CAS 5.0.x embedded Tomcat in production environment
Ernst-Jan Verhoeven
I was wondering if the embedded Tomcat in CAS 5.0.x is deemed fit for use in a production environment. E.g. will CAS receive timely security updates if any security issues are reported for the embedded Tomcat.
I ask this because we are in the process of upgrading to CAS 5 but our servers will be running Red Hat 6. There doesn't seem to be an official repository for a Tomcat beyond 7 for RH6, so it would be very nice if we can just use the embedded Tomcat instead.
The docs seem a bit ambiguous about the subject. A quote from
https://apereo.github.io/cas/5.0.x/planning/Installation-Requirements.html
[..]
Servlet Containers
There is no officially supported servlet container for CAS, but Apache Tomcat is the most commonly used. Support for a particular servlet container depends on the expertise of community members
[..]
but that page also refers to https://apereo.github.io/cas/5.0.x/installation/Configuring-Servlet-Container.html, where I am told
[..]
Embedded
Note that CAS itself ships with an embedded Tomcat container that allows the platform to be self contained as much as possible. You DO NOT need to configure and deploy to an externally configured container.
[..]
Which kind of sounds like it is somewhat supported :)
Ernst-Jan
Misagh Moayyed
I was wondering if the embedded Tomcat in CAS 5.0.x is deemed fit for use in a production environment. E.g. will CAS receive timely security updates if any security issues are reported for the embedded Tomcat.
Yes. There will be security updates. Timely basically translates to the CAS release schedule and policy. If that model suits you, sure.
[..]
Embedded
Note that CAS itself ships with an embedded Tomcat container that allows the platform to be self contained as much as possible. You DO NOT need to configure and deploy to an externally configured container.
[..]
Which kind of sounds like it is somewhat supported :)
What it tries to imply is that in general, Tomcat-related questions should be routed to the Tomcat folks. (i.e. “Why isn’t the proxy port working?”)