[cdi-dev] Thoughts on Phases and Events for the Security spec

Hi, On Monday, December 22, 2014, Antonio Goncalves <antonio.goncalves(a)gmail.com <javascript:_e(%7B%7D,'cvml','antonio.goncalves@gmail.com');>> wrote: I think separate events may be better. Maybe I'm mistaken but the way I think the transactional events are used is that during a transactional method an event is fired. The event is then not delivered right away to all observers, but for those using during=after_success only when the TX commits. This is kinda like what JMS does; a message is only send when the TX commits, or send right away. CDI offers 3 other cases, but I feel that those first two are the main ones. For authentication events I don't think we can really speak of a "logging-in" method. Even if we would appoint one (e.g. validateRequest() in a SAM) then I'm not sure whether any random event published during that method would have any need to be queued until just before or after authentication actually happens. Instead, we would merely be interested in the actual events; the moment the container is about to authenticate (so we can potentially veto) and the moment right after that (so we can take an action such as loading data related to the user into the current session). Just my 2 cents. Hope I understood the case correctly. Kind regards, Arjan