When it comes to deploying Oracle REST Data Services (ORDS), there are three main options to consider: Standalone, Apache Tomcat, and Oracle WebLogic Server. Each has its own advantages and drawbacks, so it’s important to understand the differences between them before choosing a deployment option.
ORDS Standalone
ORDS Standalone is the simplest deployment option and requires no external application servers. In fact, once you have ORDS, you have all you need to get started. It uses the Eclipse Jetty server embedded in ORDS, which is suitable for development, testing and production environments. It’s easy to set up and manage. It’s simplicity makes it ideal for smaller workloads but can also scale for high availability and greater throughput when a load balancer is put in front multiple ORDS standalone instances.
To run ORDS in standalone mode: ords --config /path/to/config/ serve
One should note that although using ORDS with Apache Tomcat or Oracle WebLogic Server is supported, quite often the diagnosis process for any support issues will involve verifying if the issue also occurs with ORDS standalone.
As mentioned in a previous article about Application Process Monitoring, when running in standalone mode, ORDS loads the jars from the ords.war into memory and some Java Agents which modify jars to instrument classes at the byte level can interfere with that classloading process. Examples of Java Agents which can not be used when ORDS standalone mode is used: Oracle APM Java Agent, DynaTrace Java Monitoring.
Pros:
- Easy to set up and manage. Get started straight away!
- Can generate a convenient self-signed certificate for HTTPS.
- Suitable for development and testing.
- Ideal for a variety of workloads.
- ORDS configuration of embedded Jetty server optimised for REST services.
- Jetty configuration is extensible using XML files.
Cons:
- Limited integration with identity and authorisation management systems.
- Requires a load balancer for high availability.
- Does not work with some Java Agents.
ORDS Deployment to Tomcat
Apache Tomcat powers numerous large-scale, mission-critical web applications across a diverse range of industries and organisations. Chances are that your organisation is already running at least one Apache Tomcat servlet container. Tomcat is a popular open-source web server that is well-suited to ORDS.
It’s easy to set up, and deploying ORDS to Apache Tomcat is as simple as ords --config /path/to/config/ war $CATALINA_HOME/webapps/ords.war
Of course, that’s if your Tomcat configuration has auto deployment enabled, which is the default setting. Similar to ORDS standalone, Tomcat is configured to be reasonably secure for most use cases by default. Also, similar to ORDS standalone, for high availability a load balancer / reverse proxy must be configured to route to the servers.
Pros:
- Integration with identity and authorisation management systems, such as Active Directory, OpenID Connect, through container managed security.
- Suitable for production workloads.
- Easy to get started with: install Apache Tomcat, start it, generate the ords web application, done.
- Free.
Cons:
- Involves an additional server.
- More complex to manage than ORDS Standalone for clustering – see Tomcat Cluster documentation. Moreover, since ORDS is stateless, session serialisation, which is a common characteristic of web server clustering, that aspect of most clustered systems is not required.
ORDS Deployment to WebLogic
Oracle WebLogic Server is a unified and extensible platform for developing, deploying and running enterprise applications, such as Java, for on-premises and in the cloud. ORDS deployment to WebLogic is a very robust option. Weblogic is a powerful and reliable application server and provides advanced features such as clustering and load balancing. It’s suitable for large-scale production workloads. However, provisioning and configuring an Oracle Weblogic domain can be complicated.
The steps for deploying ORDS to WebLogic are involved and it’s best to refer to ORDS documentation.
Pros:
- Provides advanced features such as clustering and load balancing
- Suitable for large-scale production workloads
- Robust and reliable
- Integration with identity and authorisation management systems, such as Active Directory, OpenID Connect, through container managed security.
Cons:
- Requires an Oracle WebLogic application server licence for production
- Complex to set up and manage but is fairly standard for an enterprise grade application server
Decision Factors
Ultimately, the deployment option that’s best for you depends on the complexity of your integration with other systems. What your organisation already uses, and has support in place for, is also an important factor. ORDS standalone is ideal for getting started, developing and testing new services before deployment to product. It’s also suitable for production workloads. What it misses out of the box is integration with identity and authorisation management systems. That’s essentially the gap that deployment on Tomcat and Weblogic addresses. In all three cases, each mode is suitable for large-scale production workloads with appropriate load balancing in place.
Post Publishing Edits: February 20th 2023 - Added text about some Java Agents not working with ORDS standalone. February 25th 2023 - Added text pointing out that ORDS does not retain session state.
Peter's Random Topic Library 
Having set up and deployed ORDS hundreds of times (always with APEX included) I’ve yet to ever see a situation in which Tomcat and/or Weblogic adds any value if you are just using ORDS for APEX. While you can use Tomcat or Weblogic for clustering an ORDS deployment, ORDS doesn’t maintain state in the middle tier, so that clustering isn’t really going to make ORDS better. With APEX the integration with identity and authorization management systems can be done in APEX instead of using Tomcat or Weblogic.
The only time I’d ever recommend using either Tomcat or Weblogic is if the organization already has a large set of applications deployed to Tomcat or Weblogic, and for Weblogic, that would be a large set of applications deployed other than just Oracle ERP.
LikeLike
This is true, particularly if one is using ORDS primarily for running APEX through the ORDS PL/SQL Gateway. APEX has excellent integration with identity and authorisation management technologies. APEX Social Sign-In immediately comes to mind as one example. That is not an out of the box option for ORDS REST Services, REST Enabled SQL, Database API, and other ORDS features. That’s where the Tomcat and WebLogic container management security currently has an important role to play.
LikeLike