Tasting SOAP. Early project experiences with Web Services. Web Services World - Japan July 24th 2001

Transcription

1 The Japan 2001 conference Tasting SOAP Early project experiences with World - Japan July 24th 2001 Anton (Tony) Fricko, IBM Hursley, UK anton_fricko@uk.ibm.com Objectives The Japan 2001 conference Provide insight and practical hints on current state of implementations Share project experience by: explaining significant efforts in Europe and the US step-by-step walk through of one project explain benefits and pitfalls Not a beginners session! You should already have some basic knowledge of 1

2 The Japan 2001 conference Objectives Elevate the discussion and understanding on to new levels, focusing on: need for standardising tmodels dynamic WS require intelligent invoker issues and solutions for context propagation Agenda The Japan 2001 conference The project space The jstart Team The IBM Toolkit The project Storebrand ASA, Norway Summary of project experience 2

3 The Japan 2001 conference IBM Project environment The jstart Team A Worldwide Mission The Japan 2001 conference Promote the rapid adoption of the emerging e-business technology worldwide Deliver high quality business critical solutions through the use of new technologies Insure customer success through partnership Provide a platform for customer visibility 3

4 Dynamic Dynamic e-business e-business product product rollout rollout The Japan 2001 conference IBM IBM alphaworks alphaworks The Japan 2001 conference Hundreds of tools for, XML, Java early versions of features that may be in products some are solid production-code (XML4J, LotusXSL) some are experimental, prototypes free download and use Toolkit and demos XML and Dev Environment WSDL Toolkit on ibm.com/alphaworks A set of tools that allow developers to generate client and server code from a WSDL document 4

5 The Japan 2001 conference Storebrand ASA B2B project in Oslo, Norway Who is Storebrand? The Japan 2001 conference Norway's largest financial corporation Storebrand Bank, an award-winning Internet bank Storebrand Funds Storebrand Life Insurance, produces life products company-customers 500 of the customers with more than 100 employees covering employees in total Are dependent on current data from the employers about the employees 5

6 The business challenges The Japan 2001 conference Storebrand manages the pension funds of around 6500 companies in Norway To maintain the accuracy of the claims, personnel data needs to be send from the participating companies to Storebrand on a regular basis Customers demand online functionality Want to sell their life products through external distributors over Internet Technology overview The Japan 2001 conference client Servlets B4 Facade (EJB) Business objects Gateway Payroll systems MQSeries sphere Business Partners Add Change Remove Mainframe 6

7 jstart project objectives The Japan 2001 conference Proof of technology for: create for Storebrand side (Servlet) Implement infrastructure Sphere 3.5 Security Enable Vendor Payroll System(s) for Connect 5 existing Business Partners Deliver Whitepaper for partner connection Time to get connected to the system: < 1 day The Whiteboard The Japan 2001 conference 7

8 Storebrand B2B Phase 1 The Japan 2001 conference Payroll vendor will extract necessary data The data will be converted into a industrystandard XML-format, XMLife from Acord A COM-component provided by the vendor will generate a SOAP-request A Service at Storebrand will receive the data and pass it on to MQSeries Integrator Consideration for XML Schema The Japan 2001 conference XML schema developed a generic solution for all partners Don t want a schema specific for a single vendor Don t want to invent own standard: Look at Industry Standard for Insurance Business: ACORD Choose XMLife as an acknowledged, suitable XML schema for a common adoption Need however specific Storebrand extensions! Desirable: industry specific tmodel! 8

9 UDDI Object Relationships The Japan 2001 conference businessentity businessentity businessentity businessservice bindingtemplate InstanceDetails categorybag keyedreference Service Service Rosetta-Net BASDA Simple.Buy Schemas, Interchange specification tmodels SIC CODE NAICS identifierbag keyedreference DUNS Numbers Thomas Registry ID The Japan 2001 conference Domain specifics The IT industry can provide technology Businesses must populate registries with meaningful: taxonomy business semantics business transactions contractual regulations (e.g. tpaml) Role for: industry leaders and standard organizations (e.g. Origo, ACORD, POSC, BDI, DTI,..) 9

