Oracle API Platform Cloud Service Best Practices & Lessons Learnt

PaaS Community Forum
Oracle API Platform Best Practices & Lessons Learnt
Split, March 2017
Luis Weir
luis.weir@capgemini.com
uk.linkedin.com/in/lweir
@luisw19
www.soa4u.co.uk

2Copyright © Capgemini and Sogeti 2016. All Rights Reserved
APIs are great ……But can result in a lot of ad-hoc mess if APIs are not managed…

API Management
Planning
Design
Implementation
Publication
Operation
Consumption
Maintenance
Retirement
API

API Platform Cloud Service *new cloud service (not the previous solution)
Cloud and on-premise API creation, publishing and management
Key Features
• API visibility in the cloud: API Platform provides visibility to APIs
through a cloud-based portal
• Protects backend services : API Gateways deployed on-prem or
on any cloud protects backend systems and services by
providing a robust security layer
• Supports on-premise and cloud-based services : APIs can
virtualise both cloud and on-premise services
Benefits
• Easily expose APIs to internal and external consumers
• Provides security to protect backend systems
• Rapid and fully automated provisioning
• Secure, highly available with clustering
API Platform

Why APIPCS?
We evaluated against
other major players
(IBM, Mule) and
results were
impressive
3rd Generation:
Native hybrid model
(APIs anywhere) –
suitable for Canon’s
on-premise API
gateway Microservice oriented
with support for
micro-gateway
Best licensing
model based on the
market. Based on
logical gateways –
not CPUs
Best API-first
capability on the
market
(APIary)

Steps to success!
1) Discover 2) Architect
3)
Install/Configure
4) Define Use
Case/Prototype
5) Conclusions

Steps to success
Discovery: identify the needs and drivers for API management. Conduct discovery workshops with
business t& IT. Idea is to create a backlog of needs and identify existing assets1
1 2 3 4 5

Discovery workshops and outcomes
Business Stakeholders
• Identify key stake holders (i.e.
Finance, HR, etc)
• Prepare questions to understand
their needs i.e.
• Need to access up to date data
in real time?
• Mobile apps or web-apps need
access to backend data?
• Need to understand who
access the data?
• Partners need access to data
(i.e. product info?)
• Volumes (from business point
ov view)
IT Stakeholders
• Understand what related
infrastructure is available (i.e.
SOA Suite, OSB, etc)
• Identify what APIs (SOAP or
REST) exists and their usage
• Understand connectivity
challenges specially around
access to data from different
places (i.e. cloud to on-premise)
• Understand non-functional
requirements
Outcomes
• Gather all needs and classify
them –basically a backlog
• Create a catalogue of existing
APIs (spreadsheet nothing
fancy) if not already available
• Expected business value of
APIs. This should be used as a
success factor of the initiative
1 2 3 4 5

Steps to success
business t& IT. Idea is to create a backlog of needs and identify existing assets
Architecture and SDLC: Create a reference architecture (conceptual, logical, physical) and define your
environment strategy as well. Also define your SDLC (process / tools / roles)
1
2
1 2 3 4 5

SaaS
API Applications
Finance SCM Legacy, etc CX HCM, etc
Business APIs
Single Purpose APIs Utility APIs
Identity
Logging
Error
Handing
Notifications
Management &
Collaboration
Design &
Development
Portals
Policy Definition
Lifecycle
Management
Runtime
Analytics
User Management
SYSTEMS OF ENGAGEMENT
Mobile Devices APIs Presentation APIs Partner [B2B] APIsPublic [Consumer] APIs
Microservices
SYSTEMS OF RECORDS SYSTEMS OF INNOVATION
SYSTEMSOFDIFFERENTIATION
System APIs System APIs System APIs System APIs System APIs
Message Pipe
API Reference Architecture
1 2 3 4 5

