# jini Published articles for jini. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Propagating User Identity Chains Across JVM Service Calls DevFeed: [Propagating User Identity Chains Across JVM Service Calls]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-23T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [Java](), [Authorization](), [Protocol (disambiguation)]() Tags: [authorization](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [microservices](), [protocol](), [security](), [technical](), [tls](), [tokens]() ### AI overview This article explains how a chain of user identities crosses service calls on the wire. It distinguishes TLS machine authentication from in-band user claims, describes receiver-side limits and principal handling, and notes that standard Java 24 lacks the required authorization support without DirtyChai on both ends. ### Source excerpt Alice calls the order service. The order service calls the ledger on her behalf. At the second hop, the ledger has to decide whose authority the debit is being made under. Most stacks answer badly. Forward Alice's bearer token verbatim, and the ledger cannot tell her from the service that relayed it. Drop the token and the ledger sees a machine, with no record that a human started the chain. Neither option lets the ledger authorize the combination. ## Security Baked Into the JVM: two Subjects, one call DevFeed: [Security Baked Into the JVM: two Subjects, one call]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-09T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [SPIFFE](), [SPIRE]() Tags: [certificates](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [jwt](), [microservices](), [oidc](), [permission](), [process](), [security](), [spiffe](), [spire](), [technical]() ### AI overview This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries. ### Source excerpt The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently. ## Security Baked Into the JVM: the Safe Codebase Audit Pipeline DevFeed: [Security Baked Into the JVM: the Safe Codebase Audit Pipeline]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-07-19T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [Java](), [Architecture & Design](), [systems]() Tags: [analysis](), [bytecode](), [dirtychai](), [distributed](), [java](), [jgdms](), [jini](), [jvm](), [microservices](), [security](), [supply-chain](), [systems](), [technical]() ### AI overview This article presents the Safe Codebase Audit Pipeline, or SCAP, for analyzing third-party Java JARs before clients deserialize objects from them. It focuses on supply-chain risks from malicious bytecode and blocking static initializers, and describes distributing the pipeline across hosts with separate responsibilities and restricted network access. ### Source excerpt In Part 1, the minimal deployment showed constraints traveling with the proxy: authentication, encryption, hardened deserialization, all declared in configuration and enforced at the call boundary. The proxy is a JAR. That JAR was downloaded and unmarshalled before any constraint ran. That step is the earlier problem. Distributed Java systems that load remote code are vulnerable to supply chain compromise: an attacker can replace a legitimate JAR with one containing malicious bytecode. ## Security Baked Into the JVM: why fork Apache River and OpenJDK? DevFeed: [Security Baked Into the JVM: why fork Apache River and OpenJDK?]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-06-28T00:00:00Z Content type: opinion Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [Java](), [openjdk](), [Architecture & Design](), [Remote Procedure Call (RPC)](), [Networks]() Tags: [authorization](), [dirtychai](), [discovery](), [distributed](), [ipv6](), [java](), [jgdms](), [jini](), [jvm](), [lock-free](), [microservices](), [openjdk](), [rpc](), [security](), [self-healing](), [technical]() ### AI overview This article introduces DirtyChai, a community fork of OpenJDK that restores Java authorization infrastructure, and JGDMS, a security-hardened fork of Apache River for dynamically discoverable microservices over IPv6. It argues that distributed systems require security beyond network firewalls and outlines the projects' complementary roles, including authorization, service discovery, hardened deserialization, transport security, proxy trust verification, and codebase safety checks. ### Source excerpt The more distributed a system, the harder it is to secure. Code crosses JVM boundaries. Objects are serialized across trust boundaries. Third-party proxies run inside your process. The usual answer is a network firewall. It helps, but it operates at the wrong level. Java 17 deprecated the SecurityManager, Java 24 put the final nail in its coffin. Most developers didn't notice.