Question

We have a servlet that needs certain variables like passwords, encryption salts, etc., not to be saved on the file system permanently. This is what we do currently (summary):

During initialization,

1. A Perl script sets ReadMode to 2 to mask stdout echo, prompts user for the variables, filters a known file to put them in and invokes tomcat/bin/startup.sh

2. The servlet init() method reads the variables from the file and deletes it (the file).

Problem:
When the WAR is recompiled, tomcat tries to deploy it (autodeploy=true), which we want. But the data file is no longer there, so a FileNotFoundException is thrown (rightly so).

Question: Is there a property or some HashMap/Table available to servlets where a few variables can be stored during the manual startup? The idea is that init() could check for them if the data file is not there during redeployment. Thank you, – MS.

Answer 1

There is nothing in Tomcat to do what you want. If you move the settings into the tomcat JNDI tree you will have to put the user/name password combo in the server.xml or the context.xml file. Here are a couple of possible solutions for the problem you have.

Option 1: Use a Tomcat Listener

If you look at the top of the tomcat server.xml file you will see several listeners these are java classes that execute when tomcat starts up. You can create you own tomcat listener which reads the password from the file system, deletes the file and stores the username/password Comobo in a way that is accessible to the app. The tomcat listener is tied to the lifecyle of the tomcat server so auto redeploy of the app will not cause your tomcat listener class to be reloaded. The code for your tomcat listener would have to be put into a jar and place in the CATALINA_HOME\lib folder.

The listener could use static variables to store the username/password and have a static methods that return them, this will work because the listener will be in the parent class loader of the tomcat apps. The disadvantages of this approach is that you application code is dependent on the tomcat resource listener implementation, and in your unit tests you might have to do some extra steps to make sure your code can be unit tested.

The listener could also access the tomcat global JNDI tree and put the username and password combo in there, and then your app would have to have context.xml file use a ResourceLink element to make the global jndi entry available to the app. You will also have to do some extra work to make this approach work with unit tests as looking stuff up in JNDI generally complicates unit testing.

If you are using Spring on this project your best bet is to use the static variables in a tomcat listener but then use a custom spring scope to pull the data out of the tomcat listener. that way your app stays testable and you can inject username/password combos into any piece of code that needs them.

Option 2: Use a Servlet Context Listener

In this option you write a Context Listener which will allow your app to be notified whenever the app starts and stops. With this approach on startup the context listener will run and read the password information and delete the file. If the password file is not there on startup then the context listener would have to have a way to get the admin to regenerate the file.

Option 3: Use JMX

Create a JMX MBean register it with the JVM MBeanServer and then use it to store the username/password combo. If you initialize this MBean from a tomcat listener you could then have the perl script call the MBean remotely and pass in the username/password combo.

Hope this helps.