RUNTIMEDESIGN TIME & OPS
API RegistryAPI Design &
Development Portal
API-First Design
Console
ADL Programmatic
Validation
API Approval
Workflow
API Dynamic
Documentation
API Discovery &
Subscriptions
API Applications &
Keys Generation
Developer On-
boarding
Community
Collaboration
Resource
Registratio
n
Resource
Discovery
K/V Storage
K/V
Replication
Resource
Health
Status
Registry API
API Management
Console
API Lifecycle
Management
Policy Definition
Runtime
Monitoring
Runtime Analytics
API Gateway
Management
Policy Definition
User & Role
Management
Keys Management
Utility APIs
Identity
Federation
Identity
Mappings
Error
Handling
Logging
Alerts &
Nots
Managemen
t APIs
Delivery
Version Control Deployment Continuous Testing
Release
Management
Continuous
Integration
Team Management Team Collaboration Issue Tracking Spring Boards
Message Pipe
Message Routing Topics/Queues Reliable Messaging Queuing/De-queuing Circuit breaker / Throttling
Single Purpose APIs
Federated
AuthN/AuthZ
API Key Validation Call Aggregation Tailored Contracts Thread Protection
Thread Protection
Client Backend Logic
Scripting
Embedded API
Application
Push
Nots/Websockets
Polyglot Consumer
SDKs
Business APIs
AuthN / AuthZ Key Validation Policy Enforcement HTTP Routing In-Mem Cache
Rate Plans / Limits Throttling Throttling Streaming
REST/SOAP
Conversions
MicroservicesAPI Applications
Basic AuthN Orchestration Business Logic
Data
Transformation
Protocol
Conversion
Connectivity
Polyglot
Programming
Polyglot
Persistency
Choreography /
Event Collab.
Business Logic
Stack
Independence
Auto Scaling
OMESA Reference Architecture – Capability Model
1 2 3 4 5

API Reference Architecture – Product Mapping
API RegistryAPI Design &
Development Portal
API Management
Console
Utility APIs
Delivery
Message Pipe
Single Purpose APIs
Business APIs
MicroservicesAPI Applications
Eureka
REGISTRATOR
IoT App. Container Java ProcessMobile
API Platform Cloud
RuntimeDesign Time & OpsAPIPCS OOTB InteroperabilityOracle PaaS Cloud Services
App. ContainerJavaSOA Integration Container DB NoSQL MySQL
Integration Messaging Event Hub
Public SaaS
API Catalog
API Platform
Developer
Portal
Identity
Cloud
Logs
Analytics
Application
Performance
Monitoring
Developer Cloud Developer Cloud Orchestration
API Platform
Management
Service
1 2 3 4 5
optional

Oracle Cloud PaaS – Capability Comparison
** Only when combined with Developer Cloud
Capability API Platform Mobile Cloud SOA Cloud** Integration Cloud Java Cloud** App. Cont. Cloud**
E2E API lifecycle (design, mock, build, test, publish, manage, monitor)
Hybrid deployment (cloud/on-prem) –native (installed via cloud)
Rich API focused ops and analytics
REST/JSON end to end
API policies definition & enforcement
Authentication & Authorization
Identity federation support (ie. OAuth 2.0)
API keys management and enforcement
Backend (platform) APIs (ie. Push nots, storage, data sync, etc)
WebSockets
HTTP Routing (declarative)
Data transformation (declarative)
Protocol conversion (declarative)
Call aggregation (declarative)
Orchestrations (declarative)
Custom scripting
Connectivity to several sources (excluding pure REST/SOAP)
Polyglot programming
Light footprint
Full Mostly Some or Custom (libs &| imperative) No supportPartly
1 2 3 4 5

Cloud
On-premises
Oracle APIPCS Implementation Architecture
External Firewall
Internal Firewall
External API
Gateway
Internal API
Gateway
Internet ProxyExternal API
Gateway
Internal API
Gateway
Existing SOA
Infrastructure
API Applications &
Microservices
External Load Balancer
Registry
Register, de-
register, health
check, etc
Get endpoints
IP
i.e.
ADFS/LDAP
IP
i.e.
ADFS/LDAP
PaaS
DBaaS
iPaaS
ExternalAPI
Gateway
ExternalAPI
Gateway
LoadBalancer
Identity as a Service
SaaS
CloudFirewall
LG
Cloud
APIApplications&
Microservices
§ Sends stats
§ Pulls deployments
Cloud PaaS
Management
ConsoleDeveloper Portal
API Platform
Discover, Try,
Use
Application
Developers
API Platform
Admins
Install,
manage
gateways,
manage
users &
grants
API Designers &
Developers
Publish &
discover,
manage,
monitor
APIs
LG = Logical gateway
SP = Single purpose
IP = Identity provider
Mobile Backend
Mobile (SP)
API
Business
API
Business
API
Mobile
App
LG Ext.
LG Int.
1 2 3 4 5

