Authorization-constraint imposes authentication

Today I came along a strange problem in Geronimo: I wanted to grant access to everyone (even to those who are not logged in) to a URL which is protected by a <security-constraint>. So I defined a <default-principal> in my geronimo-web.xml and assigned this user to my role which is required to access the URL. To my surprise the login form appeared every time I tried to access the URL.

After some research in the net I found the Geronimo bug 2564 which describes my problem pretty precise. I also found the blog entry Inconsistency between Servlet specification implementations which reveals different implementations of the security part of J2EE. In a foil about J2EE security I spotted the following phrase which would explain my problems:

Authorization-constraint imposes authentication

So I removed the <security-constraint> from my URL and accepted that J2EE (or its implementations?) are not perfect in every way...

Some thoughts about the future of Geronimo

Geronimo is great because it's free and and open source. Now that Sun has open sourced Java and Glassfish there are some new points in the application server fight. Glassfish was actually announced to be open source before but now it will be available under the GPL. Is Geronimo still needed? Geronimo is still J2EE 1.4 and there seems to be a lot of development to be done to make Geronimo Java EE 5 compatible. Glassfish is already on the level of Java EE 5.

A thing I like at the moment more on Geronimo over Glassfish is it's simple installation. But I think we will see some improvements in the future. And since Glassfish will be included in Ubuntu the installation on Linux systems becomes hopefully really easy.

The question is, if there are still any reasons to use Geronimo in the future since Glassfish exists and will become productive ready soon? Is the market great enough for three (JBoss is also still here) open source servers?