Chapter 9 Web Services

Size: px

Start display at page:

Download "Chapter 9 Web Services"

Kristin Daniel
5 years ago
Views:

1 CSF661 Distributed Systems 分散式系統 Chapter 9 Web Services 吳俊興國立高雄大學資訊工程學系

2 Chapter 9 Web Services 9.1 Introduction 9.2 Web services 9.3 Service descriptions and IDL for web services 9.4 A directory service for use with web services 9.5 XML security 9.6 Coordination of web services 9.7 Applications of web services 9.8 Summary 2

3 9.1 Introduction Web service: provides a service interface enabling clients to interact with servers in a more general way than web browsers do to use an HTTP request to cause the execution of a program by means of requests and replies formatted in XML and usually transmitted over HTTP identified by URI and accessed in a more ad hoc manner generally provides a service description, which includes an interface definition and other information, such as the server s URL Uniform Resource Identifier (URI): a general resource identifier, whose values may be either a URL or a URN URL: location information, such as server s domain name URN: location independent, relying on a lookup service to map them onto the URLs of resources 3

4 Figure 9.1 Web services infrastructure and components Applications Directory service Security Choreography Web Services Service descriptions (in WSDL) SOAP URIs (URLs or URNs) XML HTTP, SMTP or other transport Transmitted by SOAP (Simple Object Access Protocol) or REST SOAP: using XML to package messages REST (representational state transfer): using URLs and HTTP operations; clients are supplied the entire state of a resource Described by WSDL (Web Services Description Language) Discovered by UDDI (Universal Description, Discovery and Integration) 4

5 9.2 Web services Web service interface generally consists of a collection of operations that can be used by a client over the Internet Key characteristic of most web services It can process XML-formatted SOAP messages Each web service uses its own service description to deal with the service-specific characteristics of the messages it receives Functionalities Allow clients to manipulate their web resources Examples: Amazon, Yahoo, Google, ebay Enables third-party applications to build value-added services over them Combination of web services Allows its operations to be combined with those of other services to provide new functionality Communication patterns synchronous request-reply asynchronous messages event-style pattern 5

6 Figure 9.2 The travel agent service combines other web services flight booking flight booking Client Travel Agent Service hire car booking hotel booking hotel booking hire car booking synchronous v.s. asynchronous messages 6

7 Web services invocation No particular programming model independent of any particular programming paradigm usually consisting of a single remote object Representation of messages Both SOAP and data are represented in XML, a textual format Take up more space than binary ones <- SOAP compression Require more time to process Tradeoffs between interoperability and performance Service references: can be referred by URL or URN URL: containing the domain name (fixed) URN: can change from time to time its current URL can be obtained from a URN lookup service Services may run continuously or it may be activated on demand Example: Parts Depot, Inc has deployed some web services to enable its customers to: get a list of parts get detailed information about a particular part submit a Purchase Order (PO) 7

8 Implementing the Web Services using SOAP envelope SOAP Request (XML doc) HTTP POST URL 1 getpartslist() Response (XML doc) HTTP Response Request (XML doc) Response (XML doc) PO (XML doc) HTTP POST HTTP POST URL 1 HTTP Response URL 1 Web Server SOAP Server getpart(id) submit(po) Response (XML doc) HTTP Response Note the use of the same URL (URL 1) for all transactions. The SOAP Server parses the SOAP message to determine which method to invoke. All SOAP messages are sent using an HTTP POST. 8

9 REST way of Implementing the Web Services HTTP GET request URL 1 Response (HTML/XML doc) HTTP response Parts List HTTP GET request URL 2 Response (HTML/XML doc) HTTP response Web Server Part PO HTTP POST URL 3 (HTML/XML) URL to submitted PO HTTP response PO REST (representational state transfer) Clients are supplied the entire state of a resource instead of calling an operation to provide some part of it 9

10 9.2.1 SOAP Simple Object Access Protocol (SOAP) Designed to enable both client-server and asynchronous interaction over the Internet using XML to represent the contents of request and reply messages originally based only on HTTP, currently supporting a variety of transport protocols including SMTP, TCP or UDP An extension of XML-RPC specifying how XML is to be used to represent the contents of messages how a pair of single messages can be combined to produce a request reply pattern the rules as to how the recipients of messages should process the XML elements that they contain how HTTP and SMTP should be used to communicate SOAP messages Implementation SOAP APIs have been implemented in many programming languages, including Java, Javascript, Perl, Python,.NET, C, C++, C# and VB use HTTP POST method to support client-server communication 10

