jetty-dev and delegate-to-application

[Cantor, Scott]

> I noticed a thread on the jetty-dev list with a use case similar to
> our DTA plugin requirements. Maybe there's a chance here to explain
> our needs ? I'm not good enough at the terminology to do so well. The
> response from the Jetty developer explained a couple of things I had
> been wondering about.
> 
> http://dev.eclipse.org/mhonarc/lists/jetty-dev/msg02329.html

I'm not on the list, but here's a decent start for you.

Basically, there are constant red herrings thrown around about revocation and other things, as though that has anything to do with the feature request.

- It is incredibly non-trivial to validate certificates and do trust checking.
- No matter what Sun/Oracle, or Jetty's team, or Tomcat's team, thinks is the "right" way", there is no single right way.
- There are many applications like SAML, DAME, and others that have totally different requirements for certificate checking.
- Plenty of applications would like to be able to do this for themselves without any interference from the container.
- Nobody is suggesting this be a default setting.
- It's easy to implement an option to do this and it would be tremendously valuable to have that feature built in.

If you wanted to just echo that, I think it's good enough, along with a pointer to our plugin.

-- Scott