EAP 7 new security model

Since the earliest releases of the application server, the security requirements were met by means of Java Authentication and Authorization Service (JAAS) which provided a subject-based authorization on authenticated identities. In modern IT, however, the simple caller principal and credential combination provided by JAAS is not in line with current security standards.

Additionally, the JAAS approach, which has been initially developed as a client based API, has never been finalized in the Java EE specification, thus leaving the choice of using it or not to the application servers' vendors.

Along with JAAS, other security layers have been introduced in the application server, based on Simple Authentication and Security Layer (SASL). By using SASL, you can decouple the authentication mechanisms from application protocols, in theory allowing any authentication mechanism supported by SASL to be used by the application server. An example of this is contained in...