Java EE 8 Authentication and Authorization

An airhacks.fm conversation with Arjan (@arjan_tijms) about: starting programming with Commodore 64, blog interview about zeef, "Programming in Basic" with the age of 7, Phillips P2000, Simons Basic, Assembly on Commodore 64, defaulting to C, weird main function in C, developing a database to maintain Judo progress and expenses, being a CEO of a kid organization to sell goods on free markets with other kids, SGI Indy, helping sister with recursion in Java, advertisements on websites with awin startup, OrionServer, Java Servlet Development Kit (JSDK) 1.0, Sun One Application Server, Trifork Application Server, Java EE is like operating system for business components, counting cycles for method invocations, From OrionServer to Tomcat, 3 views per server in a 2-3 node cluster, cutting libraries by moving from Tomcat to JBoss in 2 weeks, zanox.de buys awin, discussion about polyglot programming, parsing gigabytes of XML, founding Zeef.com with ten developers, monatenization challenges, starting as tech lead at Payara, JASPIC, JAAS, JACC, from form login to authenticated and authorised user, the relation between JAAS and JAAC, JAAS is about code security and code trust, in JAAC the code is trusted and the user is not trusted, JASPIC is the authentication mechanism, Java EE 8 security is the syntactic sugar around existing security specs, the simplest possible authentication with JSR-375 / Java EE 8 Security, IdentityStores vs. Realm, basic authentication and realm clarification, IdentityStore was missing in Java EE, the whole JSR-375 spec is about 12 classes, the difference between security group and roles, 1:1 role to group mapping is default in Java EE 8. Arjan's blog, Arjan on omnifaces and @omnifaces.