Narration Script for Web Service Medation Patterns WebSphere DataPower Demo

Transcription

1 Narration Script for Web Service Medation Patterns WebSphere DataPower Demo IBM Software Group Web Service mediation patterns for dynamic routing of multiple tenant requests using WebSphere DataPower SOA Appliance IBM Developer Skills 2007 IBM Corporation Welcome to the IBM Software-as-a-Service demonstration series. In this series, we will demonstrate a set of architectural patterns exploiting features in IBM middleware to build software-as-a-service solutions. In this demo, we will take a look at mediation patterns for rapid enablement of multitenancy for existing web service implementations using WebSphere s Datapower SOA Appliance.

2 What is the issue? Single instance, multi-tenant application Multi-tenant web services can be built by sharing applications on shared application servers, operating systems and physical servers as shown in figure 1 Tenant 1 App Tenant 2 Tenant 100 App App. Shared Application Server Shared Operating System However, time consuming code changes are necessary for transforming existing web service implementations as shown in figure 2 and 3. Shared Physical Server Figure 1 - Single instance multi-tenancy with shared app servers Figure 2 - Existing single tenant web service WSDL code changes necessary Figure 3 - Adding a tenant ID parameter Multi-tenant web-delivered solutions can be built by sharing a single instance of the application server, database, operating system and physical server amongst multiple client organizations as shown in Figure 1. However, sharing existing web services between multiple tenants requires time consuming and potentially expensive code changes. For example, the single tenant checkcreditscore web service with the WSDL interface shown in Fig 2. would require the addition of a tenantid parameter as shown in Figure 3.

3 What is the solution? Introduce a mediation pattern layer to route service invocations from a tenant's user to a web service endpoint dedicated to that tenant. Multi-tenancy with mediation Tenant1 s users Tenant2 s users. Three alternative ways of implementing the mediation pattern: Mediation pattern layer with routing, authorization and metering functions. 1. WebSphere Business Services Fabric (WBSF) 2. WebSphere Enterprise Services Bus (WESB) Tenant 1 Application Tenant 2 Application 3. WebSphere DataPower Appliances (W-DP) In this demo we ll describe a mediation proxy pattern that routes service invocations from a tenants user to service endpoints dedicated to that tenant. This pattern can be implemented in a number of different ways using IBM middleware. In this demo we will demonstrate the implementation using WebSphere Datapower. To view alternative ways of implementing this capability using WebSphere Business Services Fabric or WebSphere Enterprise Services Bus, click on the links at the end of this demo.

4 A sample scenario Implemented using.. WBSF WESB W-DP Offers Specifies routing rule Sam Peters Jivaro Service Provider Admin Jivaro Multi-tenant Credit Check Service Virtual Portals Mediation Pattern Layer Betty Nord First Bank N.A Admin selects Tenant 1 Routing Business Policies Expo Credit Check Service Bob Nottingham First Bank N.A Customer Firewall Tenant 2 Authorization Transformation Caren Sims Second Canada Bank Admin selects Metering Carrie Serrano Second Canada Bank Customer Monitoring S&R Credit Check Service Our scenario involves a sample multi-tenant banking application called Jivaro which has two tenants: First Bank of NA (First Bank) and Second Canada Bank (Second Bank). The Jivaro service provider administrator, Sam Peters, would like to offer a new credit check web service integrated with two external service providers: Exterian and S&R. He would like enable multi-tenancy without any code changes to his existing single tenant services. Based upon requests from Betty Nord, the First Bank administrator and Caren Sims the Second Canada Bank administrator, he d like to specify a routing rule in the mediation pattern layer. After specifying this rule, Bob Nottingham, a First Bank N.A customer s services request should be routed to the Exterian service provider and Carrie Serrano, a Second Canada Bank customer s request should be routed to S&R service provider. He would also like to build additional functions such as authorization and monitoring.

5 WBSF WESB W-DP Mediation Pattern Layer using WebSphere DataPower Appliance Sam Peters Jivaro Service Provider Admin Configure multitenant web service routing rule Configure authentication & authorization policies Configure monitoring and web service traffic shaping rules We will now show how Sam Peters can use WebSphere Datapower (WDP) to configure rules or policies for web service request routing, authorization and monitoring and web services traffic shaping. IBM Software Group Mediation proxy layer using WebSphere DataPower Web Services invocation from 1 st Bank N.A s virtual Portal Credit check Web Service Proxy Authorization Policies Tivoli Access Manager v6 e.g. allow CreditScoreGroup users for web services. Service Level Monitoring Configurations SOAP/HTTP WebSphere DataPower Graphical Reports WebService Proxy Web Services invocation from 2 nd Canada Bank s s virtual Portal FireWall FrontSide Handler Routing Rules XI tenantid = bank1 tenantid = bank2 FireWall SOAP/HTTP FireWall SOAP/HTTP Expo Credit Services S&R Credit Services

