Tomcat GenericPrincipal and JBossGenericPrincipal

[anil.saldhana]

http://anonsvn.jboss.org/repos/jbossas/trunk/tomcat/src/main/org/jboss/web/tomcat/security/JBossGenericPrincipal.java

Our Tomcat layer uses JBossGenericPrincipal to basically tie in some additional semantics like callerprincipal etc to the tomcat caching principal.

I am wondering if this is really an hindrance to users who want to plug in their own realms and create their versions of the GenericPrincipal.

If our code does an instanceof checks, then that is fine. But if we are casting principals in to JGP, then that is a definite No-No for customization.

Thinking out loud.

Of course they can subclass JGP.

[sguilhen]

I'm not sure we can change all places that cast the Principal to JGP because some of them use the specific methods of the JGP (like getSubject() and getAuthPrincipal) to set the principal info on the SecurityAssociationActions.
My first impression is that it is reasonable to require users to extend JGP instead of GenericPrincipal when they are looking for customization.