From the Publisher

What is this book about?

Tomcat is an open source web server that processes JavaServer Pages and Java Servlets. It can run as a stand-alone server or be integrated with Apache. Like Apache, the core Tomcat program is relatively simple, but there are many enhancements that can be added to make it much more complex.

What does this book cover?

You will learn how to integrate Tomcat with the Apache HTTP server (and the situations when you should and you shouldn't), how to set up database connectivity through JDBC, and how to ensure your web applications are secure.

This book will provide you, the server administrator, with the necessary knowledge to install and configure Tomcat, as well as many of the most popular enhancements to the Tomcat package. It will help you plan the installation and possible growth options of your site.

Here are just a few of the things you'll find covered in this book:

• Tomcat 3.x, Tomcat 4.0.x, and Tomcat 4.1.x
• The Tomcat architecture
• Tomcat installation and configuration
• Apache and Tomcat integration using the AJP and WARP connectors
• Tomcat security with SSL, realms, and the Java Security Manager
• Shared Tomcat hosting, server load testing, and load balancing
• Managing and administering web applications
• JDBC with Tomcat
• Ant and Log4j

It will also cover some of the tools that can be integrated with Tomcat, such as Ant (for automatically building web applications) and Log4J (for advanced logging).

Who is this book for?

This book is for professionals working with Java web applications. It assumes a certain knowledge of the JSP and Servlettechnologies, but only from an administrator's point of view. Knowledge of databases, XML, HTML, networking, and general administrative techniques is also assumed.

Product Details

• Table of Contents
• Read a Sample Chapter

Table of Contents

Read a Sample Chapter

Professional Apache Tomcat

John Wiley & Sons

Chapter One

If you've written any Java servlets or JavaServer Pages (JSPs), chances are that you've downloaded Tomcat. That's because Tomcat is a free, feature-complete servlet container that servlet and JSP developers can use to test their code. Tomcat is also Sun's reference implementation of a servlet container, which means that Tomcat's first goal is to be 100% complaint with the versions of the Servlet and JSP specification that it supports.

However, Tomcat is more than just a test server: many individuals and corporations are using Tomcat in production environments because it has proven to be quite stable. Indeed, Tomcat is considered by many to be a worthy addition to the excellent Apache suite of products.

Despite Tomcat's popularity, it suffers from a common shortcoming among open source projects: lack of complete documentation. There is some documentation distributed with Tomcat and there's even an open source effort to write a Tomcat book. Even with these resources, however, there is much room for additional material.

We've created this book to fill in some of the documentation holes and use the combined experience of the authors to help Java developers and system administrators make the most of the Tomcat product. Whether you're looking to learn enough to just get started developing servlets or trying to understand the more arcane aspects of Tomcat configuration, you should find what you're looking for within these pages.

The first two chapters are designed to provide newcomers with some basic background information that will become prerequisite learning for future chapters. If you're a system administrator with no previous Java experience, you are advised to read them; likewise if you're a Java developer who is new to Tomcat. Finally, if you're well informed about Tomcat and Java, you'll probably want to jump straight ahead to Chapter 3, although skimming this chapter and its successor is likely to yield some additions to your present understanding.

We will cover the following points in this chapter:

The origins of the Tomcat server The terms of Tomcat's license and how it compares to other open source licenses How Tomcat fits into the Java big picture How Tomcat can be integrated with Apache and other web servers

Humble Beginnings: The Apache Project

One of the earliest web servers was developed by Rob McCool at the National Center for Supercomputer Applications, University of Illinois, Urbana-Champaign, referred to colloquially as the NCSA project, or NCSA for short. In 1995, the NCSA server was quite popular, but its future was uncertain as Rob left NCSA in 1994. A group of developers got together and compiled all the NCSA bug fixes and enhancements they had found and patched them into the NCSA code base. The developers released this new version in April 1995, and called it Apache, which was a sort of acronym for "A PAtCHy Web Server".

Apache was readily accepted by the web-serving community from its earliest days, and less than a year after its release it unseated NCSA to become the most used web server in the world (measured by the total number of servers running Apache), a distinction that it has held ever since (according to Apache's web site). Incidentally, during the same period that Apache's use spread, NCSA's popularity plummeted and by 1999 was officially discontinued by its maintainers.

For more information on the history of Apache and its developers, see httpd.apache.org/ABOUT_APACHE.html.