Cloud
CDN (i.e. AKAMI)
On-premises
Oracle APIPCS Implementation Architecture
External Firewall
Internal Firewall
External API
Gateway
Internal API
Gateway
Cloud PaaS
Management
Console
Internet ProxyExternal API
Gateway
Internal API
Gateway
Existing SOA
Infrastructure
API Applications &
Microservices
Registry
Register, de-
register, health
check, etc
Get endpoints
IP
i.e.
ADFS/LDAP
IP
i.e.
ADFS/LDAP
PaaS
DBaaS
ExternalAPI
Gateway
ExternalAPI
Gateway
LoadBalancer
Identity as a Service
SaaS
CloudFirewall
LG Ext.
LG Int.
LG
Cloud
APIApplications&
Microservices
Developer Portal
API Platform
§ Sends stats
§ Pulls deployments
Discover, Try,
Use
Application
Developers
LG = Logical gateway
SP = Single purpose
IP = Identity provider
Business
Partners
Public (SP)
API
iPaaS
Community
Apps
Partner (SP)
API
API Platform
Admins
Install,
manage
gateways,
manage
users &
grants
API Designers &
Developers
Publish &
discover,
manage,
monitor
APIs
1 2 3 4 5

Deployment Framework
Environment Strategy & Deployment Process
Tools
> Dreed, Circle CI
Development/Test
Management
API Platform Instance 1 (non-prod)
Platform APIs
Development Logical
gateways
Test Logical gateways
Management
API Platform Instance 1 (pre-prod)
Platform APIs
Pre-production
Pre-production
Logical gateways
Management
API Platform Instance 1 (prod)
Platform APIs
Production
Production Logical
gateways
Retrieve API details Version Control API Check out
Deploy (create new
API)
Change properties
(ie. Endpoints)
Test
1 2 3 4 5

API {First} Design
APIM Designer
Portal
8) Feedback
13) Evaluates
14) No changes
7) Evaluates
5) Creates API definition
12) Submits final definition
(Github pull request)
9) Updates definition
4) Opens API editor
1) Enters APIM Dev Portal
2) Searches API catalogue
3) No match
11) Thumbs up!
10) Evaluates
Assertions
checks
Assertions
checks
15) Set-up continuous test
6) Creates mockup & shares URL
> Dreed, Circle CI
16) Implements API
17) Requests deploy 18) Gets request
19) Approves
API
Gateway
API Gateway
DMZ
API
Gateway
Management
Console
API Platform Cloud
API Designer
API Developer
API Consumer
Developer
Architects
API Developers
API Gateway
Admin
Developer
Portal
API Platform Cloud
1 2 3 4 5

Steps to success
1
2
Installation/configuration tips: recommendations based on lessons learnt3
1 2 3 4 5

Installation Steps
Purchase/Create
APIPCS and
Apiary instances
Create your user
accounts
Download
gateway binaries
Install/configure
the gateways
Post-
configuration in
management
service
1 2 3 4 5

Installation Tip 1: Installations takes too long and times out
§ This is usually caused because there isn’t enough entropy
(randomness) in the operating systems to complete the Weblogic
domain creation/configuration. To fix this:
I) Check entropy level with command:
tail -f /proc/sys/kernel/random/entropy_avail
II) If result is low(i.e. <100) then there isn’t enough randomness hence
why it’s taking low. To fix ths you can run following comamnd:
export CONFIG_JVM_ARGS=-Djava.security.egd=file:/dev/./random
NOTE: This shouldn’t be done in production environments. So if your production
instances have low entropy levels contact your OS admins so issue can be resolved.
Good article below on how this issue can be resolved (thanks to Martien van den)
1 2 3 4 5
https://www.certdepot.net/rhel7-get-started-random-number-generator/

