Re: [jboss-as7-dev] web security extensions

In this manner, multiple web apps could use the same security domain and you wouldn't have to change their config if you wanted to change the authentication method. The security domain has complete control over the authentication mechanism. You could take this even further fully delegate security constraint application to the security domain. THis would be very interesting as then an Identity Management service could have complete control over security metadata without having to modify the WAR.