Specify behaviour for Principal when nobody is logged in

[benjamin-confino]

I recently had a customer ask why we have CDI inject a Principal containing saying unauthenticated when HttpServletRequest.getUserPrincipal() will give a null in that context.

I think that unauthenticated is the correct choice for CDI, since we cannot inject a null and hope for it to remain up to date as the context changes, but I think it would be useful to clarify the spec on this point as the current behaviour is undefined.

[manovotn]

This belongs to an EE integration part of the specification which is being moved into the umbrella spec (see jakartaee/platform#838).
We should probably keep track of it there instead.

[Ladicek]

What seems a bit weird to me is that the specification doesn't define the scope of the Principal bean. I guess it should be @RequestScoped, and that itself actually precludes a null value.

[starksm64]

Closing as this has been moved to jakartaee/platform#841