EG:

I've got a couple of last minute questions/concerns about the spec, which I've written up as issues:

• Should default IdentityStoreHandler return all (or most) fields of CredentialValidationResult? (https://github.com/javaee/security-spec/issues/44)

• What happens if HttpAuthenticationMechanism and <login-config> both specified? (https://github.com/javaee/security-spec/issues/45)

Please have a look and comment.

Thanks,

Will

-- 
Will Hopkins | WebLogic Security Architect | +1.781.442.0310
Oracle Application Development
35 Network Drive, Burlington, MA 01803

What about the "high priority" label btw, guess that was from JIRA and does not apply to 1.0 any more?
(otherwise a lot of high prio tickets would still be left;-O)

Regards,
Werner

Yes, that carried over from java.net. Arjan has looked at a lot of these and closed them as implemented or will not do. I need to take another pass through as well, but mostly these are all things that we have decided to defer and I think need to be closed on that basis, with a label that allows them to be easily found for use by a follow-on JSR.

Will

What about the "high priority" label btw, guess that was from JIRA and does not apply to 1.0 any more?
(otherwise a lot of high prio tickets would still be left;-O)

Regards,
Werner

-- 
Will Hopkins | WebLogic Security Architect | +1.781.442.0310
Oracle Application Development
35 Network Drive, Burlington, MA 01803

Hi,

Indeed, a did an initial pass through them recently, great if Will can do another pass.

For issues that still 100% apply, an alternative could be to give them a "SecurityAPI.Next" label or something like that, so that they clearly stand out. Otherwise closing would be okay, since a lot of them may apply in spirit but the wording or context is slightly outdated.

Kind regards,
Arjan