HTTP server: ORDS or Tomcat or Apache

Question

Our current APEX configuration uses Oracle OHS with mod_plsql on Linux. In this situation, it is clear that the browser connects to OHS, makes a HTTP request and OHS hands that request to the APEX engine in the Oracle Database via mod_plsql which satisfies the request and returns a response back to OHS and back to the browser.
When using ORDS in standalone mode, the browser connects to ORDS which uses JDBC to connect to the APEX engine in the Oracle Database which satisfies the request and returns a response back to ORDS and back to the browser.
Questions:
1. When ORDS is deployed in a Apache Tomcat container, I am not sure I understand how the data flows. Who acts as the web server in this case, ORDS or the Coyote HTTP connector inside Tomcat? What component connects to the APEX engine?
2. When Apache and Kerberos are thrown into the mix as shown in Single Sign-On for APEX applications using Kerberos  same questions, what component does what exactly?
Thanks

Answer 1

Tim - Thanks for jumping in. Let me make sure I understand.
1. I followed the instructions on http://spnego.sourceforge.net . A SPN for the Tomcat server has not yet been  added to AD but since the default filter-mapping applies only to *.jsp I thought it wouldn't affect Tomcat as long as I don't request URLs ending in  JSP. But to my surprise, even the Tomcat homepage at http://host:8080 gives a HTTP 500 error and the logs/localhost.yyyy-mm-dd.log has the error
18-Nov-2014 09:24:30.286 SEVERE [http-nio-8080-exec-1] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [jsp] in context with path [] threw exception [GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)] with root cause
java.security.GeneralSecurityException: Checksum failed
Why is this? Is this just the way Tomcat works i.e. all filters should successfully initialize for Tomcat to even come up, regardless of the URL requested?
2. What is the syntax for the <url-pattern> command? Does it do regular expression matching on the full URL, including the query string? To match all APEX URLs, shouldn't it be /f?p= instead of just /f ? What about accept processing? The URL for that is /apex/wwv_flow.accept, should this be added to the spnego filter too? I didn't see any documentation on this on the SPNEGO SourceForge site
3. When you say "we simply setup a second listener that did not enforce authentication", can you clarify how you did this exactly? Did you copy apex.war to, say, apex-public.war and use http://host:port/apex-public/... to serve public content? But if the SPNEGO filter applies to the entire Tomcat instance, wouldn't it apply to this as well? Maybe this goes back to my questioin #2 above i.e. did you specify the url-pattern as /apex/f?p= so it will skip the public webapp?
4. IMHO the SPNEGO filter works very well but it appears to be very fragile, even a minor configuration error results in a HTTP 404 or HTTP 500 and troubleshooting is a pain. Is it really recommended to use this in a Production environment?
5. Yes, Waffle does look like a easy, plug-and-play solution but it doesn't work on Linux so we would need to install Tomcat/Waffle/ORDS on a Windows server. Will look into this. Thanks.
Thanks