Implementing Enterprise API Management In the Oracle Cloud

Transcription

1 Luis Weir soa4u.co.uk/ Implementing Enterprise API Management In the Oracle Cloud Oracle OpenWorld San Francisco September 18-22, 2016

2 Table of Contents Introduction Context A step back redefining types of integrations The missing pieces: An Enterprise API Taxonomy API Management Capability Model Mapping Oracle Cloud PaaS to APIM Capabilities Use cases Wrap-up 2

3 Introduction

4 Resume Luis Weir Oracle Ace Director Cloud Principal at Capgemini UK I am an Oracle Ace Director, Cloud Principal and a Thought Leader specialised in Oracle Fusion Middleware & Oracle PaaS. With more than 15 years of experience implementing IT solutions across the globe, I have been exposed to a wide wide variety of business problems many of which I ve helped solved by adopting SOA architectural styles such as traditional SOA, API management and now Microservices. My current focus is in assisting organisations define and implement solutions and strategies that can help them realise the benefits that such technologies have to offer. I am very passionate about technology. I have be the lead authored of two books (Oracle SOA Governance 11g Implementation and Oracle API Management 12c Implementation), I am a regular blogger and speaker in major conferences and events. A well-known industry expert especially when it comes to Oracle middleware technologies I am also an OTN certified SOA black belt. Latest Media: 2nd Place OTN Cloud Hackathon June, st Cloud Contribution Award SOA Community March, 2016 Oracle Magazine May/June 2016 ( Systematic Approach for Migrating to Oracle Cloud SaaS ( Oracle Magazine Jan/Feb 2016 ( API Management Implementation ( A Word About Microservices and SOA ( 4

5 Context A summary of key business challenges driving the need for API management

6 The Digital dilemma 6

7 Bi-modal IT, is it really? Systems of Innovation Non-linear Mode (Agile, DevOps, automation, fast) Promised in 8 weeks What about access to core data and business functionality? Waiting for access Ready in 8 Months Bi-modal? Systems of Differentiator Waiting for changes +8 Weeks Standard interface delivered Systems of Record Traditional Mode (Reliable, delivered in waterfall, IT centric, V-model, slow) Environment created, system changed, functionality added, access granted, Promised in 4 Months 7

8 A bi-modal analogy The fast IT organisation can only be as fast as it is possible to deliver access to systems of records Thus bi-modal IT it s contraint to the speed it takes to deliver such access. 8

9 Rush to the Cloud = accidental cloud architecture (cloud spaghetti!) Mobility & IoT Solutions Cloud Oracle Cloud SaaS {json} Other SaaS {json} Social Media {json} {json} {json} {json} Firewall <xml> <xml> <xml> FIN SCM HUBs LEGACY 9

10 Breaking the chains 10

11 API-led connectivity Cloud Oracle Cloud SaaS Other SaaS Social Media Mobility & IoT Solutions Firewall Cloud APIs On-Premise APIs Hybrid API Platform ERP CRM HCM LEGACY 11

12 API growth is exponential Growth In Web APIs Since Programmable Web API growth in the enterprise exponential API accelerated growth will continue: Partner integration APIs B2C APIs Enterprise mobility APIs IoT APIs API Count Fastest Growing Web API Categories (6 months) Science, 31 Social, 28 Programmable Web Financial, Mapping, 35 Government, 38 Enterprise, 66 Advertising, 43 Backend, 52 Month Messaging, 43 12

13 What is an [Web] API? Application Programming Interfaces (APIs) are not new. But they have taken on a new shape. REST (or Web) APIs are doors that give access to information and functionality in real time. And just like doors: They have locks. Only key holders can open them There are different types for different needs (size, color, locks, purpose, etc.) They can be outside facing (anyone can see them i.e. internet) or internal facing (i.e. only accessible within an area/zone) They are available only in specific locations API endpoints They can be as secured and closely monitored as required (typically depending on their purpose and information being accessed) The have an impact on people (customers and employees) experience. Based on their performance experience can be good or bad. If bad people will remember! 13

14 API Management Planning Retirement Maintenance Design API Consumption Implementation Publication Operation 14

15 Drivers for API Management Quicker, standard and secure access to information and functionality Discovery and reuse of APIs 3 rd generation API platform with global deployment capabilities (cloud or on-prem) Richer user experience by delivering tailored-fit APIs Robust operations, analytics and insights Enable a digital strategy by unlocking access to electronic business assets API as a new source of revenue. Information is a valuable asset 15

16 A step back redifining types of integration An overview of vertical and horizontal integrations

17 Vertical vs. Horizontal Integration Main scope for API Management SYSTEMS OF ENGAGEMENT Synchronous/Real time Vertical Integration Mobile Apps Response web Applications Financials EPM HCM Devices Order Management Customer Service Business Partners CRM Data Hubs Legacy SYSTEMS OF RECORDS Horizontal Integration Asynchronous in nature. Near-real time or batch. Typical integration styles: as pub/sub, data replications, file transfers Created with Niklas Olsson / 17

