Default Mechanism Ordering Implementation ----------------------------------------- Key: ELY-726 URL: https://issues.jboss.org/browse/ELY-726 Project: WildFly Elytron Issue Type: Task Components: SASL Reporter: Darran Lofthouse Fix For: 1.1.0.Beta18 We have to have some form of mechanism ordering anyway to get silent mechanisms to the front of the queue. SaslMechanismInformation may need some updates but we have plenty of information about the mechanisms so we should be able to put together a reasonable documented ordering. Stronger mechanisms that can complete without interaction with the client can be pulled up the list as they can quickly silently fail where AuthenticationClient does not have enough information to handle them. This set probably includes JBOSS_LOCAL_USER, EXTERNAL, GSSAPI, GS2, and the token mechs. For username / password mechanisms we can ensure PLAIN goes last. Of the CRAM, Digest, and SCRAM set I would suggest first order by digest algorithm and then SCRAM -> Digest -> CRAM. There will be the opportunity for plenty of discussions on is X really better than Y but I think a reasonable default implementation that is documented will be much better than today's current random ordering. Once filtering has been applied to take into account things like available credentials in the realms etc. I would expect most lists to be very small, maybe some silent mechs a token mech and one or two username / password mechs depending on consistency of an identity store.