Serve Up the Web with ITAP

Size: px

Start display at page:

Download "Serve Up the Web with ITAP"

Cory Ferguson
5 years ago
Views:

1 Martin Knopp I Centura Serve Up the Web with ITAP ce Tea Active Pages (ITAP) allows you to link Web pages to CTD applications. ITAP works much like Microsoft Active Server Pages (ASP) does. With ASP, you can include VBScript code within a Web page; with ITAP, you can include SALScript code in your Web pages. If you re developing Web applications with ASP, you ll write COM objects containing the business logic and call these COM objects from VBScript embedded in your Web pages. Using ITAP you wouldn t write COM objects but would make direct calls to your CTD server application by embedding SALScript in your Web pages. That was all I knew before I first used ITAP myself, and I couldn t really imagine how it would look for me developing Internet applications with ITAP. Therefore I ll show you a sample shortly. As with S Q L W i n d o w s ASP, everything in your HTML source enclosed in <% %> tags is processed 3 2 by the server (VBScript with ASP and SALScript with ITAP). Because of the great similarity between ITAP and ASP, every HTML editor that supports ASP development (for example, by color-coding) is also well suited for ITAP development. I used HomeSite, myself, but you also can use Microsoft FrontPage, for example. ITAP was developed by Gianluca Pivato of the Ice Tea Listing 1. An HTML page from sample file Demo.itap. The Ice Tea Group s promising Web enabler called Ice Tea Active Pages (ITAP) has the potential to change how Centura developers think about Web deployment. Here s an advance look at the product. <HTML> <BODY> <% Application.Init() %> = 1 < Application.GetCount() %> This is row number <%=@Row%> containing text <%=Application.GetRowData(@Row) %>.<BR> <% + 1 EndWhile %> </BODY> </HTML> Pro Group, who is well known for his development efforts XSal and XSalCOM. My review is based on a pre-release of ITAP, so there might be some slight changes when the final release is out. I can t comment about the installer and the documentation, as both were unfinished at the time this review was done. But I feel this product is so hot that it s worth being reviewed in this state anyway. An example Having described the basic concept of ITAP and the similarities to ASP, I think Listing 1, the HTML code for a simple page, will make it more clear about how everything fits together. The embedded SALScript code looks nearly identical to the SAL code you re used to. One exception is that you need an EndWhile construct (and also an EndIf ), since you don t have your code structured in an outline. You can even define local variables (which are untyped, and must start with to distinguish them from normal SAL variables). A server application The corresponding server application would have to look like Listing 2. (To improve clarity, I don t show code inherited from the ITAP libraries.) I choose to implement all the logic (which is quite simple in this example) in one functional class, and there s one global instance of this functional class defined. This design is useful because the SALScript code embedded in the ITAP Web pages is executed in a context where it has access to all global variables and all internal and external functions. Centura Pro October

Returns Parameters Static Variables Local variables Actions Set ncount = 5 Function: GetCount Returns Number: Parameters Static Variables Local variables Actions Return ncount Function: GetRowData

2 Listing 2. A simple ITAP server application. Global Declarations Variables capplication: Application Class Definitions Functional Class: capplication Derived From Class Variables Instance Variables Number: ncount Functions Function: Init Returns Parameters Static Variables Local variables Actions Set ncount = 5 Function: GetCount Returns Number: Parameters Static Variables Local variables Actions Return ncount Function: GetRowData Returns String: Parameters Number: p_nrow Static Variables Local variables Actions Return 'RowData#' SalNumberToStrX(p_nRow,0) The look of ITAP To give you an idea of what a Web application developed with ITAP could look like, I d like to show you some screenshots taken from the sample application that shipped with my pre-release (see Figures 1 and 2). It s a simple front end for the well-known ISLAND database that ships with CTD itself, and is also used by Centura s CTD samples. In addition, there are some great samples already online, which I ll discuss at the end of this article. Technical talk Before taking a look at the specifics of ITAP, let me give you a short background on how you can link a Web server to applications. A Web server does nothing other than receive a request for a specific document from a browser, read this document as a file from its own disk, and return it to the browser. The browser expects the returned data to be a valid HTML document and displays it accordingly. Now, instead of reading the document from a file on the disk, most Web browsers have interfaces so they can call an application that returns a valid HTML document as its output. These applications must be developed in a special manner to meet the requirements of the interface defined by the Web server. There are three commonly used interfaces for this task: CGI, ISAPI, and NSAPI. CGI comes from the Unix world; ISAPI was invented by Microsoft for Microsoft Internet Information Server (IIS); and NSAPI is the counterpart to ISAPI from Netscape, for its own Netscape Web Server. I m not an expert in these interfaces myself, so I won t get into further details now. For ITAP to work, you need a small program (called a stub) to be installed on the Web server. The stub is compliant with one of the interfaces mentioned above and handles the requests sent by the browser for ITAP pages (such as requesting demo.itap in my example). Right now an ISAPI stub integrates perfectly with IIS. I did my testing with IIS version 4 but as far as I know Pivato uses IIS version 3. The ISAPI stub is very lean (about 50K) and optimized for performance. Because only the ISAPI stub is available, right now ITAP only supports Web servers running on Windows NT (i386) and IIS, or any other Web server that supports the ISAPI interface. However, the first version of ITAP I saw had a CGI stub, so the technology is there to provide a CGI stub in future versions that could even run on Linux. The communication between the stub and the application server instances (your CTD programs) is plain TCP/IP, so Figure 1. The ISLAND sample showing the selection of companies. Figure 2. The ISLAND sample showing a company s details. 8 Centura Pro October

