[ https://issues.jboss.org/browse/ELY-927?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse commented on ELY-927: -------------------------------------- Also we may still have some cases where we want to pass additional information from the mech to the realm. We can use a specific credential type for the result but we still can't get the additional information into the RealmIdenty. As an example session based Digest needs the nonce passing over. The purpose of this is we can make a remote call to obtain a credential representation valid only for this session, even if the heap was compromised the credential instances on the heap would only be valid for a specific session and could not be used for new sessions. -- This message was sent by Atlassian JIRA (v7.2.3#72005)