Service Oriented Architecture

Transcription

1

2 Service Oriented Architecture Web Services Security and Management Web Services for non-traditional Types of Data

3 What are Web Services? Applications that accept XML-formatted requests from other systems across a network via lightweight, vendor-neutral communications protocols

4 What are Web Services? Applications that accept XML-formatted requests from other systems across a network via lightweight, vendor-neutral communications protocols Web Services by their very nature are not secure!

5 Why is SOA by Nature not Secure? Characteristics Expose your application as a Service on the network (Wider accessibility) Don t know all your consumers before-hand (Reuse) Can t make technology assumptions about Consumers. (Interoperable) Concerns Security (wider accessibility => greater risk) Manageability (wider dependencies, less control)

6 Web Services Security/Mgmt Concerns Security Only valid organizations/constituents may access our web services Exception Handling Notify operations if a transaction stalls Compliance and Consistency All requests must be encrypted with 128 bit keys Service Level Monitoring The requests must be processed in under 2 seconds

7 Web Services Security/Mgmt Concerns Security Only valid partners may access our web services Exception Handling Notify operations if a transaction stalls So, Compliance what and can Consistency we do to secure and All customer orders must be encrypted with 128 bit keys Manage web services? Service Level Monitoring The order system must process transactions in under 2 seconds

8 Web Services Management (WSM) Solution for securing and managing SOA via centralized policy definition and localized enforcement. No modification to existing services Flexible deployment architecture Fine-grained policy execution Standards-based, heterogeneous design Relieve developers of writing security logic

9 Typical WSM Components BUILD Policies ENFORCE Policies MONITOR Policies Policy Gateway Policy Manager Policy Agents Web Service Monitor Web Services

10

11

12 WSM Management Console

13

14 Protecting Access To Web Services Using Gateway The Request Pipeline specifies the sequence of Policy Steps that should be enforced for incoming requests. Web Service Client 1 4 Gateway 2 3 Web Service Provider The Response Pipeline specifies the sequence of Policy Steps that should be enforced for outgoing responses The Gateway secures access to one or more web services at the web service provider site Step1: The client posts a request to a web service Step2: The Gateway intercepts the request, applies security policies (e.g., decryption, signature verification, authentication, authorization), and forwards the request to the web service Step3: The web service returns a response Step4: The Gateway intercepts the response, applies security policies (e.g., encryption), and forwards the response to the client

15 Protecting Access to Web Service(s) Using Server-Side Agent Web Service Client 1 4 Agent 2 Web Service Provider 3 An Agent protects access to a web service at the web service provider (server-side Agent) Step1: The client posts a request to a web service Step2: The Agent intercepts the request, applies security policies (e.g., decryption, signature verification, authentication, authorization), and passes the request to the web service Step3: The web service returns a response Step4: The Agent intercepts the response, applies security policies (e.g., encryption), and passes the response to the client

16 Requesting Access To Web Service(s) Using Client-Side Agent 1 Web Service Client Agent 2 3 Web Service Provider 4 A Client-Side Agent enforces web services policies from within the same web application as the service client Step1: The client posts a request to a web service Step2: The Agent intercepts the request, applies security policies (e.g., encryption, etc.), and passes the request to the web service Step3: The web service processes the request and returns a response Step4: The Agent intercepts the response, applies security policies (e.g., decryption), and passes the response to the client

17 Virtualizing Web Services Using Gateway Web Service Client HTTP Gateway Actual Web Services 123 and 456 are registered with the Gateway and bound to the virtual web service ABC JMS HTTP Web Service Provider Actual Web Service 123 Virtual Web Service ABC Upon registration of an actual web service, the Gateway generates URL mapping between virtual and actual web services allowing enforcement of different policies for each actual web service Web Service Provider Actual Web Service 456 A Gateway that provides web services virtualization Actual web services are bound to a virtual service (the Gateway) Users first access the virtual web service and based on their roles, users may access selected actual web services The transport protocol can also be virtualized, for example, all users access a virtual web service through one protocol (e.g., HTTP) and the virtual service can pass the request to an actual web service using a different protocol (e.g., JMS) Users can create multiple versions of a virtual web service and redirect an older version of the virtual web service to a new version

18 Comparing Gateways and Agents Features Gateways Agents Administration Provides a central location No new component to administer Protocol Support Securing Services Impact on Clients Can perform protocols translation Cannot guarantee endpoint-level security Single enforcement points to administer Need to point the client to the Gateway Leverages existing platforms and existing protocol support Provides endpoint-level security Several enforcement points to administer No need to make changes in the client or the UDDI registry

19

20 Monitoring: Snapshot of all Activities

21 Monitoring: Authentication & Authorization Events

22 Monitoring: Traffic Analysis

23 Monitoring: SLA Compliance

24 Geospatial Web Services

25

26 Wisconsin Example

27 Spatial Web Services use cases OpenGIS Web Map Service Browser based, no local data database Web Service Provider OpenGIS Web Feature Service Desktop, local user data only OpenGIS Transactional Web Feature Service Server based consumers

28 WFS (Web Feature Service) OGC standard (and ISO 19142) -GML - Published feature types request response A WFS is a Web interface that allows one to publish and deploy geographic feature data locally or across the Internet. 2 types of services: standard WFS and Transactional WFS (WFS-T) Feature Schema Web Feature Service Mapping F T X F T Z F T Y WFS-T operations include the ability to insert, delete, update, get and query features on spatial and non-spatial constraints Data repository T a b l e A T a b l e Data base & internal data model B

29 Requirements Access/search/update/delete geo-spatial feature instances based on spatial/non-spatial search criteria using a standard interface over the web Access/Update in a secure way with proper authentication and authorization Manage feature privileges at a instance level Real-time transfer of feature instances in a platform/programming language independent way

30 A Single Web Services Platform Single source of truth Strong Security Real-time information updates Interoperable data and location aware processes Integrated spatial information from multiple sources Enhanced Business and Operational Intelligence Creation of a Network Centric, Spatially Enabled, Real Time Enterprise Access to all data through single language - SQL State/Federal Agencies Planning Dept. Spatially Enabled Data Base Land Management External Web Services Central GIS Agency Data Engineering

31 Google Earth as Web Service

32 Web Services: National Weather Service

33 National Weather Service

34 Web Services Enable Damage Assessment

35 One Approach Use SOAP/XML over HTTP for Request/Response Spatialy enabled database for Feature instance Storage/Retrieval Implement GML filter specification for feature search Use appropriate Identity Management for authentication Label-based security for instance-level privilege mgmt WSS/SSL for secure transfer of feature data

36 One Approach (Contd) Support publishing feature types from database data sources(tables, views) Complex Type columns Nested Table/VARRAY columns XMLType Columns Support publishing feature types from external data sources (external XSDs) Feature cache in middle-tier to reduce volume of spatial data transfer from DB to middle-tier makes WFS request processing more efficient

37 A Shameless plug for another presentation GIS- More Important than Ever Eric Swanson, Director CGI Governor s Room 2:45 today

38 Oracle Fusion Middleware

39 Identity Management Access Manager Web Access Control/Single Sign-On Web Services Manager SOA Security esso Suite Desktop/Legacy Single Sign-On Auditing & Reporting Compliance & Attestation Identity Federation Cross Domain Single Sign-On Identity Manager Enterprise User Provisioning Systems Mgmt Monitoring & Management Directory Services Identity Virtualization, Synch & Storage

40