Spring 4 and Servlet 3.0

[Rod Widdowson]

> Regarding shipping a container, I think I said this on a dev call, I
> do not feel I can support a container like Jetty or Tomcat because I
> do not have the expertise. I think as a project we could, but that
> pushes the work elsewhere. I basically came to that conclusion when
> talking about setuid.

I had a vague memory of this which is why I asked again, thanks for the
clarification.  I understand the motivation and I'm not suggesting we go
back on it, but I will be pushing to change this post 4.0, particularly for
the windows case (which at least doesn't suffer from the setuid nonsense).
In the UK there are a lot of small institutions who really suffer (and
probably end up less secure) because of this. 
 
> That said, I like the idea of shipping distribution options with Jetty
> embedded as well as in the latest modular style to help "get started".
> As noted, those kind of distributions might be toys. From my
> perspective, I am okay with starting there.

It’s a good start, but I can attest that can be an uncomfortable place to be
when secadvs hit.  It what the V2 "QuickInstaller" tried to do and it never
felt very satisfactory mostly because of the weak upgrade story for the
container and indeed the IdP.  OTOH we (I) have learnt a lot (particularly
about updates on windows) from that experience and I think we can make it a
lot less painful.  And indeed:

> So, IMHO, no we are not shipping a container _in_ the IdP as described
> in the wiki, which I should update. Perhaps we will via an installer
> alongside the IdP, with a note describing the kind of support that
> should be expected.

Gets us a great deal of the way - in particular I would imagine that we
would set it up such that it *only* worked for the IdP (so that people who
knew what they were doing would know not to use it).    

I think we want to think about windows packaging (when a single MSI is
indicated), but we can put up enough noise in front of the user if the
clicks the "and do jetty thing" button.

> I think we have agreement that Jetty (or any other container) will not
> be declared as a dependency in the IdP POMs, a separately versioned
> installer might, to decouple versions (between the IdP and the
> container).

Absolutely.  We cannot mandate the container, but we can make it easy to
help people who think that you only find containers on boats and trucks to
get going.

Rod