You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Ron Monzillo <ro...@oracle.com> on 2013/02/06 16:45:37 UTC
Re: Consider support for the Servlet profile of JSR 196 (JASPIC)
in Tomcat 7.0.x
On 2/3/13 5:02 AM, Mark Thomas wrote:
> On 30/01/2013 23:57, Ron Monzillo wrote:
>> Tomcat Experts and Users,
>>
>> The Servlet Profile of JSR 196 defines the use of the JASPIC SPI in
>> support of the portable integration
>> of new and/or custom authentication mechanisms in compatible Servlet
>> containers.
>>
>> The Profile is a required component of all Full Platform EE Web
>> Containers, and we are receiving requests
>> for the profile to become a required component of the EE web profile. To
>> that end, we are contacting
>> standalone and EE web profile Servlet containers to determine if there
>> is interest in adopting the profile.
>>
>> For those unfamiliar with JASPIC, the SPI is a general purpose facility
>> that applies the concepts of pluggable
>> authentication as defined by PAM and JAAS to the realm of message
>> authentication. The Servlet profile applies
>> the SPI to the realm of HttpServletRequest message authentication in the
>> context of servlet security constraint
>> processing. The SPI was defined to support complex challenge response
>> authentication protocols, and has
>> been shown to be an effective means to integrate portable
>> implementations of new internet authentication
>> mechanisms (e.g. Facebook Connect, and SAML WEB SSO) in compatible
>> Servlet containers.
>>
>> Does the Tomcat community support the inclusion of the Servlet profile
>> of JSR 196 in the EE web Profile?
> Apache Tomcat does not currently support the Java EE web profile. Tomcat
> currently supports only the Servlet, JSP and EL specifications and will
> be adding WebSocket to that list for Tomcat 8.
>
> The has been very little demand from the Apache Tomcat user community to
> support the Java EE web profile. There have been just two threads on the
> users list that mention the web profile. There have been slightly more
> on the dev list.
>
> JASPIC was on the TODO list for Tomcat 7 for a while but it dropped off
> because a) it wasn't a mandatory requirement for Servlet containers and
> b) there was very little (no references at all on the users list) for it.
>
> I think it would be safe to say that the Apache Tomcat community has no
> opinion on the Java EE web profile requiring JSR 196 support. You'd
> obviously get a very different reaction if the Servlet spec was going to
> require JSR 196 support.
>
> Apache TomEE does support the Java EE web profile. If you haven't
> already approached that community for their views, I recommend that you
> do so.
Mark,
I have posted the question to the TomEE and Caucho/Resin user's lists.
It would also help to know what the level of interest is from Tomcat
users and developers.
I anticipate that there are Tomcat users and developers who are committed
to other approaches, but I'd like to make sure the use of JASPIC has been
presented for consideration by the Tomcat community.
I would also like to know if anyone has already done or is interested in
doing
the work to integrate the JASPIC profile in the Tomcat code base.
kind regards,
Ron
>
> Kind regards,
>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Consider support for the Servlet profile of JSR 196 (JASPIC) in Tomcat 7.0.x
Posted by David Jencks <da...@yahoo.com>.
Umm, a few years ago I was quite interested in implementing it for tomcat, but couldn't raise any support over here. I still think the geronimo-tomcat-jaspic integration could be adapted to tomcat standalone pretty easily, although I don't think I'll have time to work on it.
thanks
david jencks
On Feb 6, 2013, at 10:29 AM, Mark Thomas <ma...@apache.org> wrote:
> On 06/02/2013 15:45, Ron Monzillo wrote:
>> I have posted the question to the TomEE and Caucho/Resin user's lists.
>>
>> It would also help to know what the level of interest is from Tomcat
>> users and developers.
>
> For users@, yours is the first post ever to mention JASPIC. We'll see
> what reaction your post gets.
>
> For dev@, it is safe to say it is an itch no-one has wanted to scratch
> so far because it hasn't been implemented. User demand could change that
> but so far there hasn't been any.
>
>> I anticipate that there are Tomcat users and developers who are committed
>> to other approaches, but I'd like to make sure the use of JASPIC has been
>> presented for consideration by the Tomcat community.
>
> It has been on our radar for well over 3 years. As I keep saying, so far
> no-one seems to be that interested in either using it or implementing it.
>
>> I would also like to know if anyone has already done or is interested in
>> doing
>> the work to integrate the JASPIC profile in the Tomcat code base.
>
> I believe the Geronimo folks have had this implemented for a number of
> years. If JASPIC support was going to be added to Tomcat, that is
> probably where we'd start.
>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Consider support for the Servlet profile of JSR 196 (JASPIC)
in Tomcat 7.0.x
Posted by Mark Thomas <ma...@apache.org>.
On 06/02/2013 15:45, Ron Monzillo wrote:
> I have posted the question to the TomEE and Caucho/Resin user's lists.
>
> It would also help to know what the level of interest is from Tomcat
> users and developers.
For users@, yours is the first post ever to mention JASPIC. We'll see
what reaction your post gets.
For dev@, it is safe to say it is an itch no-one has wanted to scratch
so far because it hasn't been implemented. User demand could change that
but so far there hasn't been any.
> I anticipate that there are Tomcat users and developers who are committed
> to other approaches, but I'd like to make sure the use of JASPIC has been
> presented for consideration by the Tomcat community.
It has been on our radar for well over 3 years. As I keep saying, so far
no-one seems to be that interested in either using it or implementing it.
> I would also like to know if anyone has already done or is interested in
> doing
> the work to integrate the JASPIC profile in the Tomcat code base.
I believe the Geronimo folks have had this implemented for a number of
years. If JASPIC support was going to be added to Tomcat, that is
probably where we'd start.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org