Portals allow users easy access to information

Editor: Siobhán Clarke siobhan.clarke@cs.tcd.ie Standards for Fernando Bellas University of A Coruña, Spain By integrating applications and resources, portals let users access information in a simple, straightforward manner. Currently, most portals let users create one or more personal pages composed of s interactive Web mini-applications. Until recently, no standards for s existed, and thus consuming remote s in a generic way or deploying s in one portal server that were developed in a different one has been impossible.two standards released in Fall 2003 the Web Services for Remote Portlets () and the Java specification address these problems. This articles outlines these standards and presents a typical architecture for a standards-based portal. Portals allow users easy access to information by integrating heterogeneous applications or data sources in a consistent way. Firstgeneration portals tend to present a monolithic software architecture that compromises portal development and maintenance. With roots in Internet portals such as My Yahoo (my. yahoo.com), second-generation portals let users create one or more personal pages composed of personalizable s interactive Web miniapplications, local or remote to the portal, that render markup fragments (news, weather, sports, and so on) that the portal can aggregate into a page. A portal typically decorates the markup fragments returned by a with a title and several buttons, such as minimize/maximize, edit (personalization), and destroy. Unlike first-generation portals, second-generation portals present a component-oriented architecture in which each is a component that can be easily plugged into the portal, thus improving development, maintenance, and reusability. This portal model is also beginning to appear in corporate intranets, giving users a personalized and restricted view of the company s information. In the past three years, both the industry and open-source communities have provided software platforms portal servers 1 to support the construction of second-generation portals. When portal servers first appeared, standards for developing s had not yet been proposed, making it impossible to consume remote s in a generic way or to deploy s developed in one portal server in a different one. Recently, standards have emerged to address these two problems, and most manufacturers have adapted their portal servers to comply with them or have announced plans to do so in the near term. The Need for Standards Figure 1 shows the classic approach to implementing the portal shown in Figure 2. In this scenario, each is a software component local to the portal, providing a complete user interface through which the can interact with the user and display content (provided by it or by an external service). The problem with this approach is that any portal wishing to consume the services provided by the BBC, Xignite, or others must reimplement each s user interface because such services provide only content. It would be much more convenient if the remote services were remote s, returning HTML markup fragments rather than plain data. Likewise, if we used the same portal server to develop another portal that used the My Book- 54 MARCH APRIL 2004 Published by the IEEE Computer Society 1089-7801/04/$20.00 2004 IEEE IEEE INTERNET COMPUTING

marks and Tip of the Day s, we would have to redeploy the s in the new portal; if we used a different server, we would have to develop new s from scratch. Although unrealistic in this example, the situation is common in large corporations that have intranet portals for each division and wish to share s among them. Figure 3 (next page) shows a solution to this problem: each remote producer implements a standard Web service interface (defined in Web Service Definition Language) through which portals can interact with the remote producer s s (currently the BBC and Xignite do not provide remote s, but rather services like those illustrated in Figure 1). Among the operations specified in the interface, one takes as a parameter the data corresponding to an event (for example, click on a link or click on a form-submit button) and returns the new markup. Whenever the user performs an interaction with a given in a page, the portal calls on the corresponding producer s Web service to get the new markup. To export some of its local s to other portals, a portal need only provide an implementation of the standard interface that wraps the s. As all producers implement the same interface, a portal administrator could add a remote to a portal without programming effort. In September 2003, the Organization for the Advancement of Structured Information Standards (Oasis) released the first version