Talk:Java Authentication and Authorization Service

My first impression of JAAS is that it is rather complex. Wouldn't it suffice to have 3 components:

• a client,
• a server session and
• a server authorisation

The client communicates with the server authorisation module, which updates the client's role in the server session. The client's role is checked before any method is called. Could anyone explain why JAAS needs 7 modules and 15 communication messages instead of only 3 modules and 3 communication messages in my approach?