Successfully reported this slideshow.

כנס JBOSS5


Published on

  • Be the first to comment

  • Be the first to like this

כנס JBOSS5

  1. 1. ‫‪SOA for Real‬‬ ‫המוקשים והקשיים שחוויים בפרויקטי‬ ‫‪SOA‬‬ ‫לירן זילכה‬ ‫מנכ"ל משותף‬ ‫‪Aluna‬‬ ‫‪‬‬
  2. 2. Aluna  Israel’s leading Java/JavaEE and SOA consulting company  Customers:
  3. 3. Agenda  SOA Architecture  SOA pitfalls
  4. 4. Using Services Consumer Discover and/or Bind 2 3 invoke Policies XML XML XML Registry SOAP SOAP SOAP 1 CCI CCI CCI register DB ERP CRM Service Service Service
  5. 5. Components To Services  Requires a client  Loose coupling via library ◦ Message exchanges ◦ Policies  Peer-to-peer  Client / Server  Composable  Extendable  Context independent  Stateless  Some overhead  Fast  Medium to coarse  Small to medium granularity granularity
  6. 6. BUSINESS DOMAIN Business Process #1 Business Process #2 Business Business Service Service #2 Business Business #6 Business Business Business Business Service Service Service Service #4 Service #3 Service #1 #4 #5 #5 Business Business Service #7 Service #3 Business Re-usable Business Service Services #4 Business Service Business #5 Service #3 IT DOMAIN Business Service #3 Business Service #5 IT Service IT Service IT Service IT Service IT Service IT Service #1 #2 #3 #2 #4 #3 Re-usable IT Services IT Service IT Service #2 #3
  7. 7. SOA Pitfalls
  8. 8. SOA Misconceptions
  9. 9. Web Services  Is this technology actually delivers?  Many technological problems: ◦ Target client language – effects API  Checked exceptions in C#  Overloading  Documentation/Metadata
  10. 10. Web Services – Current Solutions  Tools that make sure you fit the spec  Extend wsdl.exe, wsgen.exe ◦ To enable R&D naming conventions  Check WSDL 2.0 ◦ No more MessageType ◦ Tag names changes ◦ Otherwise, they would have called it WSDL 1.2
  11. 11. Web Services  Performance
  12. 12. Web Services – Current Solutions  Performance keeps improving  XML level ◦ Make sure your framework is based on pull- parsing  Transport level ◦ Use other transports – Messaging, Binary ◦ Use HTTP, but use keepalive
  13. 13. Web Services  Advanced specs: ◦ Transactions? ◦ Addressing? ◦ Security?
  14. 14. Participants & Transaction aware Web services
  15. 15. Why WS-Security?  We are going to “virtualize” security  If you understand Code Access Security then you understand where security is heading in terms of Web Services ◦ WS-Security conceptualizes the same idea of CAS ◦ “This message carries certain rights…”  Identity, authentication, authorization…
  16. 16. What is security?  Technical ◦ Encryption Composition ◦ Signatures ◦…  Non-Technical ◦ Policies Processing ◦ Trust ◦…
  17. 17. How is security implemented today?  Point-to-Point ◦ Channel  SSL, IPSec ◦ Entry Point  ACLs and Roles  End-to-End ◦ Message Based  XML Web Services
  18. 18. Point-to-Point Security  Cons ◦ Not implemented at the messaging layer ◦ Does not enforce up stream security ◦ Do not natively support non-repudiation ◦ Binds you to a specific transport protocol ◦ Requires additional management  Pros ◦ Broad adoption ◦ Can be implemented in a standards based manner today
  19. 19. End-to-End Security  Cons ◦ Standards are evolving and will be delivered incrementally  Pros ◦ Is implemented at the messaging layer ◦ Enables heterogeneous architecture ◦ Supports non-repudiation ◦ Can be independent of transport
  20. 20. WS-Security  WS-Security describes enhancements to SOAP messaging to provide quality of protection through message integrity, message confidentiality, and single message authentication
  21. 21. WS-Security  A specification for proposed SOAP extensions to be used when building secure Web services ◦ Supercedes the following specifications  SOAP-SEC  Microsoft’s WS-Security, WS-License  IBM’s security token and encryption
  22. 22. WS-Security  What ◦ Enhancements to SOAP ◦ Quality of protection  Integrity  Confidentiality  Authentication ◦ Token Association ◦ Token Encoding ◦ Designed to be composed with other Web service protocols ◦ Is not a complete security solution
  23. 23. WS-Security Token Elements  UsernameToken Element ◦ A means of proving a username and optional password information  BinarySecurityToken Element ◦ A means of including x.509 and Kerberos tickets  SecurityTokenReference Element ◦ A means of providing a set of claims the reside “somewhere”
  24. 24. WS-Security  Goals ◦ Single message security language ◦ Flexible; does not define explicit security protocols  Requirements ◦ Multiple security tokens for authentication and authorization ◦ Multiple trust domains ◦ Multiple encryption technologies ◦ End-to-end message-level security
  25. 25. WS-Addressing  Using SOAP without HTTP  Using A-Synch web services
