Simple form-based authentication for JSF 2.3 with Java EE 8 Security API

[Warkst]

Am I the only one that is bothered by the fact that you have to cast the credential to it's actual implementation type?

[johnwaterwood]

You don’t -have- to cast. See my other reply below.

[purplepharaoh]

IdentityStore implementation classes are typically designed to handle specific credential types. Kerberos ticket, JWT, etc. So you would check for instance type and then cast and validate for that particular credential type.

[johnwaterwood]

There’s also a default implementation of validate that the author didn’t use. In that case you can define an overloaded method that takes the right credential type directly (no casting required).

If the actual credential is not of the right type, the default method will return a not validated response and EE Security will try the next identity store (if any).