on 8/30/01 4:22 AM, Glenn Nielsen at [EMAIL PROTECTED] wrote:
> Why won't installing the jar files in $CATALINA_HOME/lib and making them
> available to all web applications meet your requirements?
>
> Is there a security reason why some web applications can use the classes and
> others should not?
Yes. In particular, I may have a set of classes I want to make available to
my contexts an no one else's. Or perhaps I own a limited-use license on some
common classes. Imagine an ISP running Tomcat in a virtual-host
configuration.
> Do the java classes being shared have static methods and data that needs to be
> shared across this subset of web applications, but not other web apps?
No, I don't think data need be shared across any contexts, nor do I think
you'd want to. It really opens up a can of worms to allow contexts to share
data in memory like that (IMO). I'm assuming individual contexts have
private data.
> I am trying to determine what you want to accomplish and why, not how you want
> to do it. Once we know what you want to accomplish it will be easier to
> determine how to do it within Tomcat 4.
Sure, that makes perfect sense. I don't require being able to extend a
context's class search path, that just seems to be the most appropriate
place to do so.
> Comments:
>
> If you need to restrict access to an API for security reasons there are ways
> to do that using the Java SecurityManager configuration and permissions
> granted in the security policy file.
If you tell me how this is done, I'll let you know if that solves my
problem. Chances are it does not, because I can't give access to a directory
to the owner of some contexts, and say "put your common classes in here". I
have to give access to the CATALINA_HOME/lib|classes dir to every owner of a
context and I don't want to have to do that.
But I'm always open to suggestion.
Thanks!
------------------------------------------------------------
Roderick Mann rmann @ latencyzero.com.sansspam
