Bendigo and Adelaide Bank has reduced time-to-market and improved agility by implementing cloud native applications for its customers and staff. These have been built using a combination of BlueMix Dedicated, BlueMix Public and on-premises IBM API Management v4. This combination has been augmented with a lean team that is able to reduce the time-to-market from months to weeks. This presentation describes the patterns used to implement various hybrid cloud applications in this enterprise environment.

1. Bendigo and Adelaide Bank Uses Hybrid
BlueMix and API Management Patterns to
Reduce Time-to-Market
IBM InterConnect 2016
Paul Winters, Director, Syntegrity Solutions
paul.winters@syntegrity.com.au
Ash Austin, Senior Midrange Systems Specialist, Bendigo and
Adelaide Bank
Ash.Austin@bendigoadelaide.com.au

2. Agenda
• Business drivers
• System context: BlueMix Public, BlueMix
Dedicated and IBM API Management
• Security controls
• Reusable and Secure Patterns

3. Business Drivers
New digital projects too slow and
expensive
Inability to deliver innovative business
initiatives to customers
New disruptive competitors
Heavy regulatory environment
Increasing use of third-party developers
and partnerships

4. System Context
Public BlueMix
System of
Engagement
IBM API
Management
[inc. DataPower]
Customers
and Staff
Dedicated BlueMix
System of Engagement
ESB and
Core
Banking
Systems of
Record
Bendigo Datacenter
IBM SecurityAccess
Manager
[inc. WebSEAL]
Microsoft Active Directory
Federation Services
IBM API
Management
Third
Party
Website
Staff

5. Security Controls
IBM API
Management Runtime
IBM DataPower
Firewalls Load balancers
Microsoft ADFS and
AD
IBM Security Access
Manager and ISDS
Identity Layer
Access Layer
Network Layer
IBM API
Management
WebSEAL

6. Unauthenticated Public Website Access
Public BlueMix
IBM API
Management
Customers
and Staff
Dedicated BlueMix
ESB and
Core
Systems
Bendigo Datacenter
IBM SecurityAccess
Manager
Microsoft Active Directory
Federation Services
Third
Party
Website
IBM API
Management

7. Authenticated Website Access for Staff
Public BlueMix
IBM API
Management
Staff
ESB and
Core
Systems
Bendigo Datacenter
IBM SecurityAccess
Manager
ADFS
Third
Party
Website
IBM API
Management
Staff
Dedicated BlueMix

8. Public API with Application ID
Public BlueMix
IBM API
Management
Dedicated BlueMix
ESB and
Core
Systems
Bendigo Datacenter
IBM SecurityAccess
Manager
Microsoft Active Directory
Federation Services
Third
Party
Website
Customers
and Staff
IBM API
Management

9. Secure API with Application ID
IBM API
Management
Dedicated BlueMix
ESB and
Core
Systems
Bendigo Datacenter
IBM SecurityAccess
Manager
Microsoft Active Directory
Federation Services
Customers
and Staff
Third
Party
Website
IBM API
Management
Public BlueMix
System of
Engagement

10. Secure Web Application Access for Staff
Public BlueMix
IBM
DataPower
Staff
Dedicated BlueMix
ESB and
Core
Systems
Bendigo Datacenter
Microsoft Active Directory
Federation Services
IBM SecurityAccess
Manager
Third
Party
Website
IBM API
Management

11. Pulling it all together: an example using
multiple patterns
IBM API
Management
Staff
Admin application
running on Meteor
.NET
system of
record
Bendigo Datacenter
Microservice built
with Express and
Compose.io
MongoDB
ADFS
WebSEAL
NodeJS Web
Server
Third
Party
Website
IBM API
Management
Customers

12. Secure API with User Authentication
[Work in Progress]
IBM API
Management
Dedicated BlueMix
ESB and
Core
Systems
Bendigo Datacenter
Federated Identity
Management
Microsoft Active Directory
Federation Services
Customers
and Staff
Third
Party
Website
IBM API
Management
Public BlueMix

13. Summary
Implemented BlueMix Public,
BlueMix Dedicated and IBM API
Management
A need to improve time-to-
market and reduce cost
A set of repeatable secure patterns are
being used that fit most scenarios

14. For more information check out these sessions:
• 6371A(Inner Circle): Transforming for Rapid Innovation:
The Bendigo and Adelaide Bank Story
• CCD-5407:Borderless Hybrid Applications on Bluemix
Public, Dedicated and Local
• HAM-3190:Citi Transforming IT: Connecting Mobile and
Cloud Applications to Systems of Record through APIs
• HAM-6355: Secure Gateways in Banking: Real-Life Scenarios
at Sberbank