Installation Tip 2: Get the gateway-props.json values right
§ Getting the value settings of gateway-props.json wrong can result in a number of issues (i.e. wrong ports
being used, wrong IPs, etc)
§ Most importantly, there are several properties that can be entered in gateway-props.json. Try and include the
minimum as required as any value entered will override the default values available in gateway-master.json
which can result in conflicts later on.
§ Below a sample that worked for us:
{
"gatewayInstallDir" : "/opt/oracle/gateway>",
"logicalGateway" : “<logical gateway name“,
"gatewayNodeName" : “<physical gateway name> ”,
"managementServerHost" : "http://<management portal host name>",
"managementServerPort" : "<management portal port>",
"proxyHost" : "<proxy host>" ,
"proxyPort" : "<proxy port>" ,
"nonProxyHosts" : "localhost",
"oauthProfileLocation" : "<oauth profil file name location>",
"listenIpAddress" : "<listen ip address>",
"publishAddress" : "<publish ip address>",
"phoneHomeProxy":["http://<proxy host>:<proxy port>","https://<proxy
host>:<proxy port>"],
"nodeProxy" : ["http://<proxy host>:<proxy port>","https://<porxy
host>:<proxy port>"],
"analyticsManagementUrl" : "http://<analytics host>:<port>",
"registryManagementUrl" : "http://<registry host>:<port>",
"gatewayExecutionMode": "Development",
"loadBalancerUrl": ["<lburl1>","<lburl2>"]
}
1 2 3 4 5

Installation Tip 3: Create all gateway admin users prior installing and have
credentials at hand!
§ Be aware of the users required during installation:
• Weblogic user (for local gateway -not management service) : the WebLogic administrator user of the gateway node.
This user is created when you run this action. The user is stored in the gateway domain’s local LDAP. When running
other actions on this node, you must supply these credentials
• Gateway manager (in management service): the Gateway Manager user that is responsible for managing this
gateway. This user must already exist on the Management Portal. This user is issued the Manage Gateway grant when
the gateway is created
• Gateway runtime user (in management service): the Gateway Runtime user that is used to download configuration
from and upload statistics to the gateway. This user must already exist on the Management Portal. This user is issued
the Node Service Account grant when the gateway is created
§ Create the gateway manager and gateway runtime users before starting installation
1 2 3 4 5

Installation Tip 4: Start with step by step installation and then automate
§ It is possible to do a full installation of a gateway by simply running the command:
./APIGateway -f gateway-props.json -a install-configure-start-create-join
§ However doing so will prevent you from fully understanding the installation process and trouble shoot
effectively if you run into issues. Better to execute the commands in the following order:
I. Install gateway binaries: ./APIGateway -f gateway-props.json -a install
II. Configure gateway Weblogic domain: ./APIGateway -f gateway-props.json -a configure
III. Start the gateway: ./APIGateway -f gateway-props.json -a start
IV. Create a new logical gateway in the management service: ./APIGateway -f gateway-props.json -a create
V. Join a logical gateway in the management service: ./APIGateway -f gateway-props.json -a join
1 2 3 4 5

Installation Tip 5: Join won’t happy due to certificate issues
§ This can happen if the certificate used by the management service is not trusted by your local keystore (i.e. in
a BETA version our management service URL was an IP and not a standard cloud URI)
§ This issue can be resolved by manually downloading the certificate of the management service and then
adding it to the local keystore (in our case we added it to the main JRE keystore but there might be a better
way)
§ We did this as following:
To obtain the server certificate:
openssl s_client -connect <URL to API platform management service> -showcerts > api.cert
To add the certificate into the keystore:
keytool -keystore </path to JRE keystore> -import -file ./api.cert
Then restart the gateway and try to join again
1 2 3 4 5

Tip 6: Don’t lockdown the gateway unless you’re sure is right!
§ Once the lockdown command is executed (below) there is no straight forward way to unlock
./APIGateway -f gateway-props.json -a lockdown
§ For development and test instances perhaps best not to lockdown
1 2 3 4 5

