Hi Juergen, Thanks, that is a fair point, and I agree that we should not write security code that the container already provides. JSPWiki already has WebContainerLoginModule for container managed authentication.
I have not tested JSPWiki against container managed OIDC yet, so I do not know if it works end to end today. One thing I would check is JSPWIKI-1176, which says that the roles Admin and Authenticated are hard coded, because that could get in the way of mapping roles from an external provider. I will change JSPWIKI-1315 to this: verify and document OIDC through the container, and fix what does not work. A login module in JSPWiki itself would only be considered if the container is not enough. Arturo On Mon, Oct 26, 2026 at 7:08 PM Jürgen Weber <[email protected]> wrote: > Hi, > > enterprise or security features like OpenID, password security or user > management should be left to the application server and Active > Directory. > > E.g. with Wildfly application server OpenID is as easy as auth-method > OIDC in web.xml > > Don't reinvent, don't bloat the wiki, use the power of Jakarta EE. > > Cheers, > Juergen > > Am Mo., 26. Okt. 2026 um 18:46 Uhr schrieb Arturo Bernal < > [email protected]>: > > > > Hi all, > > > > Following my earlier mail, three more Jira issues with proposals. As > > before, none is implemented and I would like feedback on the direction > > first. > > > > > > 1. JSPWIKI-1315, OpenID Connect login. Authentication is JAAS based > > with the login modules in org.apache.wiki.auth.login, so single > sign-on > > depends on what the container offers. The proposal is an optional > module > > that works next to the existing ones. The open points are which OIDC > > library is acceptable and how provider groups map to JSPWiki groups > and > > roles. JSPWIKI-861 and JSPWIKI-94 are related but old and narrower. > > 2. JSPWIKI-1316, importing from other wikis and exporting. I found > no > > import tool and no export to static HTML, PDF or Markdown. The > proposal > > covers a Markdown tree, MediaWiki and Confluence as import sources, > and > > static HTML or Markdown as export formats. The open question is which > > sources matter most. > > 3. JSPWIKI-1317, accessibility of the default template and support > for > > the browser colour scheme preference. The template is already > responsive. > > The issue proposes an audit with an automated checker plus a manual > > keyboard and screen reader pass, fixes for what it finds, and a dark > > variant of the default skin. > > > > > > Comments on any of them are welcome, including "not worth it". > > > > Thanks, > > > > Arturo >
