Java 17 deprecated SecurityManager and Java 24 removed it entirely, leaving distributed Java applications without a built-in authorization mechanism. This post introduces two community projects addressing that gap: DirtyChai, a fork of OpenJDK that restores and extends Java's authorization infrastructure (SecurityManager, AccessController, ProtectionDomain), and JGDMS, a security-hardened fork of Apache River providing dynamically-discoverable microservices over IPv6. JGDMS uses Jini-model service discovery, a pluggable constraint-based RPC layer (JERI), and defence-in-depth security including hardened deserialization, TLSv1.3, and proxy trust verification. A minimal deployment example shows how authentication, encryption, and deserialization constraints are declared in deployment configuration rather than service code, enforced at every call boundary without modifying the service API.
