JSR-168

JSR-168
Name	JSR-168
Title	Java Portlet Specification
Status	Final
Version	1.0
Organization	Sun Microsystems
Contributors	Java Community Process
Release	2003

JSR-168 JSR-168 is a Java specification request defining a standard API for Java-based portlets that run in portal containers. It enables interoperable components across implementations by specifying lifecycle, request handling, and rendering semantics for portlets to be managed by portal frameworks. The specification influenced portal products and standards bodies, shaping integrations in enterprise platforms and content management systems.

Overview

JSR-168 defines a portable programming model for portlets to be deployed onto portal containers such as products from Sun Microsystems, IBM, BEA Systems, Oracle Corporation, and Apache Software Foundation. The specification specifies lifecycle phases that allow portlets to perform initialization, action processing, and rendering under portal servers like Liferay, uPortal, IBM WebSphere Portal, Oracle WebCenter. It establishes interoperability between portlet applications and portal frameworks used by enterprises such as AT&T, Deutsche Bank, Bank of America, T-Mobile, and public sector deployments by United States Department of Defense and European Commission.

Specification

The document prescribes a set of Java interfaces and XML deployment descriptors that map to servlet APIs from Sun Microsystems and patterns seen in Jakarta EE predecessors. It mandates lifecycle methods analogous to conventions used in Apache Tomcat and integration points compatible with containers like Jetty and GlassFish. The descriptor semantics relate to XML schema work by standards groups such as W3C and tie into session management conventions influenced by RFC 2616 and authentication flows similar to OAuth 1.0 era practices. The API defines strict behaviors for render, action, and resource phases, session scoping consistent with Java Servlet Specification patterns, and namespacing mechanisms used in AJAX integration exemplified by products from Google and Microsoft.

Implementations

Multiple vendors implemented the specification in portal platforms, including commercial servers like IBM WebSphere Portal and Oracle WebCenter, open source projects like Liferay Portal and Apache Jetspeed, and academic or government portals such as uPortal. Application servers that hosted portlet containers included BEA WebLogic, JBoss, GlassFish, and Apache Geronimo. Tooling and IDE support emerged from vendors like Eclipse Foundation and NetBeans (then by Sun Microsystems), while integrations with enterprise systems involved connectors to SAP, Siebel Systems, Salesforce, and identity providers conforming to SAML implementations from vendors such as Ping Identity.

Adoption and Impact

Adoption of the specification accelerated interoperability among portal vendors and enabled third-party portlet marketplaces tied to vendors like Oracle Corporation, IBM, and Liferay. Enterprises in finance, telecommunications, and public administration used portlets to compose dashboards integrating services from Microsoft Exchange, Lotus Notes, and SharePoint through portal aggregation layers. Academic, healthcare, and research institutions such as MIT, Stanford University, CERN, and National Institutes of Health leveraged portal frameworks to deliver consolidated web interfaces. The specification shaped subsequent standards efforts within the Java Community Process and influenced later portlet specifications and web component models championed by organizations like OASIS and W3C.

Compatibility and Extensions

Extensions and successor efforts built on the foundation laid by the specification, leading to later versions that provided AJAX-friendly resource serving, inter-portlet communication patterns, and eventing mechanisms used in newer enterprise platforms from Oracle, IBM, and the Apache Software Foundation. Backward compatibility considerations required implementers such as Liferay and uPortal to support older portlets alongside newer modules from ecosystems like OSGi-based deployments championed by Eclipse Foundation. Vendors created bridging libraries to reconcile differences with web frameworks like Spring Framework, Struts, and JavaServer Faces used in large projects by companies such as Red Hat and SAP.

Security Considerations

The specification mandates isolation of portlet instances and scoping rules for session and attribute visibility, addressing concerns similar to those in OWASP guidance and authentication standards like SAML and early OAuth deployments. Implementers had to consider cross-site scripting mitigations recommended by CERT Coordination Center and content security practices promoted by W3C. Enterprise deployments integrated portal authorization with directories such as LDAP and identity management platforms from Microsoft and Oracle, while compliance obligations in sectors overseen by HIPAA and PCI DSS influenced secure configuration and auditing features in portal offerings.

History and Development

The specification was developed under the auspices of the Java Community Process by working groups including participants from Sun Microsystems, IBM, BEA Systems, Oracle Corporation, and open source contributors from projects like Apache Jetspeed and Liferay. Drafts circulated alongside related efforts such as the Java Specification Request series and were discussed at conferences including JavaOne and standards meetings involving representatives from OASIS and W3C. The evolution of portal technology, commercial consolidation among vendors like Oracle and BEA Systems acquisitions, and the rise of alternative web component models influenced subsequent revisions and the creation of successor specifications.

Category:Java specification requests