of the Web Services for Remote Portlets () standard (see the Portal Resources sidebar on p. 60), which specifies the interfaces a remote producer must implement to allow another application (typically a portal) to consume its s, regardless of the technology the producer and consumer use (J2EE,.NET, and so on). Developers should be able to take s developed in one portal server and deploy them in a different server, provided the servers are built with the same technology. Such an approach avoids dependence on portal server manufacturers. Thus, we need a standard API for each language used to develop s. It might seem that the interfaces specified in make up such an API. After all, many tools implement the standard WSDL-to-Java mapping, for example, and.net provides a similar tool for its languages. However, several factors make this approach unsuitable: BBC World News BBC Tech News Stock News Stock Quote My Bookmarks Tip of the Day Portal XML/HTTP BBC World News Service (www.bbc.co.uk) XML/HTTP BBC Tech News Service (www.bbc.co.uk) SOAP/HTTP Stock News Service (www.xignite.com) SOAP/HTTP Stock Quote Service (www.xignite.com) Figure 1. Classic -based portal architecture. Each is a software component local to the portal, with either its own content or content provided by an external service. Figure 2. A sample -based portal. Each user has one or more pages composed of several personalizable s. Most s will be local, in part because many will be domain specific, but also because using local resources is more efficient. However, was not designed to be an API for developing local s; it is for exporting a producer s s to remote applications. interfaces contain many low-level details that make them difficult to implement directly. Implementing a involves developing a component that generates markup (HTML, Wireless Markup Language, and so on) as in other Web applications. Therefore, we need a API that lets us use the same technologies we use to generate markup when developing normal Web applications (for IEEE INTERNET COMPUTING www.computer.org/internet/ MARCH APRIL 2004 55

BBC producer (www.bbc.co.uk) BBC World News BBC Tech News Portal 1 producer My Bookmarks Tip of the Day Xignite producer (www.xignite.com) Stock News Stock Quote Local s Portal 1 Portal 2 Figure 3. Architecture of a portal with local and remote s. Many portals can consume a given remote, and portals can export their local s to other consumers. Stock Quote _ +? v ORCL IBM Symbol SUNW Stock News 1: Click on the Stock Quote Edit button (e) News Add x Stock Quote _ +? v x ORCL IBM SUNW Symbol News Stock Quote _ +? e Symbol Last Change ORCL 13.16-0.02 IBM 93.05-0.47 SUNW 10.07 0.06 Symbol Stock News News Search Figure 4. Example user interaction with a.the user personalizes the Stock Quote by adding a new stock symbol to the list of preferred stocks.the user clicks on the Stock Quote Edit button (e) in the top toolbar, then the Stock Quote Add button, and, finally, the Stock Quote View button (v). Add _ +? e x Stock News _ +? e x 2: Click on the Stock Quote Add button 3: Click on the Stock Quote View button (v) +? e example, Java server pages or ASP.NET). In October 2003, the Java Community Process released the first version of the Java specification (JSR 168), standardizing a Java API for implementing -compatible s that can be deployed in any standard Java container. Web Services for Remote Portlets In the standard, modes refer to the types of functionality a can perform. The standard defines four modes: view, edit, help, and preview. It also defines window states, which indicate the amount of space a will be assigned in the page. Window states can be normal, minimized, maximized, or solo. _ x x Service Interfaces A producer must implement two Web service interfaces service description and markup and may implement two others registration and management. With the service description interface, consumers can discover metadata about the producer (supported custom modes, window states, and so on) and the s it hosts (supported markup types, window title, description, and keywords, for example). The markup interface defines operations for requesting markup generation and for interacting with the markup. The operations getmarkup and performblockinginteraction best represent this interface. Whenever the consumer needs to get the markup of a (for example, when a user accesses a personal page at the beginning of the session), it invokes getmarkup. When the user performs an interaction with a that might result in a change to a shared data area (such as a database), the consumer calls performblocking- Interaction on the. This call is followed by a call to getmarkup on the as well as the remaining s in that page from the same producer, because