Hi everybody---

An experimental JSPWiki branch with the new AAA subsystem is nearing alpha status.

Background
----------
Less than 60 days ago, a bunch of us in this fine list bashed out a set of requirements for a new system for authenticating and authorizing users. Although there are too many requirements to list here, some of the primary features include:
- Continued support for JSPWiki's custom authentication system
- Full support for container-based authentication and authorization, including container-style roles
- Flexible, ad hoc "groups" 
- Wiki-based ACLs
- Customizable security policies, with simple and sensible defaults
- New user database for "persistent" user identities
- Support for standard Java security technologies; notably, J2SE security policies and JAAS authentication

Development needs
-----------------
I need help getting the preceding list of requirements implemented...
2.7  Access restrictions on searches not implemented yet.
2.9  Hard-coded "super user" needs to be re-implemented
     and coded into AuthenticationManager.
3.3  Groups names are checked at creation time to make
     sure they aren't the same as a built-in role, but
     there should be logic in the JSP pages that tells
     the user they can't do that...
3.8-3.11 Requirements not implemented yet (these are "nice
     to have" features anyway)
4.10 Page restore operation restores previous
     ACL, not current ACL
6.9  Password re-set not implemented yet (nice-to-have)
7.1  Embedding permission checks within core wiki classes
     (e.g., WikiEngine) NOT implemented yet. Examples:
       - WikiPage.setAcl should check for 'edit'
7.5  Need to sanity-check configuration files (e.g.,
     jspwiki.policy) to ensure they implement a common
     number of use cases that should "just work."
7.6  No user-facing documentation at the moment...

Deployment considerations
-------------------------
JSPWiki now installs default JAAS and J2SE security policies
at startup. See the jspwiki.policy and jspwiki.jaas files 
for more details on how to customize these configurations
if you don't like the defaults.

Bugs, limitations and errata
----------------------------
- Need a CreateGroup.jsp page **badly**
- Ant build script (build.xml) now automatically signs
  the jspwiki.jar file after it builds. It will attempt
  to create a new .jks key file for you if it can't find
  one where it expects (etc/). If will also copy this key
  file to WEB-INF when building the WAR.
- There are some funky cookie/user profile issues that persist
  during logout operations. This could cause funnny
  things to happen when editing preferences or registering.
  This will get solved very soon... but not tonight.
- Container-managed authentication has been tested
  and debugged. It works.
- User preferences has been split into the traditional
  "master" JSP with the business logic, and a separate
  *Content.jsp file.
- User registration now lives in a JSP separate from
  user preferences. The explanation for this is complex,
  but it boils down to the impossibility of guaranteeing
  session state (anonymous, asserted, authenticated).
  Since the UI is subtly different in all of these cases,
  it made sense to break the two functions apart.
- UserCheck and UserProfile tags have significant
  enhancements that should make template-writing much
  easier, with a dramatic reduction in scriptlet code.
- Changes to the AAA model ***will*** break your
  custom template's scriptlet code unless you change
  JSPs to use the new API calls, in particular
  AuthorizationManager.checkPermission(). A migration guide 
  for template developers would be great!
- Container-based authentication has been unit-tested
  but not system-tested, so it might not work.
  But it should...
- Requirement 1.10 might not be practical. I didn't
  attempt to implement it.
- Groups are implemented as wiki pages named Group*
  rather than as subpages of GroupConfiguration
- UserPreferences.jsp needs a decent stylesheet...

Requirements
------------