JAAS security with Open Liberty

From discussion with Alasdair when reviewing KC.

The KC Authentication topic contains a bunch of randomly-organised sections about different authentication-related things. Several of them relate to JAAS (Java SE security) but they're spread around without a coherent flow.

Talk with Ajay about whether it's useful info for us to provide or whether that info is covered by the short paragraph and links to elsewhere that are in the [OL Authentication topic]https://www.openliberty.io/docs/latest/authentication.html#_jaas_authentication) already.

If he thinks it's necessary, and there's enough info needed that it's worth a whole topic, create a single OL docs topic about JAAS security that pulls together the information from the following sections of the KC Authentication topic:

• JAAS configuration
• JAAS login modules
• Callback handler - don't do a lot on this because it's quite internal and advanced use cases - callback handler is called by login module to get info needed (eg a username and pw prompt put up on screen) but, in reality, because this is server-side it often doesn't results in human interaction; human interaction is generally designed around client-side stuff.
• Pluggable authentication
• Proxy login module
• Hash table login module
• Identity assertion - this one is something that a user raised an RFE about fairly recently because they wanted to log in people using just a user ID and no password (I think). But, it's an advanced use case and Alasdair doesn't know how much we need to talk about it - would need to ask the security team to provide solid use cases of when it would be needed (in a cloud/containerised context). As for everything in this list, check it's useful to more than just a handful of people in highly specialised contexts.

You'll need to understand a bit about each of these things to work out how to organise them and structure the topic. It's possible that there are other bits of info that would need adding to make it all make sense. In general, make sure that the security SME can explain how each of these things is relevant in a cloud/containerised context - it must be framed like that in the OL docs.

Start by comparing the listed JAAS sections in the KC Authentication topic with the existing OL Authentication topic and discuss the usefulness and scope with Ajay and the security SME. If warranted, create one coherent Open Liberty topic covering relevant JAAS material, with advanced details limited and all guidance framed for cloud/containerised use.