I would like to join. Sent via the Samsung Galaxy S7, an AT&T 4G LTE smartphone

Obviously an MR is the best route if Oracle has the appetite. If not I suggest an RI specific extension. The last resort could be a fork. Sent from my iPhone

That website is community-contributed. If needed, I can get in touch with the original author. Sent via the Samsung Galaxy S7, an AT&T 4G LTE smartphone

Sounds good to me.

Certainly worth exploring if doing anything is possible. It does come up often enough these days at clients along with OAuth/OpenID Connect.

I agree with Arjan. In a vast majority of cases, default mapping is just fine. Indeed I have not seen it the other way around in a very long time.

This problem was supposed to be solved through the configuration JSR.

I agree ultimately you should do what you are truly comfortable with as specification lead (within reason of course). If you had any general questions, Bill and Linda could provide guidance.

It is indeed a shame we didn't do more to step away from EJB in Java EE 7 and Java EE 8. One thing I was hoping would come out of this JSR is interceptor versions of @RolesAllowed, etc.