  26. 26. Goal of WS-Addressing  Aim is to make Web Services to support : ◦ A wide range of transport protocols ◦ Asynchronous communication ◦ Dynamic end point addressing  A small set of tags is defined
  27. 27. Transport Protocol Neutral SOAP Host URI The type of the message being conveyed is SOAP SOAP Action
  28. 28. Transport Protocol Neutral SOAP(II)
  29. 29. Asynchronous Web Services  WSDL defines one-way, request-response, solicit response, and notification messaging behaviours  Normally, when a response is made, it is assumed that this response will be conveyed by the already opened HTTP Channel.  Therefore currently there is no standard support to achieve asynchronous communication between Web Services  WS-Addressing adds <MessageID>, <From>, <ReplyTo>, <FaultTo>, <RelatedTo>
  30. 30. Asynchronous Web Services (II) The address of the sender of the message, the addresses for return reply or fault messages are given current message has id “uuid:someid” and it is related with another message that has id “uuid:someotherid” and the type of the relationship is “Reply”
  31. 31. Endpoints  <From>, <ReplyTo>, <FaultTo> tags convey an “EndpointReference”  Endpoint is any addressable resource to which SOAP message can be sent (Web Service client or application, a SOAP router or any SOAP aware entity  The most logical way to include endpoints is to use WSDL “Service” element, however WSDL does not allow extensibility of this element, therefore EndpointReference is defined.  EndpointReference may be used in WSDL
  32. 32. WS Addressing Constructs  WS-Addressing defines two constructs to convey information that is typically provided by transport protocols and messaging systems: ◦ Endpoint Reference (provides dynamic endpoints) ◦ Message Information Header (provides asynchronous transport neutral comm., )
  33. 33. Fault Codes  Some fault codes are defined (the same logic in HTTP, i.e. 404 file not found)  Fault schema of SOAP is extended  Defined faults: ◦ Endpoint Unavailable, ◦ Action Not Supported, ◦ Destination Unreachable, ◦ Message Information Header Required, ◦ Invalid Message Information Header
  34. 34. Web Services  QA ◦ How do we implement it? ◦ Unit or integration testing?  Who is in charge? ◦ Support matrix:  .NET frameworks – WCF, WSE 2.0…  Java frameworks – AXIS1, AXIS2, JAX-RPC, JAX- WS
  35. 35. Web Services – Current Solutions  Automated testing tools: ◦ SOATest ◦ Actional  Open source testing tools: ◦ Web Service Studio ◦ The Grinder ◦ SoapUI
  36. 36. BPEL  When do we use BPEL and when do we use the ESB?
  37. 37. BPEL – Current Solutions  BPEL is used for business processes  ESB is used to move information  Is that helpful in anyway?
  38. 38. BPEL  Where is the human decisions in the process?
  39. 39. BPEL – Current Solutions  BPEL4People was handed to OASIS (Jan, 2008)  Meanwhile – use extensions
  40. 40. ESB  How many ESBs do you have in your organization?  Are they talking to one another?  What to do inside or outside the ESB?
  41. 41. ESB – Current Solutions  Most ESBs are based on fast messaging and JavaEE Application Servers  The ESB is used to deliver thousands of messages a second. How much code do you want to place in it?
  42. 42. ESB  How do we connect ESB to BPEL?  What else can be placed inside the ESB? ◦ Runtime governance?
  43. 43. ESB – Current Solutions  JBI will become a spec ◦ Take OpenESB for example  In the mean time… BPEL ESB
  44. 44. JBI
  45. 45. Java Business Integration (JBI)  Extends J2EE and J2SE with business integration SPIs (JSR 208).  SPIs enable the creation of a Java business integration environment for specifications such as WSCI, BPEL4WS and the W3C Choreography Working Group. 45
  46. 46. Java Business Integration (JBI)  Employs concepts similar to J2EE to extend application packaging and deployment functionality to include JBI Components.  JBI Components are an open-ended class of components that are based on JBI abstract business process metadata.  46
  47. 47. JBI Roles  Integration Architect. This user designs the overall approach to solving integration problems. This includes selecting JBI components used to provide connectivity and business logic.  Integration Technologist. This user devises the particular services needed to solve an integration problem and configures a JBI system to integrate those services.  System Administrator. This user installs, configures, monitors, and tunes the JBI system so that it provides the designed integration services.  JBI Component Developer. JBI components can be created by users or third parties. In either case, the developer of JBI plug-ins must provide Java components that conform to the JBI specification. 47