Steps to success
Use case definitions and prototyping4
1
2
1 2 3 4 5

Service Cloud searches on-premises customer master through existing SOAP
web service
API Gateway
Oracle SOA Suite
ACS
Mediator
DB
Adapter
Cloud SaaS
Service Cloud
APIPlatform
Presentation API
Validate
API-Key
Limits &
throttle
User
AuthN
SOAP-
REST
Respond
Management
Console
API Platform
Cloud PaaS
§ Sends stats
§ Pulls
deployments
Customer
Data Hub
PLSQL
EBS
{json} {json}
<soap><soap>
0) Customer Service Agent conducts a search in Service Cloud to
service for a specific customer (ie. Based on first and last name)
1
2
4
7
1) Service Cloud triggers a call to an API exposed in a DMZ
(i.e. https://myorg.com/customers?name=luis&lastname=weir)
2) The API gateway receives the request, validates the API key and user credentials
(ie. OAuth 2.0), enforces limit/throttling policies and then converts the payload into
SOAP to invoke the business service exposed by SOA Suite internally
Mediator BPEL
WS
Adapter
6
3
5
sqlnet
DMZ
3) Typically an enterprise business service (EBS) in SOA Suite will just route the
request to the relevant application connector service service also in SOA Suite
4) The ACS will transform the request from a canonical model into the application
format and via the adapter (ie. Database) will connect to the system of record and
conduct the search in any given protocol (ie. SQLNET)
5) The request is converted back into a canonical model and send back to the invoker
service
6) A SOAP response in canonical model is send back to the API Gateway
7) A policy converts back the SOAP payload into JSON (most likely removing fields
that are not required by the consumer system) and sends back the JSON payload
https
1 2 3 4 5

Steps to success
Use case definitions and prototyping4
1
2
Conclusions5
1 2 3 4 5

Understand the requirements. Listen to
the needs
• Make sure you understand the real business and technical
(IT) needs for API
• Don’t boil the ocean. Identify assets that can be reuse (i.e.
SOAP services) and API-enable them
• Elaborate a clear view of expected business benefits and
deliver them (i.e. revenue generation via APIs)
Define the right architecture for your
requirements
• Get inspiration from other architectures (OMESA), but one
size doesn’t fit all. Define an architecture right for your
needs
• Define your environment strategy suitable for your
landscape including process/tools to promote APIs
• Define a clear SDLC –APIfirst based
Learn from our experience and share your
own!
• Get gateway-props.json right
• Be watchful of potential entropy related issues
• Better to install one step at the time at the beginning
• Be watchful of potential security certificate related issues
Conclusions
1 2 3 4 5

Thank you!! … and remember:
“With great APIs
comes great
responsibility”
1 2 3 4 5

The information contained in this presentation is proprietary.
Copyright © 2016 Capgemini and Sogeti. All rights reserved.
Rightshore® is a trademark belonging to Capgemini.
www.capgemini.com
www.sogeti.com
About Capgemini and Sogeti
With more than 180,000 people in over 40 countries, Capgemini is a global leader in
consulting, technology and outsourcing services. The Group reported 2015 global
revenues of EUR 11.9 billion. Together with its clients, Capgemini creates and delivers
business, technology and digital solutions that fit their needs, enabling them to achieve
innovation and competitiveness. A deeply multicultural organization, Capgemini has
developed its own way of working, the Collaborative Business Experience™, and
draws on Rightshore®, its worldwide delivery model.
Learn more about us at www.capgemini.com.
Sogeti is a leading provider of technology and software testing,
specializing in Application, Infrastructure and Engineering Services.
Sogeti offers cutting-edge solutions around Testing, Business
Intelligence & Analytics, Mobile, Cloud and Cyber Security. Sogeti
brings together more than 23,000 professionals in 15 countries and has
a strong local presence in over 100 locations in Europe, USA and India.
Sogeti is a wholly-owned subsidiary of Cap Gemini S.A., listed on the
Paris Stock Exchange.

Oracle API Platform Cloud Service Best Practices & Lessons Learnt

More Related Content

What's hot

Similar to Oracle API Platform Cloud Service Best Practices & Lessons Learnt

More from luisw19

Recently uploaded

Oracle API Platform Cloud Service Best Practices & Lessons Learnt