Re: JAAS Interface to sourceid

Actually, steps 1, 3, 7, and 11 are entirely married to HTTP; replacing
them with generic socket connections would, I think, disqualify your
binding from being called "LECP", you'd have to call it something else. 

The point may be moot, however, as there is merit in the idea of hiding
the liberty interactions (whether it's LECP-based or standard
browser-based) inside of a JAAS facade. 

There are two places where this could add value, as you identified --
inside of a rich client app, and behind a backend servlet container like
Tomcat. I've already started down the road of Liberty-enabling Tomcat,
and it turns out (from the thread I quoted) that neither JAAS, nor
form-based login security (nor a combination of the two) is going to
work well, and that instead, the best route is to build a custom adapter
for Tomcat, using it's Authenticator interface (which is neither JAAS,
nor form-based login). Probably the same pattern will have to be
followed for the other app server containers, unfortunately. 

Backtracking to the client side, it is entirely possible to build an
HTTP client which is embedded in a JAAS LoginManager implementation. I
think this would be a great approach for client-server apps. Perhaps the
LECP profile would be a good place to base this upon, since there is
less HTML and more pure HTTP/XML in that profile (though, at the present
time, there is no LECP support in SourceID-SSO, but it is scheduled to
appear shortly). 

Bryan