Jakarta EE 11

Apply the Java 21 prompt first. Jakarta EE 11 requires Java SE 17 or later; these rules target Java 21. Apply each component's rules only where the deployed platform or profile provides that specification.

Authentication and identity stores

• Install a CDI-discovered HttpAuthenticationMechanism or a configured built-in mechanism. In custom validateRequest, call HttpMessageContext.notifyContainerAboutLogin only after credentials validate; an unfinished exchange or NOT_VALIDATED result isn't authentication. Rate-limit credential attempts across mechanism and programmatic login entry points.
• Configure multiple mechanisms through HttpAuthenticationMechanismHandler; Security 4.0's default handler resolves one mechanism by CDI ambiguity rules and doesn't chain them. Inject built-ins with their qualifiers, and never let invalid credentials fall back to weaker authentication.
• Review IdentityStore priority and useFor settings together: an INVALID result does not prevent a later store from validating the credential, and PROVIDE_GROUPS stores can add groups. Bind supplemental groups to the validated store identity and tenant instead of joining unrelated accounts by username alone.
• Keep DatabaseIdentityStoreDefinition.callerQuery and groupsQuery developer-controlled, using their single caller-name placeholder. Select a password-hashing policy through hashAlgorithm and hashAlgorithmParameters; explicitly tune Pbkdf2PasswordHash.Iterations for the deployment instead of accepting its legacy default of 2048 iterations.
• For