Design and implement replacement for Policy

[arjantijms]

The java.security.Policy class is currently deprecated for removal as part of https://openjdk.java.net/jeps/411 that deprecates the entire security manager.

Jakarta Authorization uses Policy as an entry into its authorization modules; meaning the container calls methods on Policy in order to interact with these. As Policy is going to be removed, this has a big impact on this API.

The best course of action is likely to create a replacement class for Policy containing exactly the methods a container would normally call. These are essentially the implies method and the "getPermissions" method.

[arjantijms]

See also jakartaee/platform#406

[starksm64]

It does not seem likely we can address this issue for EE10.

[arjantijms]

It does not seem likely we can address this issue for EE10.

Very, very unfortunately indeed not, but it is what it is. This will have to be addressed in the next major version then.

[arjantijms]

These are essentially the implies method and the "getPermissions" method.

A typical pattern for using the Policy is as follows:

    boolean checkPermission(Permission permissionToBeChecked, Set<Principal> principals) {
        return policy.implies(newProtectionDomain(principals), permissionToBeChecked);
    }

Where newProtectionDomain is implemented as follows:

    private ProtectionDomain newProtectionDomain(Set<Principal> principalSet) {
        return new ProtectionDomain(
                emptyCodeSource,
                null,
                null,
                principalSet == null ? null : (Principal[]) principalSet.toArray(new Principal[0]));
    }

The new implies method only really needs the collection of Principal and the Permission to be checked. We could also opt to name the method 'checkPermission`, but for the initial draft we may want to stay close to the original and keep using 'implies'.