18 Vertical vs. Horizontal Integration Characteristics Vertical Human behind the trigger Information requested on-demand (real-time) Synchronous in nature. A request expects a response Objective is to deliver functionality and/or information in support of a user journey Directly impacts the user experience (regardless of the channel) Best realised with API management Horizontal System behind the trigger Initiated by a system scheduled or a system event Asynchronous in nature. No immediate response expected Objective is to deliver data or messages from a source system to a target(s) system No immediate impact to the user (unless a malfunction occurs) Can be realized in a number of ways Coworkers UX Systems of Engagement Customers Experience Delivery Tailor, Deliver Enforce, Aggregate, Route Rapid access, Transform Extract, Capture Validate, Enrich, Transform Route, Operate, Load

19 What about SOA? Typically adopted to deliver horizontal integrations Best for vertical integrations SOA Traditional SOA (i.e. AIA) API Management Not for integration. Best for building modern systems Microservices Architecture Inspiration from Martin Fowler s Microservices presentation at GOTO conference, Berlin November 2014 (minute 14) 19

20 The missing piece: Enterprise API Taxonomy, API Management Capability Model and Oracle PaaS Cloud Services mapped to the APIM capabilities

21 Enterprise API Taxonomy SYSTEMS OF ENGAGEMENT API $ Management & Collaboration Single Purpose APIs Utility APIs Design & Development Portals Policy Definition Lifecycle Management Runtime Analytics User Management Special Purpose APIs Presentation APIs Public [Consumer] APIs Partner [B2B] APIs API Applications [Managed] Business APIs System APIs System APIs System APIs System APIs System APIs Finance SCM Legacy, etc CX HCM Microservices Identity Logging Error Handing Notifications SYSTEMS OF DIFFERENTIATION SYSTEMS OF RECORDS SaaS SYSTEMS OF INNOVATION 21

22 API Management Capability Model Dev-Ops Runtime API Management Console API Lifecycle Management Policy Definition Runtime Monitoring Runtime Analytics API Gateway Management Policy Definition User & Role Management Keys Management API Design & Development Portal API-First Design Console ADL Programmatic Validation API Approval Workflow API Dynamic Documentation API Discovery & Subscriptions API Applications & Keys Generation Developer Onboarding Community Collaboration API Registry Resource Registration Resource Discovery K/V Storage K/V Replication Resource Health Status Registry API Federated AuthN/AuthZ Thread Protection AuthN/AuthZ/API Key Validation Light Scripting System AuthN/AuthZ Data Transformation API Key Validation Client Backend Logic Scripting Policy Enforcement In-memory Cache Connectivity Adapters Complex Orchestrations Single Purpose APIs Call Aggregation Platform/ Backend APIs Business APIs HTTP Routing Rate Limiting/Throttling API Applications Connection & Session Management Custom Logic (Complex Scripting) Tailored Contracts Push Nots/ Websockets Calls Aggregation Streaming Transport Conversions Polyglot Programming Thread Protection Polyglot Consumer SDKs Light Transformation REST/SOAP Conversions Protocol Conversions Decentralise Deployment Utility APIs Identity Federation Identity Mappings Error Handling Logging Alerts & Nots Management APIs Delivery Version Control Deployment Continuous Integration Continuous Testing Release Management Team Management Team Collaboration Issue Tracking Spring Boards 22

23 Oracle PaaS for API Management Oracle PaaS Cloud Services APIPCS OOTB Interoperability Suggestions Dev-Ops Runtime API Management Console API Portal API Registry Single Purpose APIs Utility APIs Mobile Cloud API Platform Cloud Java Cloud App Container Cloud API Platform Cloud API Platform Cloud Eureka Business APIs Identity Cloud API Platform Cloud API Applications Managem ent Cloud REGISTRATOR Public SaaS API Catalog SOA Cloud Integration Cloud Java Cloud App Container Cloud Delivery Developer Cloud 23

24 Patterns & Use Cases Sample enterprise API management use cases delivered in the Oracle Cloud PaaS

25 API {First} Design 1) Enters APIM Dev Portal 2) Searches API catalogue 3) No match API Platform Cloud Developer Portal 4) Opens API editor API Designer 5) Creates API definition 6) Creates mockup & shares URL 9) Updates definition 12) Submits final definition (Github pull request) 15) Set-up continuous test Assertions checks Assertions checks APIM Designer Portal > Dreed, Circle CI 7) Evaluates 8) Feedback 10) Evaluates 11) Thumbs up! API Consumer Developer 13) Evaluates 14) No changes Architects 16) Implements API API Platform Cloud API Developers API Developer 17) Requests deploy Management 18) Gets request Console 19) Approves API Gateway DMZ API Gateway API Gateway API Gateway Admin 25

