Payara Server Comes with Soteria, an Implementation of the Java EE Standardised Security API.
Historically EE Server vendors have implemented their own security APIs which wasn't very 'write once run anywhere' friendly. The new 'Java EE Security API 1.0', or JSR 375, aims to solve that problem. It contains APIs for authentication, identity stores, security context. It's been available since Payara Server 4.173.