Modular Installation in the IdP

Fri May 15 10:08:12 UTC 2020

On 13/04/2020 14.32, Rod Widdowson wrote:
> I've been kicking some ideas around about how we approach adding new
> functionality that not everyone needs without increasing the size of
> the monolithic IdP install.

As an IdP extension developer, I appreciate this effort toward more
modularity. :) What I still don't like about it, is the WAR rebuild step
which has to happen outside of my usual Java development workflow and
with a different tool. I've tried to work around this with Maven WAR
overlays, which I don't think will work with this new plug-in architecture.

What if deployers didn't need to build an IdP WAR file? This brings me
to another idea I've been kicking around and I'll summarise it with "own
your servlet container". The IdP could ship it's own servlet container
by embedding Jetty or Tomcat akin to what Spring Boot does, but without
the complicated JAR-in-JAR packaging. Then starting the IdP becomes a
matter of invoking Java with a classpath containing all "system" classes
and plug-ins (coming from different directories). This greatly
simplifies installation because deployers no longer have to maintain
Jetty or Tomcat themselves (likely for the sole purpose of running the
IdP) and there is just one command to start the IdP `java -cp ...
MainIdPClass` which is easily integrated with systemd. This is also
orthogonal to the plug-in installation/update machinery.

Of course, this makes you responsible for maintaining the embedded
servlet container, but on the other hand, it reduces the number of
different supported servlet containers to just one: the one you choose
to embed.

Given that Tomcat has been removed from RHEL 8 in favour of RedHat's own
JBoss product [1], it brings it on a equal footing with Jetty: neither
are packaged by RPM-based distributions for easy security updates.
People using these distributions are left manually upgrading their
servlet containers. I think it would help them if it were embedded in
the IdP so they don't have to maintain it. By the way, Tomcat's removal
from RHEL negates the biggest argument we (SWITCH) had to recommend
using it over Jetty for ease of maintenance. Meanwhile, users of Debian
and Ubuntu still enjoy packaged Tomcat and Jetty. :)

Embedding your own web server is also a tendency I can observe among the
web applications I operate as a developer: Jenkins, SonarQube, Sonatype
Nexus. They all run their own embedded servlet containers. It also makes
running these in [Docker] containers much easier.

What do you guys think?

  Etienne

[1]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/considerations_in_adopting_rhel_8/dynamic-programming-languages-web-servers-database-servers_considerations-in-adopting-rhel-8#tomcat-removal_configuring-the-unversioned-python