3 providing stubs for different platforms isn t a problem. Additionally, Pivato told me that he s currently investigating Netscape server extensions, so we might see an NSAPI stub in the not-too-distant future, too. The stub reads the HTML file (containing the embedded SALScript to be processed by ITAP), sends it to an application server instance, receives the resulting HTML page (plain HTML now) from it, and returns it to the Web server to be sent to the client browser. To be able to do that, the stub has to know which application server instances exist and are to be used to handle various ITAP requests. This is done with an INI file that names each application server instance using an IP address and a port number. Additionally, you can configure an error page, a timeout, encryption, and some other parameters using that INI file. For each virtual server or directory you can have different sections in the INI file, so you can use different application server instances for each. In the main INI file you can also redirect a section to a different INI file, so you would end up with a global INI file in charge of the server administrator and an INI file for each virtual server or directory in charge of the administrator of the corresponding Web application. You can even handle ISP situations, where you might have a lot of different ITAP Web applications served by one Web server, running on different virtual servers or directories. It might sound a little bit complicated, but it really isn t; and the ITAP Manager (much like the Centura Connectivity Administrator) can assist you in doing all the necessary configuration. But how did the stub get control of the original HTML file in the first place? With Internet Information Server you can register the ITAP s ISAPI stub (itapisa.dll) to handle requests for files with various extensions automatically. Using this feature IIS will pass every request for files named *.itap, (or whatever extensions you choose) to itapisa.dll (the implementation of the ISAPI stub) for processing. This is exactly like Active Server Pages, where every request for files named *.asp is passed to asp.dll by IIS. The URL for calling my sample sheet looks like this: (assuming the demo.itap file is placed in the root directory of mydomain). With the CGI stub you couldn t do this automatic mapping; the URL for calling my sample sheet would look like this: Please keep in mind that the first version of ITAP will probably ship with only the ISAPI stub. A useful class library Now you might say, Looks nice, but real world applications aren t that simple. You need to access the query string (the part of an URL after the? ), form values, cookies, and you need some session management. ITAP takes care of all of these issues. Besides the server stub and the ITAP engine (a CTD library that has to be included in every ITAP server application), it comes with a collection of very useful functional classes. These objects include: The Request object, to access the HTTP parameters (everything the browser sends to the Web server as defined by the HTTP). The Request.Form object, which you ll use to access all the parameters that are passed to your page from an HTML Form (it s very simple; Request.Form.GetString( Username ) returns the value of an HTML Field named Username ). If you already have HTML experience, you can use either the POST or GET method to transfer your form data. In both cases you ll have access to it via this object. And it also gives you access to parameters that you manually added to the URL as part of the query string. This behavior is slightly different from the corresponding ASP objects. The Cookie object gives you access to values stored in the cookie file on the client side. The Session object lets you store and retrieve variables that are persistent during a whole ITAP session. The ITAP session management is cookie-based so it requires the client to allow a cookie to be set. However, it only stores a unique session ID in a cookie, not the session variables themselves, which are stored in a session file on the server. So you re virtually unlimited in what you store as session variables. For database access a simple Database object and Resultset object are provided, too. All this functionality is available either from the server application or from the SALScript embedded in the HTML pages. The sample application shipped with the pre-release is a good place to learn how to develop Web applications with ITAP. Scalability and fault tolerance Scalability and fault tolerance are quite important to Web applications. You often don t know how many users your services will attract, and you want your application up and running 24 hours, seven days a week in most cases. You can have multiple ITAP server application instances serving one Web application. These server application instances can run on one machine (on different ports) or even on different machines. The different server instances will be used in a round-robin fashion. If a server application instance fails to respond, Centura Pro October