11 Figure 9.3 SOAP message in an envelope envelope header header element header element body body element body element A SOAP message is carried in an envelope, consisting an optional header and a body XML elements envelope, header and body, together with others of SOAP messages are defined as a schema in the SOAP XML namespace 11

12 A SOAP Example A GetStockPrice request is sent to a server The request has a StockName parameter, and a Price parameter will be returned in the response The namespace for the function is defined in " stock" address POST /InStock HTTP/1.1 Host: Content-Type: application/soap+xml; charset=utf-8 Content-Length: nnn <?xml version="1.0"?> <soap:envelope xmlns:soap=" soap:encodingstyle=" <soap:body xmlns:m=" <m:getstockprice> <m:stockname>ibm</m:stockname> </m:getstockprice> </soap:body></soap:envelope> HTTP/ OK Content-Type: application/soap+xml; charset=utf-8 Content-Length: nnn <?xml version="1.0"?> <soap:envelope xmlns:soap=" soap:encodingstyle=" <soap:body xmlns:m=" <m:getstockpriceresponse> <m:price>34.5</m:price> </m:getstockpriceresponse> </soap:body></soap:envelope> 12

13 Figure 9.4 SOAP example of a simple request without headers env:envelope env:body xmlns:env =namespace URI for SOAP envelopes m:exchange xmlns:m = namespace URI of the service description m:arg1 m:arg2 Hello World Figure 9.5 Example of a reply to the request in Figure 9.4 env:envelope xmlns:env = namespace URI for SOAP envelope env:body m:exchangeresponse xmlns:m = namespace URI for the service description m:res1 m:res2 World Hello 13

14 Figure 9.6 HTTP POST request in SOAP clientserver communication POST /examples/stringer endpoint address Host: Content-Type: application/soap+xml Action: action HTTP header <env:envelope xmlns:env= namespace URI for SOAP envelope> <env:header> </env:header> <env:body> </env:body> </env:envelope> Soap message The HTTP headers specify the endpoint address (URI of the ultimate receiver) and the action to be carried out The Action parameter is intended to optimize dispatching by revealing the name of operation without the need to analyze the SOAP message in the message body The HTTP body carries the SOAP message HTTP GET method instead of POST can be used if it s just a request for information, has no arguments, and does not alter data 14

15 9.3 Service descriptions and IDL for web services Service description: to describe and locate service specifies how the message are to be communicated and i.e. SOAP over HTTP the URI of the service used to generate client stubs WSDL (Web Services Description Language) 2.0 Defines an XML schema for representing the components of a service description, which include, for example, the element names definitions, types, message, interface, bindings and services Two parts: abstract: types, message and interface (port) concrete: bindings and services 15

16 WSDL Structure definitions types message interface bindings services target namespace document style request-reply style how where abstract concrete Figure 9.10 The main elements in a WSDL description <definition namespace = http/ > <type> xml schema types </type> <message> </message> <port> a set of operations (interface) </port> <binding> communication protocols </binding> <service> a list of binding and ports </service> <definition> 16

17 WSDL: Abstract Part Type: types of the values used in message declaration i.e. Types int and and GraphicalObject XML Schema Message: the set of messages exchanged defines the data elements of an operation, compared to the parameters of a function call Figure 9.11 Interface (PortType, Port): collection of operations specifies message exchange pattern between client and server Figure 9.12 <message name="getlasttradepriceinput"> <part name="body" element="tradepricerequest"/> </message> <message name="getlasttradepriceoutput"> <part name="body" element="tradeprice"/> </message> 17

18 Figure 9.11 WSDL request and reply messages for the newshape operation message name = " ShapeList_newShape" part name ="GraphicalObject_1" type= "ns:graphicalobject " message name = " ShapeList_newShapeResponse" part name= " result " type= "xsd:int" tns - target namespace xsd - XML schema definitions Figure 9.13 WSDL operation newshape operation name = " newshape" pattern = In-Out input message = "tns:shapelist_newshape" output message = tns:shapelist_newshaperesponse" tns target namespace xsd XML schema definitions The names operation, pattern, input and output are defined in XML schema for WSDL 18

19 Figure 9.12 Message exchange patterns for WSDL operations Name In-Out In-Only Robust In-Only Out-In Out-Only Robust Out-Only Messages sent by Client Server Delivery Fault message Request Reply may replace Reply Request no fault message Request guaranteed may be sent Reply Request may replace Reply Request no fault message Request guaranteed may send fault 19