26 Mobile Application accessing System of Records in Oracle SaaS and SFDC Auth Cloud PaaS Mobile Cloud JSON Object Tailoring Mobile API Mobile Backend Connections 2 Validate API-Key Business API {json} User Authn API Platform Limits & throttle API Gateway 8 Route Respond {json} {json} 3 7 {json} REST Integration Cloud Orchestrate Transform 4 Integration Flows Connect Connect 1) Update personal info submitted from app. Call to mobile backend API takes place. Authentication would ve already happened in this example. Mobile API Key is validated <soap> 6 {json} <soap> <soap> ERP Cloud <soap> 5 Auth Service Cloud SaaS Enterprise WSDL 2) Backend API code (node.js) transforms object (into enterprise format), injects and calls business API via the REST connector (in theory connector should inject API key and authentication credentials) 1 9 3) Business API receives the calls and enforces policies as specified, ie. key validation, user authn/authz, rate limits, possibly custom script and finally routes the request to the backend (system) API (implemented in ICS) {json} {json} 4) An integration flow receives the request (in enterprise format). An orchestration is initiated to: 1) update personal info in SFDC, 2) update personal info in ERP cloud. It happens as following: 5) The received object is transformed into target system format and included into a request call to SFDC (via enterprise WSDL). ICS takes care of REST/SOAP conversion and also handles authentication and sessions with SFDC 6) The received object is transformed into target system format and included into a request call to ERP Cloud (via enterprise WSDL). ICS takes care of REST/SOAP conversion and also handles authentication and sessions with ERP Cloud 7) ICS transforms back the object into the enterprise object format and sends back JSON response to the API gateway Oracle MAF 8) API gateway sends back the response to the mobile backend 9) The mobile backend API code transforms object to format expected by the mobile app 26

27 Service Cloud searches on-premises customer master through existing SOAP web service Cloud SaaS Cloud PaaS Service Cloud {json} {json} API Platform Management Console 0) Customer Service Agent conducts a search in Service Cloud to service for a specific customer (ie. Based on first and last name) DMZ API Platform Validate API-Key User AuthN Presentation API 2 <soap> 1 Limits & throttle 6 7 SOAP- REST Respond API Gateway <soap> https Sends stats Pulls deployments 1) Service Cloud triggers a call to an API exposed in a DMZ (i.e. 2) The API gateway receives the request, validates the API key and user credentials (ie. OAuth 2.0), enforces limit/throttling policies and then converts the payload into SOAP to invoke the business service exposed by SOA Suite internally 3) Typically an enterprise business service (EBS) in SOA Suite will just route the request to the relevant application connector service service also in SOA Suite EBS Mediator BPEL WS Adapter 3 ACS Mediator DB Adapter 4) The ACS will transform the request from a canonical model into the application format and via the adapter (ie. Database) will connect to the system of record and conduct the search in any given protocol (ie. SQLNET) Oracle SOA Suite 5 4 sqlnet 5) The request is converted back into a canonical model and send back to the invoker service PLSQL Customer Data Hub 6) A SOAP response in canonical model is send back to the API Gateway 7) A policy converts back the SOAP payload into JSON (most likely removing fields that are not required by the consumer system) and sends back the JSON payload 27

28 Wrap-up

29 Oracle Cloud PaaS Capability Comparison ** Only when combined with Developer Cloud Capability API Platform Mobile Cloud SOA Cloud** Integration Cloud Java Cloud** App. Cont. Cloud** E2E API lifecycle (design, mock, build, test, publish, manage, monitor) Hybrid deployment (cloud/on-prem) native (installed via cloud) Rich API focused ops and analytics REST/JSON end to end API policies definition & enforcement Authentication & Authorization Identity federation support (ie. OAuth 2.0) API keys management and enforcement Backend (platform) APIs (ie. Push nots, storage, data sync, etc) WebSockets HTTP Routing (declarative) Data transformation (declarative) Protocol conversion (declarative) Call aggregation (declarative) Orchestrations (declarative) Custom scripting Connectivity to several sources (excluding pure REST/SOAP) Polyglot programming Light footprint Full Mostly Partly Some or Custom (libs & imperative) No support 29

30 About Capgemini and Sogeti With more than 180,000 people in over 40 countries, Capgemini is a global leader in consulting, technology and outsourcing services. The Group reported 2015 global revenues of EUR 11.9 billion. Together with its clients, Capgemini creates and delivers business, technology and digital solutions that fit their needs, enabling them to achieve innovation and competitiveness. A deeply multicultural organization, Capgemini has developed its own way of working, the Collaborative Business Experience, and draws on Rightshore, its worldwide delivery model. Learn more about us at Sogeti is a leading provider of technology and software testing, specializing in Application, Infrastructure and Engineering Services. Sogeti offers cutting-edge solutions around Testing, Business Intelligence & Analytics, Mobile, Cloud and Cyber Security. Sogeti brings together more than 23,000 professionals in 15 countries and has a strong local presence in over 100 locations in Europe, USA and India. Sogeti is a wholly-owned subsidiary of Cap Gemini S.A., listed on the Paris Stock Exchange. The information contained in this presentation is proprietary. Copyright 2016 Capgemini and Sogeti. All rights reserved. Rightshore is a trademark belonging to Capgemini.