the change can affect them. When performing an isolated interaction with a, the consumer invokes getmarkup to request the new markup of the. To improve efficiency, the return value of getmarkup can indicate how long (in seconds) the markup can be cached. The registration interface enables a relationship between a consumer and a producer (for billing, for example). A producer providing personalizable s must implement the management interface, which allows creation and destruction of instances, among other things. Each instance represents a unique personalization. Operations Figure 4 illustrates the interactions a user performs with the Stock Quote in a page that also includes the Stock News. I have augmented the Stock Quote interface to include a stock-quote search facility. The user personalizes the Stock Quote by adding a new stock symbol to the list of preferred stocks. Figure 5 shows the remote invocations the portal performs on behalf of the user. Assuming the markup returned by the Stock News is cached, when the user clicks the Stock Quote Edit button, the portal invokes get- Markup (1.1) on the Xignite producer to request the 56 MARCH APRIL 2004 www.computer.org/internet/ IEEE INTERNET COMPUTING

new markup for the Stock Quote. The getmarkup invocation specifies that the should render markup in edit mode and assume a normal window state. When the user adds the new stock symbol, the portal calls performblockinginteraction (2.1) on the Stock Quote, followed by an invocation to getmarkup (2.2 and 2.3) on each. This action modifies the Stock Quote preferences, which could impact the markup generated by the Stock News. Finally, when the user clicks on the Stock Quote s View button, the portal calls getmarkup (3.1) on that, specifying the view mode. Clicking the s Search button would cause an invocation of getmarkup only on that because this action does not modify shared state. It s important to note that the internal URLs a inserts into the generated markup cannot be direct links to the producer. First, the producer s firewall can prevent client browsers from directly accessing the. In addition, the portal creates the final markup returned to client browsers, and it might aggregate the markup of the remaining s in the page (as in the example) or include other information (such as a portal-specific header and footer). Therefore, the internal URLs generated by a must be rewritten, so that they point to the portal rather than to the itself. This way, the portal will intercept user interactions with a given, translating them into appropriate invocations on producers. The standard defines two techniques for URL rewriting, one occurring in the consumer (the consumer rewrites the URLs embedded in the markup generated by the ) and the other in the producer (the consumer indicates to the producer how to generate URLs that point to the consumer). Another interesting issue involves the markup returned by s. To allow s to generate consumer-independent markup, the specification defines a set of standard Cascading Stylesheet (CSS) styles. Portlets should use these styles, and consumers must provide a CSS with concrete definitions for each style, thus achieving a consistent and consumer-specific look-and-feel in the generated pages. 1: Click on the Stock Quote Edit button (e) 2: Click on the Stock Quote Add button 3: Click on the Stock Quote View button (v) Portal 1.1: getmarkup 2.1: performblockinginteraction 2.2: getmarkup 2.3: getmarkup 3.1: getmarkup Figure 5. Interaction between a portal and remote s. The user interactions depicted in Figure 4 cause this sequence of invocations. Java Portlet Specification Similar to servlets, Java s run in a container, a portal server component that provides s with a runtime environment. Although a differs from a servlet, the Java API (javax.) borrows many concepts from the servlet API. In fact, a container is an extension of a servlet container. Likewise, a application is an extension of a Web application, which, apart from servlets, JSP pages, and other static resources (HTML files, images, and so on), also includes one or more s. Figure 6 (next page) shows a code snippet of the Stock Quote implementation. Typically, s are implemented by extending GenericPortlet, which provides a default implementation of the Portlet interface. As in, the API distinguishes between action and render requests. Action requests modify the s state or cause a redirection, and are processed by redefining processaction. The remaining requests are render requests and are processed by the implementation of the render method provided by GenericPortlet. This method in turn invokes dodispatch to dispatch the request to doview, doedit, or dohelp, depending on the selected mode. Only render methods can generate markup using the RenderResponse object. Thus, an action request directed to a is always followed by a render request to the and to the remaining s in the page whose content is not cached. A render request directed to a also causes a Xignite Producer IEEE INTERNET COMPUTING www.computer.org/internet/ MARCH APRIL 2004 57

