Name: bsC130419 Date: 09/05/2001


java version "1.3.1"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.1-b24)
Java HotSpot(TM) Client VM (build 1.3.1-b24, mixed mode)

Current JAAS implementation requires all LoginModules to be put on the system
classpath to be found by a LoginContext instance. This requirement complicates
development under the majority of application servers where specialized class
loaders are extensively used. The sys classpath requirement makes it impossible
to distribute a J2EE application that uses JAAS in a WAR or EAR file containing
the login module itself. Additionally, every app server uses its own class
loading scheme which makes it difficult to predict runtime behavior. The
problem is that the JAAS "client" is almost always loaded by a non-system
class loader and the fact that the system class loader will eventually be
asked to load a login module cannot be guaranteed in a general case. ANother
problem is that it might be required not to share login modules between
different applciations running in the same app server, which is almost
impossible if the login module is found on the system classpath.


The request is to make it possible to put LoginModules not only on the system
classpath but anywhere where they can reached by class loading mechanisms. If
this would break any assumptions taken into considereation in the current JAAS
implementation then any implications of such use should be clearly documented.
(Review ID: 131360)
======================================================================