----- Original Message ----- From: "KUMAR,PANKAJ (HP-Cupertino,ex1)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 31, 2002 11:47 PM Subject: RE: isolation of web services deployed on axis
> I have been watching this discussion with some curisity ... > > There is an intersting parallel here with the Web Application world. There > are huge sites that run on farm of servers and then there are tiny sites > that get hosted on a single box, all served by one web server. I don't see > how the web services world is going to be different. Why shouldn't an ISP be > able to provide "hosting" of multiple web services, to different entities, > on the same box, within the same container? > > My ISP allows me to have my own perl scripts. I would want it to have my own > servlets but today it doesn't allow me that. Don't know if there are ISPs > that allow. But the deamnd is certainly there. The same would hold for web > services. Whether Axis can do this or not, with reasonable overhead, would > largely determine its acceptance within such environments. if your ISP doesnt handle servlets/jsp, it wont take axis. > I realize that the current architecture of Axis, where Axis runs as a > servlet supporting all deployed web services, will be a problem. This is one > area where I like the JAX-RPC RI architecture where each web service is a > separate servlet. With this comes isolation as one could define the access > rights of the code for each servlet separately. The trouble with isolation is that you have to be thorough. you need isolated -classloaders -jndi -jmx -rpc -anything else provided by the container servlet engines provide exactly this isolation between webapps. There is no point redoing this in axis, as all we'd end up doing is reinventing stuff and chasing security issues wherever we missed a bit. And then we still wouldnt integrate properly with the isolation provided by the hosting app server. Its easy to add axis.jar to an existing webapp. lets stick with what is known, working and documented.
