V3 Idp- system requirements

[Peter Schober]

* Ramaiah, Vanna G. <ramaiah at musc.edu> [2016-08-01 15:43]:
> https://wiki.shibboleth.net/confluence/display/IDP30/SystemRequirements
> 
> The above doc says it does not support "packaged" containers by OS
> vendors. I'm not 100% sure what that means. I believe Jetty is a
> container engine. Tomcat8 is not, to my knowledge, so perhaps we can
> use the OS packages for Tomcat8 but not Jetty, or does it mean a
> container that runs within Jetty?

If either Tomcat or Jetty could be used with the IDP, it doesn't
matter what you call those (N.B.: Both Tomcat and Jetty are Java
Servlet Container software), such statements will apply to both.

Personally I never had a production service (Shib IDP or otherwise)
run on /unpackaged/ (i.e., manually downloaded and unpacked, etc.)
container software, as I value easily available security fixes from
the OS vendor/distribution.

There may or may not be available packaged and supported (e.g. via
security updates) versions for either one on the OS of your choice.
E.g. no Tomcat8 or Jetty 9.2/9.3 packages seem to exist for
RHEL7/CentOS7, for Debian8 Tomca8 packages exist in stable-backports,
etc.
SWITCHaai even documents (and supports) running Tomcat7 on
RHEL7/CentOS7, as (OS-vendor supported) packages exist for that, even
though Tomcat7 it's not officially supported by the Shibboleth
project. I.e., SWITCHaai values vendor-provided security updates
higher than the Shib project's "officially supported" status. If you
have the resources to support other deployments, that's certainly a
choice you can make. (Of course Tomcat7 might not always work with
later IDP releases, going forward.)

But with all the devops hype going on today (automated downloading and
running -- usually as root -- of arbitrary software from the Internet,
often without regard to checksums or cryptographic signatures) it
seems OS/vendor-provided software updates are less popular than
ever. Instead people are replacing the whole OS instance with an
updated (immutable) server.
-peter