Co-bundling Jetty ?

[David Langenberg]

On Thu, Sep 12, 2013 at 9:57 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/12/13 9:25 AM, "Marvin S. Addison" <marvin.addison at gmail.com> wrote:
> >
> >Can you say a bit more about why you think setuid is mandatory? That
> >doesn't follow from anything in the discussion that I can tell. The
> >desire for privileged ports comes to mind as a reason to setuid root,
> >but most Java webapp deployments I'm familiar with don't do that for
> >security reasons.
>
> If you don't trust it as a web server, then that means you're running
> Apache or something else in front of it, or using firewall tricks or a
> load balancer to forward traffic, either of which (to me) defeats the
> primary purpose of bundling.
>
> The people who will benefit most from bundling are the same people who
> won't know how to work around it running on port 8080 and will almost
> never be load balancing it. The support burden of it not being a plug and
> play package would be very large and be entirely about Jetty support,
> which is not a burden I'm prepared to take on. It's hard to see how we
> could avoid that support role if we're shipping the container ourselves.
>

I don't see how you're going to get out of the support game for Jetty.  If
you list Jetty as the only container to which the project supports running
the software, and I externally download it & have trouble you're gonna get
a question on -users.  You have the same problem today with Tomcat.  At the
very least if you bundle in a specific Jetty version, that limits the scope
of questions for configuring Jetty to just that version.  A comparison from
another project I'm involved in -- Grouper. The grouper project ships a
pre-configured Tomcat as part of our installer package.  Now, I will grant
that Grouper has a smaller install base than shibboleth, but even so, we
rarely get any tomcat-specific questions on the -users list.

Dave

-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130912/d83f1edd/attachment.html