Today the Apache web server is available on pretty much any major operating system - as of this writing, downloads are available for 29 different operating systems. Apache can be found running on the some of the largest server farms in the world as well as on some of the smallest devices (including the Linux-based Sharp Zaurus hand-held). In Unix data centers, Apache is as ubiquitous as air conditioning and UPS systems.

While Apache was originally a somewhat mangy collection of miscellaneous patches, today's versions are state-of-the-art, incorporating rock-solid stability with bleeding edge features. The only real competitor to Apache in terms of market share and feature set is Microsoft's Internet Information Services (IIS), which is bundled free with certain versions of the Windows operating system. At the time of writing, Apache's market share was estimated at around 56%, with IIS at a distant 32% (statistics courtesy of netcraft.com/survey/, June 2002).

It is also worth nothing that Apache has a reputation of being much more secure than Microsoft IIS. When new vulnerabilities are discovered in either server, the Apache developers fix Apache far faster than Microsoft fixes IIS.

The Apache Software Foundation

In 1999, the same folks who wrote the Apache server formed the Apache Software Foundation (ASF). The ASF is a non-profit organization created to facilitate the development of open source software projects. According to their web site, the ASF accomplishes this goal by:

Providing a foundation for open, collaborative software development projects by supplying hardware, communication, and business infrastructure Creating an independent legal entity to which companies and individuals can donate resources and be assured that those resources will be used for the public benefit Providing a means for individual volunteers to be sheltered from legal suits directed at the Foundation's projects Protecting the Apache brand, as applied to its software products, from being abused by other organizations

In practice, the ASF does indeed sponsor a great many open source projects. While the best known of these projects is likely the aforementioned Apache web server, the ASF hosts many other well-respected and widely used projects.

Apache Projects

The following is a listing of the current Apache projects, all of which can be found at apache.org/:

The Jakarta Project

Of most relevance to this book is Apache's Jakarta project, of which the Tomcat server is a subproject. The Jakarta project is the umbrella under which the ASF sponsors the development of Java subprojects. At the time of writing, there is an impressive array of more than twenty of these. They are divided into three different categories: "Libraries, Tools, and APIs", "Frameworks and Engines", and "Server Applications". We will highlight two projects from the first category (Ant and Log4J), one from the framework category (Struts), and, of course, Tomcat.

Tomcat

The Jakarta Tomcat project has its origins in the earliest days of Java's servlet technology. Servlets plug into special web servers, called servlet containers (originally called servlet engines). Sun created the first servlet container, called the Java Web Server, which demonstrated the technology but wasn't terribly robust. Meanwhile, the ASF folks created the JServ product, which was a servlet engine that integrated with the Apache web server.

In 1999, Sun donated their servlet container code to the ASF, and the two projects were merged to create the Tomcat server. Today, Tomcat serves as Sun's official reference implementation (RI), which means that Tomcat's first priority is to be fully compliant with the Servlet and JSP specifications published by Sun. JSP pages are simply an alternative, HTML-like way to write servlets. We will discuss all this in more detail in the next chapter.

A reference implementation also has the side benefit of honing the specification. As developers seek to put in code that has been defined in the specifications, problems in implementation requirements and conflicts within the specifications are highlighted.

A reference implementation is in principal completely specification-compliant and therefore can be very valuable, especially for people who are using very advanced parts of the specification. The reference implementation is available at the same time as the public release of the specifications, which means that Tomcat is usually the first server out there that provides the enhanced specification features when a new specification version is completed.

The first version of Tomcat was the 3.x series, and it served as the reference implementation of the Servlet 2.2 and JSP 1.1 specifications. The Tomcat 3.x series was descended from the original code that Sun provided to the ASF in 1999.

In 2001, Tomcat 4.0 (codenamed Catalina) was released, and was a complete redesign of the Tomcat architecture and had a new code base. The Tomcat 4.x series, which is current as of this writing, is the reference implementation of the Servlet 2.3 and JSP 1.2 specifications.

At the time of writing, the latest stable version is 4.0.4. Hints of Tomcat 5.0 are on the horizon, as the new Servlet 2.4 and JSP 2.0 specifications are nearing release and Tomcat 5.0 will need to implement those specifications.