public class StockQuotePortlet extends GenericPortlet { public void processaction (ActionRequest request, ActionResponse actionresponse) throws PortletException, java.io.ioexception { String command = request.getparameter( command ); if (command.equals( AddStockSymbol )) { addstocksymbol(request); else if (command.equals( StockSymbol )) { removestocksymbol(request); public void doview (RenderRequest request, RenderResponse response) throws PortletException, IOException { String command = request.getparameter( command ); if (command == null) { showpreferredstockquotes(request, response); else if (command.equals( SearchStockQuote )) { showstockquote(request, response); public void doedit (RenderRequest request, RenderResponse response) throws PortletException, IOException { PortletPreferences prefs = request.getpreferences(); String[] stocksymbols = prefs.getvalues( stocksymbols, new String[0]); request.setattribute( stocksymbols, stocksymbols); includehtmlresponse(request, response, /edit.jsp ); Figure 6. Code snippet of the StockQuotePortlet class. This class acts as the application controller: it receives requests, calls on model facade methods, and delegates the content generation to JSP pages. render request to the remaining s in the page whose content is not cached. The implementation of a render method (doview, doedit or dohelp) can delegate markup generation to a JSP or a servlet. In the example in Figure 6, processaction handles requests for adding or removing stock symbols from the list of preferred stocks. Each action is implemented in a helper method, which gets the preferences and modifies the stocksymbols preference. The doview method handles two kinds of render requests: one for printing the preferred stock quotes and another for displaying a quote when a user types the stock symbol in the search form. Again, a helper method implements the processing of each event. For instance, showpreferredstockquotes gets the preferred stock symbols, obtains the stock quote collection by using a facade of the business logic, adds it to the request as an attribute, and includes the content generated by a JSP displaying the stock quotes and the search form. In the same way, doedit gets the array of preferred stock symbols, adds it to the request, and includes the content generated by a JSP page that prints the personalization wizard. To facilitate the creation of action and render URLs from JSPs, the API provides a tag library. This example also suggests the use of the modelview-controller (MVC) architectural pattern to implement applications. The class (controller) receives requests, calls on model facade methods, and delegates content generation to JSP pages (view). Standard-Based Portal Architecture Figure 7 (p. 60) shows the typical architecture of a Java portal server that supports and the 58 MARCH APRIL 2004 www.computer.org/internet/ IEEE INTERNET COMPUTING

private void addstocksymbol(actionrequest request) throws PortletException, IOException { String stocksymbol = request.getparameter( stocksymbol ); PortletPreferences prefs = request.getpreferences(); String[] currentstocksymbols = prefs.getvalues( stocksymbols, new String[0]); String[] newstocksymbols = addtoarray(currentstocksymbols, stocksymbol); prefs.setvalues( stocksymbols, newstocksymbols); prefs.store(); private void showpreferredstockquotes(renderrequest request, RenderResponse response) throws PortletException, IOException { PortletPreferences prefs = request.getpreferences(); String[] stocksymbols = prefs.getvalues( stocksymbols, new String[0]); StockQuoteFacade stockquotefacade = new StockQuoteFacade(); Collection stockquotes = stockquotefacade.findstockquotes(stocksymbols); request.setattribute( stockquotes, stockquotes); includehtmlresponse(request, response, /showstockquotes.jsp ); private void includehtmlresponse(renderrequest request, RenderResponse response, String path) throws PortletException, IOException { response.setcontenttype( text/html ); PortletRequestDispatcher rd = getportletcontext().getrequestdispatcher(path); rd.include(request, response); [...] Figure 6 continued. Java specification. The container component runs applications conforming to the Java API. The portal Web application component implements the portal use cases, such as sign in, sign up, select layout, aggregate responses, and so on. To interact with a, the portal Web application component calls on a specific