6 We will show how Sam Peters creates a Datapower web service proxy with a front side handler component and routing rules so that web service requests from 1 st Bank N.A and 2 nd Canada Bank s customers are routed to the Expo and S&R credit check service endpoints respectively. We will also show how he integrates Tivoli Access Manager to configure access control policies and how he configures service level monitoring and web service traffic shaping rules in DataPower. This is done through simple point and click steps. <Live> Here we show how Sam Peters uses the Datapower Web console to configure the credit check service web service proxy. He creates a front side handler component for this proxy to accept SOAP requests and a routing policy for selecting the correct endpoint for a tenant. He builds a routing map for configuring this policy. The routing map includes a routing rule which applies an XPATH expression to extract a Tenant ID parameter from the web service context. Based on the TenantID value, this SOAP request is forwarded to the web service endpoint dedicated to the appropriate credit score service provider. For example, here we can see that requests with tenant ID=bank1 are forwarded to the endpoint with port 9332 and those with tenant ID=bank1 are forwarded to the port In addition to the routing policy, he also configures an Authentication, Authorization and Audit (in short triple A) policy for this web service proxy. For authentication, the triple A policy accepts the Lightweight Third Party Authentication (LTPA) tokens issued by the web services client (WebSphere Portal in this case). For authorization, he delegates all decisions to Tivoli Access Manager. He specifies that the resource name be extracted from the URL of the service requested. We also map the extracted resource name to an element of the same name defined in the Tivoli Access Manager (TAM) Protected Object Space with the prefix web-services. If the authentication and authorization rules return a deny result, the triple A policy rejects the service request. Here we show Sam configures authorization policies for the proxy web service in Tivoli Access Manager. This is the Protected Object Space element with the prefix web service. Here we can see the Access Control List (ACL) for the CreditScoreService. Here we can see, that the ACL specifies that only users in the group CreditScoreUsers can access this web service. Next Sam Peters creates a service level monitoring configuration in the Datapower web console.

7 He specifies a limit of 60 service requests in 10 seconds to prevent denial of service attacks. Finally, in this graphical report, he monitors how this service is performing. <Live Portal> Next we show the result of this configuration. Bob Nottingham, a First Bank Customer logs into the bank s virtual portal. From the Credit Check Services portlet, he checks his credit score and finds that it is provided by Expo Credit Check Services. However, when Carrie Serrano, a Second Bank customer uses the Credit Check portlet to check her credit score, the score is provided by S&R s credit check services. This is achieved by a mediation proxy layer implemented with WebSphere Datapower which routes the customer requests to the two different service providers for each tenant bank. IBM Software Group Advantages of the techniques WebSphere Business Services Fabric Rapid provisioning to various tenants through different channels. WebSphere Enterprise Service Bus Advanced protocol transformation and routing capabilities. WebSphere DataPower Appliance Hardware accelerators for better performance. Application of business policies to address the changing business needs. Out of the box performance and invocation summary. Built in governance manager to control the SOA lifecycle of business services Seamless integration with Tivoli Access Manager and WebSphere Services Registry and Repository. Best suited for hub & spoke or broker type of integration architectures. Adapter support for connecting to disparate systems. Enhanced web services and XML security. Support for leading industry standards. Seamless integration with Tivoli Access Manager and WSRR. Advanced protocol transformation capabilities. In addition to what we showed in this demo, there are additional advantages to using Datapower. Datapower offers hardware accelerators for better performance, support for industry standards, and enhanced web services and XML security. In addition, Datapower provides seemless integration with Tivoli Access Manager and WebSphere Services Registry and Repository. Datapower also provides advanced protocol transformation capabilities.

8 Conclusion IBM Software Group Existing web services implementations can be rapidly enabled for multi-tenancy using a mediation proxy pattern. Implementing the mediation proxy pattern using WebSphere DataPower Appliances: Provides hardware routing for speed Provides security functions In conclusion, we have shown how to rapidly enable multi-tenancy for existing web service implementations by using a mediation pattern. We demonstrated this capability using IBM s Datapower which offers wire speed routing and security functions. This mediation pattern could have been implemented using either WebSphere Business Services Fabric or WebSphere Enterprise Service Bus.

9 Ready to Go Further With IBM? Learn more. Deploy faster. Market your SaaS Solution Join the SaaS Community Register for PartnerWorld Select Software as a Service as an interest area Network with other SaaS business partners at SaaSpace.com Visit the Virtual Innovation Center (VIC) Take the SaaS Education Courses Fill out the VIC Project Profile for a no-charge technical assessment and custom enablement road-map Qualify for the SaaS Specialty Receive additional marketing resources and benefits IBM has innovative resources and programs to help you manage change & become relevant in the Software as a Service market. Whether you re an ISV, System Integrator or Reseller, we can provide education, support and benefits to help you grow revenue and differentiate yourself. The first step will be to join the SaaS community. You will automatically be kept aware of new SaaS technical benefits and workshops and get the enablement help that you need to transform your application for delivery in the IBM Software as a Service model. Then, as a member of IBM SaaS community, you can register at the Virtual Innovation Center (VIC) where you will get personalized access to product support and education to help build your Software as a Service knowledge and skills. As an Advanced level member of PartnerWorld, you have the opportunity to gain access to additional marketing and sales support by qualifying for the Software as a Service (SaaS) specialty. For more information, Visit our main site at