10 The Japan 2001 conference Need for tmodels Dynamics: are introduced through choice! need context rich target environment Must come from domain specific business transactions Obtain additional information via WSDL reference from the tmodel Requires intelligent invoker! Conceptual data flow The Japan 2001 conference Payroll system COM Send data as XMLife Transform XML Sends it to backend MQSI Domino service sphere Send XML to right queue 10

11 Planned deliveries The Japan 2001 conference 1/ Build the service as a bean 2/ Register the service with the SOAP router 3/ Define a service using WSDL 4/ Register the service with UDDI 5/ Call the service from a client using SOAP over HTTP either 5.1/ Directly using the basic SOAP interface ignoring the UDDI registration 5.2/ By looking up the service in UDDI and binding to it through WSDL Test Environment The Japan 2001 conference Secure connection Client JAVA Domino Server NO security Can t use sniffer over secure connection! Server - HTTP RPC Router Sphere Service DB

12 Basic design choices/ steps The Japan 2001 conference 1) just SOAP P-P, single client technology 2) SOAP + WSDL definition just WSDL - can configure, but not full repository lookup 3) SOAP + WSDL + UDDI service description in registry Step 1 building the SOAP connection The Japan 2001 conference 1) Define and build the service and its interfaces build Java classes, C++, VB, COM component 2) Register the service with the SOAP router (deploy) 1) Can be entered via form at the Apache SOAP administrator GUI 2a) manually create a deployment descriptor and send it to the SOAP router by: 2b) invoking program from Apache to deploy - i.e. a bat file 3) develop your own program/script to perform deployment steps automatically 12

13 Step Step 1 1 building the SOAP connection The Japan 2001 conference 3) Write a client to exercise the service: At a minimum: Build a Java program to make a Apache SOAP API call This will: create the SOAP envelope send HTTP request rpc router picks up the deployment descriptor for the requested services creates a Java object and pass parameter into the correct method which should create a response: either a response object or shows fault (or other expected) result Step 1 The Japan 2001 conference 1 2 Define the service and its interfaces Client HTTP To define a Service 1) Create a deployment descriptor file (or use form for definition) 2) Invoke Apache utility to deploy to RPC router 3 Descriptor 3 Server - HTTP HTTP Listener RPC Router Sphere 2 Deploy Execute the client from a JVM - invoke SOAP APIs 1 Service Now the service is known by the port of the RPC Router - I.e the URL of the SOAP listener e.g. 13

14 Step 2 The Japan 2001 conference creating the WSDL For existing bean: use Service Wizard from WSDE to build a WSDL Deploy WSDL to the server: so that it can be located via an URL server needs to support mime type for XML Can now use WSDL to configure client Still a level of manual interaction required to provide access to WSDL Benefit of WSDL: can read it into other technologies, I.e. MS toolkit (but MS toolkit cannot use the IBM / Apache WSDL today) W3C standardisation on WSDL (but implementation is currently different) Step 2 The Japan 2001 conference 2 1 Use Wizard from WSDE to create: 1) WSDL file 2) client proxy Client Make WSDL file external available: I.e. URL through server HTTP 2 Server - HTTP WSDL RPC Router Sphere Client can now request the WSDL data and construct invocation from provided information I.e the URL of the WSDL object e.g. 1 Service ---or use the provided proxy!??? 14

15 The Japan 2001 conference A peek at the client side How the client accesses a Service: 1) Very comfortable: using a PROXY (I.e. no changes for the app) 2) With light assistance: using Toolkit APIs Step 2 3) Cumbersome: code the SOAP requests directly (e.g over HTTP today) Consequence: the more you code directly into your client application, the less flexibility you have on choosing aspects of the service dynamically. Client side comfort options The Japan 2001 conference Client Proxy Toolkit API Native transport WSDL invocation describes Service Proxy shields from: Transport Language Encoding Proxy: - no changes to client required Toolkit: some ease for SOAP API calls Native: construct SOAP messages yourself 15

16 The Japan 2001 conference Service Discovery (binding) 1) Dynamic - at runtime 2) At startup of services (deployment time) 3) Static services found and bound to at development time Tools browse/search UDDI registry is a services directory Contains service definitions Programatically searchable Decisions for dynamic binding EAI specific The Japan 2001 conference Zone Availability of client e.g. is binding model in classpath? WSEL transactional, secure, audited, fast, Availability of server is it up? 16