  48. 48. Steps In Developing A Service  Creation of the service: A developer creates services either from scratch or from existing implementations of services. Packed into Service Units.  Orchestration of the service (optional step): Then either the developer or the integration architect/technologist composes the services using an orchestration engine.  Creation of the Service Assembly: The developer or integration architect/technologist then determines how to provide access to these internal services, as well as to any external services on which they depend. I.e., Binding Components must be selected and then configured for both inbound and outbound access. After configuration, a Service Unit must be created for each required Binding Component. The various Service Units for the Service Engines and Binding Components are then packaged into a Service Assembly.  Deployment of the Service Assembly. 48
  49. 49. Orchestration Transformation Other Service (BPEL) (XSLT) J2EE Engines Logger WSDL WSDL WSDL WSDL System Management JBI Core Discovery & Deployment Services Normalized Message Service Installation Deployment Management Component Registry Console Admin. WSDL WSDL WSDL WSDL WS-I Basic + Other JMS Filesystem Basic Security Bindings J2SE/J2EE SOAP SOAP JMS WSDL WSDL WSDL Service Service Service 1 2 3
  50. 50. Orchestration Transformation Other Service (BPEL) (XSLT) J2EE Engines Logger WSD WSDL WSDL WSDL L System Management JBI Core Discovery & Deployment Services Installation Deployment Management Component Registry Console Admin. WSDL WSDL WSDL WSDL WS-I Basic + Other Basic Security JMS Filesystem Bindings J2SE/J2EE SOAP SOAP JMS WSDL WSDL WSDL SOA Composite Service 1 Service 2 Service 3 App Descriptor Application Element Artifact Service Orchestration BPEL Data Transformation XSLT Service 1 WSDL Service 2 WSDL Service 3 WSDL
  51. 51. ESB  Can we bundle an ESB inside our product? ◦ Most ESBs are point-to-point based ◦ Adding a service requires updating the ESB itself
  52. 52. ESB – Current Solutions  Extending the ESB in code  Writing dispatcher code inside the ESB ◦ See the Router pattern in the next presentation
  53. 53. Governance  Ever heard of someone who actually did it?
  54. 54. Governance – Current Solutions  New concept, but still ◦ You must have governance ◦ Know what services you have ◦ Make sure they are documented, fit company procedures, etc
  55. 55. A scenario on the importance of SOA governance Finance Sales Legal Currency Service Order Fulfillment Purchasing 1. All groups plan 2. Service defined 4. Success metrics 3. Service enabled a re-usable that meets defined, monitored to be available currency service everyone’s needs to confirm service to all LOBs scalability
  56. 56. 14 Critical Processes That Constitute an Effective SOA Governance Model Implementation Service Service Service Service Planning Modeling Implementation Management Define Service Identify Services Design Services Manage Quality of Focus Process Process Process Service Process Identify Service Specify Services Assemble Manage Service Owners Process Process Services Process Levels Process Define Service Realize Services Test Services Manage Service Funding Process Process Process Change Process Deploy Services Manage Service Process Security Process Establishing decision rights By effectively establishing governance mechanisms in these 14 areas, clients Defining high value business services can address these common challenges: Managing the lifecycle of assets Measuring effectiveness
  57. 57. Service Lifecycle Management is essential in the realization of SOA Governance Service Lifecycle Management Service Development Infrastructure and and Delivery Management Management In Support of SOA Enforce, execute, automate Monitor and control process and policies operational policies SOA Governance SOA Governance Method Establish Process and Policies
  58. 58. Establish the Governance Need Define the Governance Approach • Document and validate business strategy for SOA and IT • Define/modify Governance Processes SOA Governance Method • Assess current IT and SOA capabilities • Design policies and enforcement mechanisms • Define/Refine SOA vision and strategy • Identify success factors, mechanisms • Review current Governance capabilities and arrangements • Identify owners and funding model • Layout Governance plan • Charter/refine SOA Center of Excellence • Design Governance IT infrastructure Deploy the Governance Model Incrementally Monitor and Manage the Governance Processes • Deploy Governance mechanisms • Monitor compliance with policies • Deploy Governance IT infrastructure • Monitor compliance with governance arrangements • Educate and deploy on expected behaviors and practices • Monitor IT effectiveness metrics • Deploy policies
  59. 59. Q&A