Hi Christopher,
I would be very interested in having this available for Tomcat 3.3.
Since I'm not a security expert, I'll defer to those better informed
to decide the appropriate solution. Would this "keystore security
solution" plug into Tomcat 3.3 using an interceptor? If there are
changes needed in the core classes to support this, I would be in
favor of including these changes in 3.3.
Since this solution will be used by Tomcat 4.0 as well, jakarta-tomcat
may not be the best place for the source, other than changes to the 3.3
core (assuming it can plug in as an interceptor). Outside of
jakarta-tomcat it could have it's own release schedule and be developed
to support both Tomcat 3.3 and 4.0. I'm not knowledgeable about what is
in jakarta-commons to say if that would be a good place, or whether
we need a new project, perhaps jakarta-tomcat-plugins or
jakarta-tomcat-addons, to hold something like this.
Cheers,
Larry
> -----Original Message-----
> From: Christopher Cain [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, July 31, 2001 7:46 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [PROPOSAL] Standalone SSL (status?)
>
>
> I forgot to mention that I plan on offering to port this initial
> keystore security solution (whatever it ends up being, although the
> Apache-style prompt is so far the only idea being floated) to
> the 3.3 if
> there is any interest in having it. I don't technically consider it a
> bug, so the 3.2 branch is probably not appropriate. I'm not sure what
> the general feeling on the 3.3 beta process is, if such a
> thing would be
> considered too big a modification at this point, or if anyone
> in the 3.3
> branch is even interested. I just thought I'd point out that you 3.3
> cats are more than welcome to speak up on this idea as well.
>
> Also, where are we at in the process? I hate to be pushy (no, really
> :-), but I kind of need to get my app up and running, plus I'm up
> against it on the cluster management tool I mentioned. If I could just
> get a general feel as to how much support the (configurable,
> as pointed
> out by Jim) command-line prompt idea has as far as addressing the
> problem, then I can go ahead and jam on that. I'm not
> necessarily asking
> for anything offical (although I probably wouldn't mind :-), but I
> mainly just want to make sure that I'm starting on the best possible
> (initial) solution ... or at least the solution that would
> make the most
> sense in the long run should it eventually make in into CVS. Unless it
> is just something wildly personal, I hate writing code to
> extend an OSS
> product and just sit on it myself, but I kinda need to start
> coding soon
> =)
>
> - Christopher
>