20 WSDL: Concrete Part Bindings: choice of protocols which message formats and form of external data representation are to be used i.e. SOAP, HTTP and MIME Figure 9.14; optional attributes message exchange pattern: either rpc (request-reply) or document exchange XML schema for the message formats. The default is SOAP envelope XML schema for the external data representation. The default is the SOAP encoding of XML Services: choice of endpoint or server address specifies the name of the service and one or more endpoints (or ports) where an instance of the service may be contacted uses a soap:address element to specify the URI of the service location 20

21 Figure 9.14 SOAP binding and service definitions binding name = ShapeListBinding type = tns:shapelist soap:binding transport = URI for schemas for soap/http style= rpc operation name= newshape input soap:body encoding, namespace service name = MyShapeListService endpoint name = " ShapeListPort " binding = " tns:shapelistbinding " soap:address location = service URI output soap:body encoding, namespace the service URI is: soap:operation soapaction 21

22 9.4 A directory service for use with web services Universal Description Discovery and Integration (UDDI) provides both a name service and a directory service looked up by name (a white page service) looked up by attribute (a yellow page service): to look up a particular category of service provides an API for looking up services based on two set of query operations get_xxx set of operations: retrieve an entity corresponding to a given key find_xxx set of operations: retrieve the set of entities that matches a particular set of search criteria publication: the first time a data structure is published at a UDDI server, it is given a key in the form of a URI and that server becomes its owner i.e. uddi:cdk4.net:213 22

23 Figure 9.15 The main UDDI data structures businessentity businessservices human readable businessservices information businessservices about the publisher bindingtemplate human readable bindingtemplate information URL about a bindingtemplate family of services information about the URL service interfaces key URL key key tmodel tmodel tmodel service descriptions Four structures (three accessed by keys and the other by URL) businessentity: describes the organization businessservices: information about a set of instances of a web service bindingtemplate: holds the address of a web service instance and references to service descriptions tmodel: holds service descriptions, usually WSDL documents 23

24 9.5 XML security XML security consists of a set of related W3C designs for signing, key management and encryption WS-Security: another approach to security that is particularly concerned with applying message integrity, message confidentiality and single message authentication to SOAP TLS (SSL): used to create a secure channel for the communication of information 24

25 Requirements of XML security Basic requirements To be able to encrypt either an entire document or just some selected parts of it To be able to sign either an entire document or just some selected parts of it Additional basic requirements To add to a document that is already signed and to sign the result To authorize different users to view different parts of a document To add to a document that already contains encrypted sections and to encrypt part of the new version, possibly including some of the already encrypted sections 25

26 Figure 9.16 Algorithms required for XML signature Type of algorithm Name of algorithm Required reference Message digest SHA-1 Required Section Encoding base64 Required [Freed and Borenstein 1996] Signature DSA with SHA-1 Required [NIST 1994] (asymmetric) RSA with SHA-1 Recommended Section MAC signature (symmetric) HMAC-SHA-1 Required Section and Krawczyk et al. [1997] Canonicalization Canonical XML Required Page 810

27 Figure 9.17 Algorithms required for encryption (in Figure 9.16 are also required) Type of algorithm Name of algorithm Required reference Block cipher TRIPLEDES, AES 128 AES-256 AES-192 required Section optional Encoding base64 required [Freed and Borenstein 1996] Key transport RSA-v1.5, RSA-OAEP required Section [Kaliski and Staddon 1998] Symmetric key TRIPLEDES wrap (signature KeyWrap, by shared key) AES-128 KeyWrap, AES 256KeyWrap AES-192 KeyWrap required [Housley 2002] optional Key agreement Diffie-Hellman optional [Rescorla, 1999]

28 Figure 9.18 Travel agent scenario 1. The client asks the travel agent service for information about a set of services; for example, flights, car hire and hotel bookings. 2. The travel agent service collects prices and availability information and sends it to the client, which chooses one of the following on behalf of the user: (a) refine the query, possibly involving more providers to get more information, then repeat step 2; (b) make reservations; (c) quit. 3. The client requests a reservation and the travel agent service checks availability. 4. Either all are available; or for services that are not available; either alternatives are offered to the client who goes back to step 3; or the client goes back to step Take deposit. 6. Give the client a reservation number as a confirmation. 7. During the period until the final payment, the client may modify or cancel reservations

29 Figure 9.19 A selection of Amazon Web Services

Web-Based Systems. INF 5040 autumn lecturer: Roman Vitenberg

Web-Based Systems. INF 5040 autumn lecturer: Roman Vitenberg Web-Based Systems INF 5040 autumn 2013 lecturer: Roman Vitenberg INF5040, Roman Vitenberg 1 Two main flavors Ø Browser-server WWW application Geared towards human interaction Not suitable for automation