Ant

Ant is a tool to automate building and deploying applications that range from the very simple to the extremely complex. If you're familiar with Unix, you might think this sounds like the ubiquitous make tool. In fact, Ant was created by a group of people who wanted to create a replacement for make. You can read about their comments on the subject at jakarta.apache.org/ant/.

Ant can be used for building applications in any language, and it can be used on any platform that has a Java 1.1 virtual machine or better. Ant's versatility can also be extended with Java plug-ins. Ant won awards from both the Software Development and Java World magazines in 2002, and it is extremely popular amongst developers.

Log4J

Developers generally use logging for two purposes: debugging during development and monitoring when the system is in production. When developing systems, developers usually prefer logging to be as verbose as possible, and aren't concerned with its impact on the system's overall performance. However, when a system is deployed into production, developers want logging to impact performance as little as possible.

Log4J represents more than five years of work towards creating the ideal logging solution for Java programs, combining the desire for generation of rich data at development time with the need for minimal performance degradation in production environments. If your current logging technique is executing something like System.out.println(), you owe it to yourself to investigate this project and see what else is possible with logging.

Log4J Versus JDK 1.4 Logging

Java 1.4 introduced a logging mechanism to Java as part of the standard J2SE platform. Log4J has been in its present form since late 1999, and thus predates the JDK 1.4 logging mechanism by a little more than 2 years (JDK 1.4 went final in early 2002). When it was learned that Java 1.4 would incorporate logging, the Log4J group lobbied to have its product incorporated into Java as the official logging mechanism for the platform. However, that did not happen.

With the release of Java 1.4, Log4J didn't disappear, and doesn't intend to. Log4J provides two advantages over the Java 1.4 logging mechanism: it has more features and it can be used with Java 1.1 or later.

Struts

The current architectural best practice for web applications is the Model View Controller (MVC) design pattern. Under this model, the application is divided into three logical layers (also called tiers): the View, which represents the user interface; the Model, which represents the business logic specific to the application including any persistent data store (for example, a database); and the Controller, which coordinates how the View and the Model interact, and takes care of any other general application behavior (for example, application lifecycle issues). We'll see more on the MVC architecture in the next chapter.

Servlets and JavaServer Pages are the standard Java way to create web applications. They provide an efficient interface to the Web's HTTP protocol. However, developers who wish to create an MVC architecture with servlets and JSP must still do quite a bit of work.

Many third-party frameworks have been created which attempt to relieve developers from the burden of implementing their own MVC architecture, freeing them to instead focus on solving the unique business problems of their organization. Struts is one of these frameworks. Struts has gained an excellent reputation in the development community as being well-designed and very flexible.

Other Jakarta Subprojects

There are many other Jakarta subprojects, including: Lucene, a full-featured search engine; Jetspeed, a portal server; and James, a mail server. See these and others at jakarta.apache.org/.

Distributing Tomcat

Tomcat is open source software, and as such is free and freely distributable. However, if you have much experience in dealing with open source software, you're probably aware that the terms of distribution can vary from project to project.

Most open source software is released with an accompanying license that states what may and may not be done to the software. There are at least forty different open source licenses out there, each of which has slightly different terms.

Providing a primer on all of the various open source licenses is beyond the scope of this chapter, but the license governing Tomcat will be discussed here and compared with a few of the more popular open source licenses.

Tomcat is distributed under the Apache License, which can be read from the $CATALINA_HOME/LICENSE file. The key points of this license state that:

The Apache License must be included with any redistributions of Tomcat's sourcecode or binaries

Any documentation included with a redistribution must give a nod to the ASF Products derived from the Tomcat sourcecode can't use the terms "Tomcat", "The Jakarta Project", "Apache", or "Apache Software Foundation" to endorse or promote their software without prior written permission from the ASF

Tomcat has no warranty of any kind

However, through omission, the license contains these additional implicit permissions:

Tomcat can be used by any entity, commercial or non-commercial, for free without limitation Those who make modifications to Tomcat and distribute their modified version do not have to include the sourcecode of their modifications Those who make modifications to Tomcat do not have to donate their modifications back to the ASF

Thus, you're free to deploy Tomcat in your company in any way you see fit.

Continues...

---

Excerpted from Professional Apache Tomcat by Chanoch Wiggers Ben Galbraith Vivek Chopra Sing Li Debashish Bhattacharjee Amit Bakore Romin Irani Sandip Bhattacharya Chad Fowler Excerpted by permission.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.

---