Co-bundling Jetty ?

[Cantor, Scott]

On 9/18/13 5:13 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>The cost I worry about the most is the cost of having to track security
>and
>other mandatory updates to Jetty.  This means we have to be experts on it
>ourselves and have to watch it closely, with the added risk that we end up
>having to do coding level support for it because no one else can or will
>(are we not already doing this for other projects?)

We already do to some degree because nobody else seems to grasp that
negotiating TLS and validating certificates are orthogonal tasks.

>Unlike Scott, I am not too worried by the support list cost, although I'm
>prepared to be proven wrong.  As a data point the QuickInstaller for
>windows
>(which is just a bootstrap to get the right things to the right place -
>and
>explicitly does not address updates to any package) ships a stripped down
>Tomcat and my memory is not having [m]any user support issues.  The major
>pain has always been updating the distribution with the latest/greatest
>Tomcat.  

Well, my main point about support was really about the port. Your Windows
example is to the point because Windows doesn't block (or hasn't in the
past) services from binding to low ports. On Linux, you can't do that
without complex workarounds or setuid.

I respect the opinions that this isn't an issue to worry about, but I
don't agree. One big reason discussed on the call is that the obvious
"non-standard" port for the server is 8443, which overlaps with the
"typical" port used for SOAP. We could certainly forget about SOAP in this
kind of installation, but that creates support burdens in its own right
unless we make other changes such as pushing attributes in SAML 1, etc.

>To my mind an important point about bundling Jetty is that we are not
>shipping a general container, we are shipping some carefully chosen jars
>with a carefully chosen "Mandatory default" configuration.  If people
>tinker
>with that then they are deploying their own container and they get a terse
>answer about support.

I think that flies if we can credibly say that the majority of people can
use the mandatory defaults.

>- Mostly I think about Windows where bundling seems very natural.  A
>reasonably large proportion of these people (particularly in the UK) will
>not run any other web service on the IdP host, and further they are not
>large organizations:  meaning that their scalability and availability
>needs
>can be served by an embedded Jetty, the sysadmin staff are so widely
>stretched that they are never going to become jetty experts (indeed they
>will struggle to become IdP experts).   I do *not* think that it is a good
>idea, but I will float the idea of only bundling in a windows environment.

It may be that the setuid problem makes that a legitimate direction.

-- Scott