API provided by the container. The producer component provides an implementation of the interfaces, so other consumers can access local s. The portal server also provides a consumer component, implemented as a Java, that acts as a generic proxy of any producer, allowing the portal to consume remote s. To facilitate the adoption of and the Java specification, the Apache Software Foundation has launched Jakarta Pluto and 4J. Jakarta Pluto is the reference implementation of a Java container and includes a very simple portal Web application component for testing s. 4J builds on Jakarta Pluto, providing a producer and a proxy of a producer. Looking Ahead and the Java specification are in their initial versions. Over the next few years, an increasing number of portals and s will use both standards. Future improvements will emerge to overcome issues not currently addressed by the standard. Some improvements have already been suggested. One such improvement refers to the use of Universal Description, Discovery, and Integration (UDDI) for Web services and electronic business using XML (ebxml) registries in to allow producers to publish information about their IEEE INTERNET COMPUTING www.computer.org/internet/ MARCH APRIL 2004 59

Anumber of interesting resources on portal standards and portal servers are available online. Apache 4J http://ws.apache.org/wsrp4j/ Cover Pages: News http://xml.coverpages.org/wsrp.html Oasis Web Services for Remote Portlets Technical Committee www.oasis-open.org/committees/tc_home. php?wg_abbrev=wsrp Java Portlet Specification Introducing the Portlet Specification, Part 1, S. Hepper and S. Hesmer, JavaWorld, 2003, www.javaworld.com/javaworld/ jw-08-2003/jw-0801-.html Introducing the Portlet Specification, Part 2, S. Hepper and S. Hesmer, JavaWorld, 2003, www.javaworld.com/javaworld/ jw-09-2003/jw-0905-2_p.html Jakarta Pluto http://jakarta.apache.org/pluto/ Jakarta Struts Roadmap http://jakarta.apache.org/struts/ Portal Resources status.html Java Portlet Specification http://jcp.org/aboutjava/community process/final/jsr168/index.html Portlet Open Source Trading (POST) http://sourceforge. net/projects/-opensrc Portal Servers BEA WebLogic Portal www.bea.com/framework.jsp?cnt =index.htm&fp=/content/products/portal Byelatech s portal technology resources (collection of links) www.byelatech.com/resources/portal_resources.asp exo Platform http://exo.sourceforge.net IBM WebSphere Portal www.ibm.com/software/genservers/ portal Jakarta Jetspeed http://jakarta.apache.org/jetspeed/site/ Metadot Portal Server www.metadot.com/metadot/ Microsoft SharePoint Portal Server www.microsoft.com/ sharepoint Oracle Application Server www.oracle.com/appserver Browser Other portals Portal web application producer Portlet container Portlet app. Portlet app. Figure 7. Typical architecture of a Java portal server supporting and the Java specification. The container component runs applications conforming to the Java API while the portal Web application component implements the portal use cases.... consumer Internet/Intranet producer s and portal administrators to find s that meet their needs. Security is another area for improvement. Currently uses only transport-level security mechanisms (such as secure socket layer/transport-layer security, SSL/TLS). The standard will incorporate message-level security mechanisms for Web services Web Services Security (WS-Security), Security Assertion Markup Language (SAML), and so on when they are fully specified and supported. Filters (similar to servlet filters) and eventbased intercommunication are among the future improvements to the Java specification. The specification also will impact current MVC Web frameworks, such as Jakarta Struts. Even though the Java API lets us structure a application according to the MVC pattern, its support is more primitive than current MVC Web frameworks. Because these frameworks assume the servlet API, they ll need adaptation before they re suitable for building applications. In fact, the Jakarta Struts team has announced support for applications in a future version. And finally, -compatible APIs for other languages should appear in the next few years. Reference 1. C. Wege, Portal Server Technology, IEEE Internet Computing, vol. 6, no. 3, 2002, pp. 73 77. Fernando Bellas is an associate professor in the Department of Information and Communications Technologies at the University of A Coruña, Spain. His research interests include Web engineering, aspect-oriented development, and content adaptation for handheld devices. He has a PhD in computer science from University of A Coruña. He is member of the IEEE Computer Society and the ACM. Contact him at fbellas@udc.es. 60 MARCH APRIL 2004 www.computer.org/internet/ IEEE INTERNET COMPUTING