How does JSP work on IIS?

The following question is often asked - why IIS does not support using JSP directly? Allow me to explain what is really going on here...


Does IIS 5.0 support the use of .jsp pages directly or do I need to use a separate server or extensions to IIS? Thanks in advance.

Thanks for your quick reply. One follow-up question, does IIS 6.0 directly support the use of .jsp or do I still need the 3rd-party add-on?


Ok, here's how all of this works:

  • From a request-serving perspective, IIS natively supports serving static files and execute add-ons (ignoring DAV for the sake of this discussion). This applies to all IIS versions.
  • Ability to use dynamic scripting frameworks like ASP, ASP.Net, PHP, JSP, Perl, etc are all add-ons as far as IIS is concerned. These add-ons are configured as "Application Mappings" on IIS and map to certain resource extensions, and IIS simply executes the configured add-on to handle a particular resource extension whenever it is requested.
  • Windows Server 2003 comes with ASP and ASP.Net add-ons in the default installation and they are configured (but not enabled) by default. Of course, you can still download and install any other add-ons to extend IIS functionality, including JSP/Servlet using Tomcat, PHP, or Perl.
  • Just about all other web servers behave in exactly the same way as IIS in these regards, except they differ on what is bundled, installed, and configured by default.

Tomcat is slightly different and here is how Tomcat works with web servers like Apache and IIS:

  • Tomcat includes a web server written in Java.
  • Since it is writtin in Java, Tomcat obviously can "natively" run a JSP or Servlet, which is basically another Java class to Load, Instantiate, and Reflect as far as Tomcat (i.e. Java) is concerned.
  • All web servers that are NOT written in Java (like Apache and IIS) obviously cannot run JSP without first loading Java code in a JVM to Load, Instantiate, and Reflect on the JSP page, and this is exactly the functionality their respective add-ons/connectors give to these web servers.

A popular add-on for IIS to run JSP on Tomcat is isapi_redirect, and what it does is basically the following:

  • It still requires you to run Tomcat's web server on a certain port so that JSP/Servlets can be configured and executed.
  • It registers an ISAPI on IIS to steal JSP requests from IIS request processing, opens a connection to Tomcat web server, and shuttles the stolen request to Tomcat (i.e. it proxies the request).
  • Tomcat sees this stolen request as brand-new, so it just executes it as-is, including your JSP page
  • The response is sent back to isapi_redirect ISAPI, which then hands the response back to IIS to send back to the original client


What you need to run JSP:

  1. A web server that runs Java to load the JSP. Tomcat does this.
  2. If you want to run another web server for the real content, then you will need an add-on/connector to route requests between this web server and the web server in #1

Thus, IIS can never directly support the use of JSP because it requires an add-on to run Java code in a JVM to Load, Instantiate, and Reflect on the JSP page. The same can be said for every other non-Java web server because they have to do the exact same thing as IIS (so it is a matter of bundling and not capability). Meanwhile, Java-based web servers can obviously directly support JSP, but they are usually VERY slow in raw speed in comparison to native code web servers like IIS or Apache for everything.

In fact, you can say the exact same thing about ASPX pages - IIS can never directly support the use of ASPX pages because it requires an add-on to run .Net code in a CLR to Load, Instantiate, and Reflect on the ASPX page.

So, yes, IIS natively supports running JSP via add-ons, just not directly.


Comments (20)

  1. sandeep says:

    How and where can i get jsp plugin. And how to install it??

  2. David Wang says:

    sandeep – There are many JSP plugins available for IIS – Tomcat, JRUN, JBoss, etc.

    Actual installation and configuration of any of them is beyond the scope of the blog since they are essentially different products with their own support groups. I suggest searching and deciding on a plugin and then locate suitable installation directions to use them.

    I am only talking abstractly about how these plugins interact and function with IIS to help in understanding and troubleshooting.


  3. David Wang says:


    Hello All,

    My client has a IIS 6.0 with some static pages configured in it.  My application…

  4. Harry Parmar says:

    try resin!

  5. P Shanks says:

    A couple of remarks:

    1) JBoss is not a servlet container per se.  It comes bundled with either Tomcat or Jetty to provide that service.  I second the motion to look at Resin.  So a good partial list of JSP/Servlet container candidates in a Windows/IIS environment includes Tomcat, Resin, Jetty and ServletExec.

    2) David: Could you suggest a good way to integrate the Windows Integrated Authentication with Tomcat’s ISAPI-Redirect?  Is there a way to let the Java environment have access to IIS server objects?  I would like to have IIS take care of authentication while letting the servlet container handle my Java code.

  6. David.Wang says:

    P Shanks – integration of Java with Windows Authentication completely depends on the implementation of the JSP/Servlet connector. The issue is not a matter of "letting Java have access to IIS server objects".

    Most every one of the connector simply steals the request from IIS right from the beginning, before IIS authenticates, and forwards the raw stream to the Servlet Container. This causes two problems:

    1. The connector is now considered a Man-in-the-middle attack against the Integrated Authentication protocol (NTLM)

    2. The Container gets all the raw stolen requests so it is now responsible for negotiating Integrated Authentication protocol

    If the connectors simply allowed authentication to proceed to completion on IIS *before* stealing the request and forwarding to the Servlet Container, you would get the behavior you want — IIS first authenticates, and then executes the handler to shuttle request to the Servlet container to execute Java code. Of course, the Servlet still won’t be running as the IIS-authenticated user — the only secure way to do that requires delegation and Kerberos.