17 Zones The Japan 2001 conference inside as well as outside the enterprise Internet Vetted Business Partners Closed Business Community Intranet WAN Intranet LAN Server Farm The Japan 2001 conference Requester Requester App Consequence for Service Requester (Client) Need to insert decision logic Need to insert decision logic Service Requester RT SOAP to Service Proxy WSDL SOAP to Service UDDI registry XRR Intelligent invoker How intelligent should this invoker be? 17

18 The Japan 2001 conference Step 3 connecting to the UDDI registry GOAL: be able to obtain WSDL from UDDI 1) Use e.g. UDDI browser to register business (service provider) with UDDI 2) Register services (e.g. through UDDI4J) 3) from client: need to issue a FIND Very specific: Category # Get WSDL file (first instance) from list Queries could be: Give me all services of this company Once the service description is obtained: Can invoke service like described in Step 2 Step 3 The Japan 2001 conference 2 1 Register at UDDI: 1) business 2) services Client HTTP Client issues a FIND against UDDI Gets a list of services returned Picks a service from the list and constructs SOAP call 2 List of services returned from UDDI UDDI Server - HTTP WSDL RPC Router 1 UDDI registry Sphere Service Client can query registry and construct service invocation dynamically 18

19 Scenario: Member maintenance The Japan 2001 conference Java HTPP Server SOAP IBM Sphere Server Version 3.5 on Windows NT (developmt) - IBM 390 (production) Domino server DMZ On each member change create XML file Payroll - Delphi on Windows NT Soap / ROPE Pass on via MQ Series and MQSI B4 Database Register of last update Now over to the client side We still need to solve this: The Japan 2001 conference Security How to access the XML file How to address / FIND the Service Connecting MS COM with Sphere JAVA over SOAP 19

20 Security The Japan 2001 conference Remember: we deal with salary and personnel data - this has to be protected well! Today security via Smartcards: SSL client side certificate based authentication Goal: same level of security for It was not obvious how to achieve this! Not enough standards yet Security: options The Japan 2001 conference Digital Signatures EJBs Application level SOAP (API) level SSL HTTP Basic low level transport 20

21 Client side API selection The Japan 2001 conference 2 options for Interface APIs again. What has not been used.. 1) SOAP level APIs using MS SOAP Toolkit V2 B1 this beta does not support security reliably (too many bugs) it is also not supported for production status of March 2001 Client side API selection What Storebrand has implemented The Japan 2001 conference 2) low level API: WININET APIs from INET access (as explorer) gives for HTTPS well known interfaces We needed to prove during the project the same level of security as the WEB solution with Smartcards use of client side certificate authentication distribution method of certificate has not been determined yet SSL Consequence of using the WININET APIs: need to construct SOAP envelop cumbersome to get the messages right 21

22 Context propagation The Japan 2001 conference.soap does not offer a standard mechanism to pass additional information to a service beyond the parameter description.need for adding data like session ids, admin or security data.apache has implemented a pluggable provider facility that can be used as a temporary remedy.latest version of Apache SOAP (AXIS Apache Extensible Interaction System) provides an pluggable (handler) framework for pre- and postprocessing Use of LDAP information Apache - pluggable provider The Japan 2001 conference Payroll Appl Client SOAP LDAP Domino server RPC Router PP Service Server - HTTP Sphere JAVA Security card Storebrand Storebrand has has session session verification verification logic logic in in DMZ DMZ Need Need to to pass pass on on data data from from DMZ DMZ server server to to Service Service for for further further authentication 22

23 in a App Server The Japan 2001 conference SOAP (XP) Servlet JMS MSG Beans ORB Java Class EJB EJB Wrapper EJB Wrapper JavaBean Servlet Workflow Message Queue/Broker J2C JNI Skeletons (PP) Proxy Bean SOAP (XP) AXIS: Apache SOAP V3 The Japan 2001 conference Request Transport listener Handler framework Handler PP Target Service Request/response, registry-based engine concept based on mustunderstand flag in SOAP Header 23

24 Accessing the XML file The Japan 2001 conference options 1: Could have done all in JAVA Payroll app creates XML file, which can be directly used by Java app options 2: Wrapping XML file as COM Object: seamless integration with payroll app Decision for option 2: don t want file with sensitive information (salaries) Accessing the XML file The Japan 2001 conference XML File Payroll appl Payroll appl * COM XML Java App SOAP Option: Java client SOAP over HTTPS Implementation at Storebrand SOAP SOAP over HTTPS Options file in lieu of WSDL * 2 Interfaces supported: XML as string XML DOM 24

