The fact that this is how most Stripes users are doing their auth didn't influence your decision in any way? ;-)
It influenced things, sure. :)
Also, the big debate we had recently about ClassUtil was related to the difficulties Simon was having with ACEGI. That contributed too. But it's not just that... the request-wrapping technique is pretty elegant, and seems like a good way to make JSPWiki play nicely with lots of things.
I think this sounds pretty good. I've never been much of a fan of JAAS, since it adds all sorts of weirdosities - I have to admit that all those Callbacks sound very strange to me, when you're used to simplicity of Beans.
I admire the design of JAAS quite a bit -- it's modeled after PAM, and is really flexible. It's only weird if you think PAM is weird too. Yes, Callbacks are a little odd, but not too bad, really, once you get the hang of them.
So, is this a 2.8 or 3.0 item?
