>>
>>> [1] Tomcat 7 user using JAAS based auth to an LDAP server
>>> [2] Tomcat 9 user using SPNEGO with the JAAS realm
>>> [3] Tomcat 8.5 user using SPNEGO with the JAAS realm
>>> [4] Tomcat 7 users with custom CLIENT-CERT auth based on JAAS realm
>>> [5] User wanting access to HttpServletRequest during auth
>>>
>>> Most, if not all, of those have better solutions available than the
>>> JAAS Realm. And those wanting some form of custom auth do have the
>>> "proper" Jakarta Security API to work with.
>>>
>>> Therefore, I'm not currently seeing a good reason to keep the
>>> JAASRealm. Any objections to immediate deprecation with removal
>>> planned for 10.1.x?
>>>
>>> Mark
>>>
>>>
>>> [1] http://markmail.org/message/ndvr5ilxovoo4ins
>>> [2] http://markmail.org/message/5ocdnmqvvlvjsxas
>>> [3] http://markmail.org/message/wki275i5yhlg3yyo
>>> [4] http://markmail.org/message/av2sv6g4kgm6ouu4
>>> [5] http://markmail.org/message/fm4ggo3ge4r47gar
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PROPOSAL] Deprecate JAAS Realm in 10.0.x and remove in 10.1.x
Posted by Mark Thomas <ma...@apache.org>.
On 12/10/2026 16:29, Christopher Schultz wrote:
> All,
>
> I'm going to resurrect this proposal.
>
> Is JAASRealm still relevant in Tomcat 10+?
I don't think so.
+1 to deprecate in 11.0.x and remove in 12.
Mark
>
> -chris
>
> On 4/26/21 12:17 PM, Mark Thomas wrote:
>> In reviewing references to Java EE (and J2EE) remaining in the Tomcat
>> 10 repo I found the following:
>>
>> <quote source="webapps/docs/config/realm.xml">
>> JAASRealm is prototype for Tomcat of the JAAS-based J2EE authentication
>> framework for J2EE v1.4, based on the <a
>> href="https://www.jcp.org/en/jsr/detail?id=196">JCP Specification
>> Request 196</a> to enhance container-managed security and promote
>> 'pluggable' authentication mechanisms whose implementations would be
>> container-independent.
>> </quote>
>>
>> JSR became JASPIC (now Jakarta Security) and Tomcat has an
>> implementation.
>>
>> Searching through the mailing lists I found the following references
>> to usage of the JAASRealm (going back ~5 years).
>>
>> [1] Tomcat 7 user using JAAS based auth to an LDAP server
>> [2] Tomcat 9 user using SPNEGO with the JAAS realm
>> [3] Tomcat 8.5 user using SPNEGO with the JAAS realm
>> [4] Tomcat 7 users with custom CLIENT-CERT auth based on JAAS realm
>> [5] User wanting access to HttpServletRequest during auth
>>
>> Most, if not all, of those have better solutions available than the
>> JAAS Realm. And those wanting some form of custom auth do have the
>> "proper" Jakarta Security API to work with.
>>
>> Therefore, I'm not currently seeing a good reason to keep the
>> JAASRealm. Any objections to immediate deprecation with removal
>> planned for 10.1.x?
>>
>> Mark
>>
>>
>> [1] http://markmail.org/message/ndvr5ilxovoo4ins
>> [2] http://markmail.org/message/5ocdnmqvvlvjsxas
>> [3] http://markmail.org/message/wki275i5yhlg3yyo
>> [4] http://markmail.org/message/av2sv6g4kgm6ouu4
>> [5] http://markmail.org/message/fm4ggo3ge4r47gar
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org