  7. I second with the point that any web server made on Java or .Net will be slower. This is because of the layer of abstraction which comes in to picture when these two language come into picture.

  8. Del says:

    I’m interested in the distinction of doing kerberos delegation versus doing authentication on ISS and then forwarding the raw request back.

    Is it considered safe to allow the authentication to occur at the IIS level.  In other words the users authenticates to IIS via SPANEGO and then the JSP request is passed to the app server(resin) via the ISAPI filter and processed.  The java code would use something like request.getRemoteUser to determine which user is executing.  Is there any guarantee that that getRemoteUser is really the same person that authenticated at IIS?


  9. Steve says:

    Man i do not want to run a another funk ass webserver within my main webserver. After reviewing and doing test devolpment deploys of tomcat within IIS to run java it means you have to move your complete install directory to go in Tomcats which is bull. I shouldnt have to move all my domains which run good mind you off its own application pool.

    If you check all the document it shows you need to make tomcat its own application pool and its own web directories which cuts out that 8 hour install of a solid ISAPI version of php you did the for the default app pool.

    I seriously think there should just be some connector released from Sun Micrsystems that does the java langauge recongiation and call and parsing like php.ini does for php.

    needless to say lots of people use java. but seriously its crap to setup in a good solid custom config.

    having to move all my websites to tomcat for them to pick up all the java langauge was not the goal of my java integration and its trully sucks.

    My domain container is setup to point to another drive with mutliple domains on it. all those custom security settings and stuff took hours to do.

    When people say use tomcat to use the java connector dont be fooled. you will have to change your complete hosting directory for the websites to be "sniffed out" for java.

    I hate it.

    Why cant sun microsystems do something right for a change. hell they went through all the trouble to sue microsoft to get the monopoly lifted off Java and microsoft didnt release it no more. The least they can do is make the appropiate ISAPI connectos for IIS 6.0 and the JVM.



  10. Chaitanya says:

    I would agree with Steve on the JaVa Monopoly issue above. Either way… my objective differs.

    I came across this site while attempting to implement JSP functionality on a custom-made free hosting service. I’m afraid of copy-cats, so I won’t detail much here.

    This is the gist:

    A custom free hosting service that provides subdomain functionality using a custom DNS server written in VB.NET, SMTP and POP3 via another custom server (VB.NET again), and web services via IIS. I’ve successfully automated much of IIS through my code – changing ASP.NET versions, adding/removing sites, mysql & mssql databases, etc.

    What I now need, is a good way to implement JSP via a custom ISAPI plugin. And I mean actually do it – not tips like ‘use xyz’ please.

    Thats about it. Can anyone here assit me with the same?


    Chaitanya Dhareshwar

    CBD Arts

  11. Chaitanya says:

    I made a mistake above – mysql & mssql databases are not a part of IIS. Also, I’m currently utilizing an ISAPI for the advertising panel capability (similar to yahoo geocities ad-panel on the right). As of now the panel will not be visible as the plugin is under development.

    Btw – I’m on a tight schedule and quick advice would be HIGHLY appreciated.

  12. David.Wang says:

    Chaitanya – I cannot think of any good, fast way to support JSP on IIS. If it already exists, then no one would want to run things like Tomcat on Windows.

    One basically needs to duplicate the work Microsoft did to support ASP.Net on IIS. You can view ASP.Net as a custom ISAPI which exposes .Net Framework onto IIS. Tomcat Connector is just another custom ISAPI which exposes Java onto IIS, but that ISAPI is a bit flaky because it just forwards the request from IIS instead of proper integration with IIS like ASP.Net.

    Someone’s going to have to figure out how to integrate Java onto server-side correctly to make your life easy, but Sun’s lawsuit pretty much make it impossible for anyone other than Sun to do this task, and they are obviously not interested.

    Clearly, Java is not "write once run anywhere". It is "Write once, run anywhere that Sun allows you to".


  13. Amorak says:

    This is the best-written guide to getting JSP to work on IIS quickly stably that I’ve seen in a long while:

    It’s written by the team at NeoSmart Technologies, who have a long track record of providing quality info on configuring IIS to work with stuff from the Linux world 🙂

  14. Mikee SA says:

    Hi everyone

    I want to run ASP pages on a server that already has Resin (for jsp pages) runnning, it works on my windows xp macine but for some reason the ASP pages cannot be found on the windows 2003 server machine… if I stop the resin engine, it still doesn’t work, if i start Resin & IIS, it still does not display ASP pages. the error I get when the ASP pages cannot be found has a error at the botom of the page that states the name Resin #.#.#…EVEN when i stop resin.

    Please can anyone give me some advice.


  15. David.Wang says:

    Mikee SA –  It seems like Resin just tries to process all pages as JSP, and since it does not understand ASP, it simply returns "cannot be found".

    This sounds like a problem with Resin since it is preventing ASP from working. I would contact Resin’s support personel on how to fix Resin so that it cooperates and interoperates with other software. It is Open Source, it’s supposed to do that, right?


  16. Shakti Kumar says:

    Very nice and useful contains for new user

  17. Shafiq says:

    Good article,that clears the basic concept of beginners.

    well done

  18. Vijendra Kumar H. says:

    Nice Article with good Information.  Thanks David.

    Best Regards,


  19. sandy says:

    IIS is just a web server and cannot support jsp or servlets. It needs a third party tool (JRun or Resin or Tomcat) to run jsp pages on learn more about online courses on<a href="">java certification</a>,.net,my sql,sap and sas

Skip to main content