4 the request automatically passes to a different server instance, providing fault tolerance. You can configure ITAP so that an application server instance that doesn t respond within the timeout period or refuses the connection is skipped for the next n requests (the exact number to be set in the INI file). Another option starts more than one application server instance using the same IP address and port number. (This has some benefit but won t provide load balancing, so I won t go into further details about that.) I mentioned one Web server and multiple application server instances (on one or more application servers). That s not all for ITAP you can even have multiple Web servers connecting to the same set of multiple application server instances (on one or more application servers). So you re virtually unlimited in scaling up your Web application using ITAP. However, there s one bottleneck: ITAP stores temporary information in files (session information, and result sets if you re going to use the Resultset object provided). Since different requests from the same session might be directed to different application server instances (even located on different application servers) all server instances have to share the same location for storing this temporary information. It s specifically the server storing this information that might become the bottleneck for performance. Even worse, if the server holding this temp directory goes down, your whole ITAP application goes down, too. The files are very small (unless you store very big result sets). An idea for a future release of ITAP would be to replicate the temp directory; then even if one or more of them aren t available, everything would keep running smoothly. Complex, yes. Maybe using fail-safe hardware would be the better choice, requiring no additional logic in ITAP. Security Security between the client browser and Web server is up to the Web server itself. For IIS you could use Secure Sockets Layer (SSL) if you need to make this communication secure. However, another place where security might be of interest is in the communication between the stub residing on the Web server and the server application instances running on the application servers. If the stub and application server instance(s) are on the same machine, it s not an issue at all. If they re in the same local area network, you might consider it safe enough, too. However, since the communication is completely TCP/IP based, they could even be connected via the Internet or an intranet. To handle all these situations in a secure way, ITAP gives you the ability to fully encrypt all traffic between the stub(s) and the application server instance(s) using standard algorithms. LUC, DES, 3DES, and BLOWFISH will be implemented in the final release. Shipment of RSA isn t certain yet because of open questions about licensing. Encryption can be configured independently for each virtual server or virtual directory. It s up to you to decide how long your keys should be. In addition to static keys on both sides, a random key is added for each transaction, so you ll end up with different streams every time even if the same data is transmitted. This gives you one of the most secure systems available, which should be well suited for e- commerce and even e-banking solutions. Performance I did some testing to give you an idea about the performance you can achieve with the ITAP solution on a single-server installation. The environment is a Pentium II/400, with 128M of memory and a simple SCSI disk system (no RAID!). So it s something of a low-end server by today s standards. The system is running Windows NT 4.0 with Service Pack 5, IIS version 4, SQLBase 7.0, the application server instance of the ITAP application, and the browser, all on the same machine. It s quite heavily loaded, but it doesn t test network performance. I used a page with an auto-refresh meta-tag in it, so the browser loaded it at the highest possible rate. The page isn t complex; however, it does database access (three simple queries). In this configuration my machine executed about nine transactions per second (about 750,000 transactions per day). My colleagues in the U.S. tell me that using RSA encryption for both directions with a 1,024-bit key slows down things quite significantly; they reached 0.4 transactions per second (about 35,000 transactions per day) in the same test. I talked to Pivato about that performance decrease, and he told me that I have to take into account that RSA, as a private/public key system, is very slow but very, very secure. He told me that DES, 3DES, and the other algorithms using a secure key system (one where the key has to be transferred securely since the same key is used for encryption and decryption) are about 100 times faster. With these algorithms the key only has to be stored on the Web servers and the servers running the application server instances, which both can be secured by themselves. I guess 3DES would be safe enough for nearly every application, and RAS should be used only where the highest possible security is needed. Since you have load balancing and scalability in ITAP, you can always throw in more hardware to meet any number of transactions needed. I should note that I didn t test all the features mentioned about scalability, fault tolerance, and security. Some of this description is based on the documentation of the pre-release and private communication with the developer. What I did test is the configuration with one Web server and multiple application server instances (even on different machines). ITAP Manager The ITAP Manager gives you a graphical user interface for 10 Centura Pro October

