JCA Security performance

[adrian.brock]

I've reassigned this issue to the security project.
http://jira.jboss.com/jira/browse/JBAS-1082

IIRC the fundamental problem is in the Subject class of the JDK?
We looked at this during the 3.2.3 development.

We should look at removing the container managed security
from the default hsqldb deployment since it is was ever intended as an example?
This usecase only demands the user/password property injection, not full blown
JAAS integration ;-)

[adrian.brock]

There is also an issue in the JDBC rar where it clones the properties
because of Oracle modifying them which could certainly be made configurable
for better behaved jdbc drivers.

[starksm64]

Yes, the Subject is not effecient to use or copy and its final nature makes it impossible to extend. Its probably a bad thing to use the only fundamental representation of the caller for these reasons, but not much can be done until the jbosssx api is revisted.