25 To WSDL or not? The Japan 2001 conference Storebrand did not use a WSDL - Why? This is what actually got implemented: get services information from property file contains location info PLUS config parameters for COM environment, e.g. max msg size, etc. No benefit of using WSDL in current scenario Interoperability The Japan 2001 conference No standard test suite available Check discussion at: http: // groups.yahoo.com/group/soapbuilders Who should do this? Apache / IBM vs MS SOAP support fixed in Toolkit V2.2 WSDL 1.0 support problematic SDL - NASSL heritage document structure different from MS / IBM can be fixed, by manual editing W3C acknowledged standard submission of WSDL 1.1 on March 6th! Best Practices document from UDDI.ORG 25

26 Reliable Message Delivery The Japan 2001 conference QoS - Quality of Service Not there - at least in the specs Need to be solved either on application level transport level Today: XML over HTTP (HTTPS) Message Ids provided by application will guarantee that a message is delivered, and only delivered once data integrity guaranteed through SSL encryption WSEL on the horizon as a remedy!! Key Technologies/Products Used The Japan 2001 conference Server Side Sphere Visual Age for Java 3.5 IBM XML Parser IBM DB2 UDB PE v7.1 IBM WSTK 2.1 IBM WSDE Client side MS SOAP Toolkit V2 Beta 1 Visual Basic 6 XMLSPY editor 26

27 Server side - overview The Japan 2001 conference Client HTTP List of services returned from UDDI UDDI HTTP Listener Server - HTTP RPC Router Sphere Pluggable provider Service XRR XML registry/repository WSDL UDDI registry Impact on business The Japan 2001 conference Interest from Payroll vendors Flocking for experience about how to enable their applications for Interest from Business Partners Want to broaden the use of for xautomating B2B Interest from other insurance companies Establish standards (tmodels) for industry use 27

28 Review of achievements The Japan 2001 conference Created standard to deliver Life insurance data in Norway for STBs partners based on XMLife of ACORD Standards based B2B - secure over Internet! using SOAP and HTTPS/SSL Integrate vendor application(s) via XML file wrapped as COM object Connect COM and Java Sphere environment via SOAP combined 2 worlds All this in less than 1 month! Review of achievements Sphere JAVA The Japan 2001 conference Payroll appl COM XML Windows NT SOAP SOAP over HTTPS RPC Router Server - HTTP Service Standards based, secure B2B over Internet COM to JAVA 28

29 Espen Storebrand ASA The Team Simon IBM Hursley ET The Japan 2001 conference More jstart projects The Japan 2001 conference WAND, Denver, - UDDI registrar Interpro Global Partners, Chicago TransactTools, New York Visualize Inc, Phoenix IMI, Sweden, NL, US, Australia all stories on: 29

30 The Japan 2001 conference Summary of experience How does this first bite of SOAP taste? The Japan 2001 conference Summary SOAP/Apache + IBM toolkit Great starting point,by far the most functional, open toolkit (MS Windows, Linux) Security very limited for now need workarounds for now expect standards in XMLP, later XKMS, SAML Reliable Messaging (QoS) not there yet needs individual implementation Transport layer: e.g. MQ Series Appl layer: roll your own Expect (some?) standards with WSEL Compatibility: SOAP: getting there WSDL: need to wait for W3C? 30

31 Summary The Japan 2001 conference technology ready for exploratory projects Real products around the corner Get ready for wide spread adoption Simple technology, but Dramatic Business impact Questions? The Japan 2001 conference ibm.com/developerworks/webservices Zone on developerworks - resources for customers and developers on the use of XML ibm.com/alphaworks site for free emerging tools and technologies from IBM oss.software.ibm.com UDDI4J open source Java class library for UDDI access xml.apache.org Apache SOAP and other open source XML tools uddi.org UDDI consortium - information and resources xml.org XML standard vocabularies repository xmethods.com& xmltoday.com news on SOAP services ebxml.org electronic business in XML initiative ibm.com/developerworks/speakers IBM speakers corner with presentations The entire collection of papers from last W3C mtg on 31