5 editing the INI file containing the configuration of the ITAP stub on the Web server. The INI file content is displayed using a tree view, allowing you to add keywords and server entries with a few mouse clicks. You don t have to remember the names of all the valid keywords because it gives you a list of appropriate keywords for every section of the INI file. It s a simple application, but it definitely makes your life easier. One nice feature: If you re going to use encryption, you can use the ITAP Manager to generate the needed key files for you. If you re using IIS 3.0, ITAP Manager assists you in creating the necessary registry entries to automatically map your ITAP file-extensions to be handled by the ITAP stub. With IIS 4.0 you can do that directly from the Microsoft Management Console (MMC). ITAP Manager is implemented with SQLWindows/ 32. This fact prevents me from using it on our production Web server. I don t like the idea of having to install the whole SQLWindows/32 runtime environment on my production Web server. I try to keep the installation of this server as lean as possible, and so I stick with directly editing the INI file using what else? Notepad. ITAP compared to Centura Web Developer, net.db and others Centura has both Centura Web Developer (CWD) and Centura net.db for Web development. Why should anyone use ITAP instead of these products? How would I position them against each other? Here s what Frank Böttcher, author of IntelliSAL, told me regarding CWD: We use ITAP for a real life program that should serve our customers as a technical research system. We evaluated CWD for this purpose and were quite pleased at the beginning. The approach to use the same application source for a client server app as well as for a Web application sounded promising. However, we soon reached the limitations of CWD: The ability to alter the layout varies from very limited to non-existent. The automated generation of layouts is very basic and therefore not usable for complex application. There is not much chance to arrange load balancing. I agree with what he says. I worked with CWD myself and saw the same limitations. Compared to ITAP, net.db 1.5 targets different needs. I see ITAP as intended for developing complex Web applications with a lot of business logic and high demands for page layout (possible in ITAP because the page layout is completely up to you). On the other hand, net.db is designed in a way that you don t need to know anything about HTML. But if you re going to do more complex things with net.db today, you ll need both HTML and JavaScript knowledge anyway. Also, implementing business logic with net.db today isn t possible, unless you re going to use database triggers and stored procedures as workarounds. This will change with net.db 2.0, with which you ll be able to use COM objects. However, the basic concept, that the page is auto-generated and not manually designed, won t be changed in net.db 2.0; only some limitations will be lifted, as far as I know. Here s a comment from Sune Jensen, who used ITAP to develop a very powerful shopping-basket application: I have also been working with Informix Data Director lately, and I must admit, even though the Informix system is 10 times more expensive, ITAP outperforms it by several times. That price comparison is inexact. The Informix package contains more than just the Web development environment, and pricing for ITAP isn t yet fixed, so the quote is based on preliminary pricing information Jensen got from Pivato. One of the best tools In conjunction with the power of CTD for developing business logic, I would rate it as one of the best tools for developing Web applications, simple or complex. Its scalability, fault tolerance, and security offer great advantages against all competing solutions I ve investigated. If you ve encapsulated the business logic of existing SAL applications in functional classes, it should be easy to bring them to the Web by writing a Web interface for your applications using ITAP. Sound similar to moving SAL applications to the COM world? There are many similarities, and it s worth noting that any COM object developed in XSalCOM, or the upcoming CTD 2.0, or in any other tool, could still be used with ITAP. You would simply make the COM call from a CTD application invoked with ITAP, instead of VBScript on ASP. Compared to CWD, ITAP is tougher to learn. You need good HTML knowledge for working with ITAP. However, that s also one of the main advantages you re unlimited in designing your pages in any way you like, since the HTML comes from you and isn t auto-generated. In addition, scalability is another major advantage over CWD in its current version. An ITAP application (an online calendar) has been available at for some weeks now. We re using the same application internally and are really satisfied with its speed and stability. The application that Sune Jensen worked on is also available. Visit Centura Pro October

6 click on a book title link, and click the Order book button to see the shopping cart, which is implemented with ITAP and SQLWindows/32. I m excited by the promise of ITAP. With a colleague, I intend to develop a Web-based defect tracking system based on it. I expect the first version to be online near the end of the year. We ll offer this commercially, both as a software product and as a Web service. CP Martin Knopp has worked with Centura/Gupta products since At the moment he s working as a consultant and developer on client/server and Internet applications, using the whole Centura product line. There are some ITAP projects in the queue already. You can contact him at mknopp@eunet.at.

Centura is Dynamic Gianluca Pivato F

Pro Centura TM Visit us at www.propublishing.com! Hot Ideas for Centura Developers The Secret s Out: Centura is Dynamic Gianluca Pivato F or years developers have had to find creative ways to overcome