Claus von Riegen, SAP AG WS-Policy Overview W3C Workshop on Constraints and Capabilities for Web Services

WS-PolicyAttachment Outlook Where we are coming from WS-Policy

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 3 Web Services Model CreatePurchaseOrderRequest CreatePurchaseOrderResponse Provider Consumer Broker (UDDI) Create Purchase Order SOAP/HTTP PublishService FindService PublishServiceMetadata (e.g. WSDL location) FindServiceResponse FindServiceRequest

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 4 Requirements for a Web services policy language Expressiveness Describe any Web service constraint and capability Carry parameters Provide mechanism to specify compositions and alternatives Robustness Don‘t change whenever new Web service constraints and capabilities are developed Composeability Attach policy to WSDL elements and UDDI entities Associate policy with WS-Addressing Endpoint References Non-Goals Domain-specific policy attributes Policy exchange model

WS-PolicyAttachment Outlook Where we are coming from WS-Policy

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / „Policy Normal Form“ WS-Policy Information Model Policy Expression Collection of alternatives („pick one“) Policy Alternative Collection of assertions („do all“) Policy Assertion Domain-specific behavior

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 7 Compact Form – Nested Operators and operators can be nested arbitrarily Transformation to normal form using set theory (commutativity, associativity, idempotency, distributivity) Example distributes over  Is equivalent to

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 8 Compact Form – Optional Attribute Assertions may carry the wsp:Optional attribute An alternative with and an alternative without the assertion Simplification of prior wsp:Usage attribute Example...  Is equivalent to

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 9 Compact Form – Reference Mechanism URI-based policy identification mechanism wsu:ID attribute is used to specify a fragment identifier element to reuse common expressions Included as is where referenced wsse:X509v3

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 10 Intersection Do two Web service endpoints have compatible policy? At design time to “wire together” compatible services At runtime to select compatible options (see next slide) Compatibility of alternatives It is necessary that alternatives at least have the same assertion types Assertion-specific intersection needs to be determined per assertion type ? ?

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 11 Runtime Intersection RequesterProvider Get Metadata (To: P)' To: P R out P in Intersect Alternative Apply Validate Policy used by R to send messages out Policy used by P to receive messages in

WS-PolicyAttachment Outlook Where we are coming from WS-Policy

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 13 Web Services Policy Attachment (WS-PolicyAttachment) Association of policies with Web service subjects Subject type Arbitrary XML elements WSDL elements UDDI entities Association type Internal association (see next slide) External association  PolicyAttachment associates policy to domain expressions (identified by URI)  Domain expression can be WS-Addressing endpoint ref. + ( | ) +

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 14 Attaching Policy to WSDL and UDDI WSDL Policy references are made via global attributes or PolicyReference element as defined in WS-Policy Policy references can be made to policy expressions defined inline, e.g. in wsdl:definitions section UDDI Policy references are made via UDDI categorization mechanism Policy expressions are always remote to UDDI entities Reusable policy expressions can be registered as distinct tModels Policy-based discovery is limited to policy expression URIs Policy WSDL P UDDI Policy UDDI Policy

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 15 Effective Policy Calculation WSDL Policy is merged from abstract to concrete levels Policy mergedServicePolicySubjectEndpointPolicySubjectOperationPolicySubjectMessagePolicySubject

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 16 Merging Example... StockQuoteSoapBinding Policy = "RM" & "AUDIT" GetLastTradePriceRequest Input Binding Policy = "DSIG" & "TOK"

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 17 Policy Subject Types Message Policy CreatePurchaseOrderRequest CreatePurchaseOrderResponse CreatePurchaseOrder GetProductCatalogRequest GetProductCatalogResponse GetProductCatalog SOAP/HTTP SMTP SOAP/HTTP Provider Policy Service Policy Endpoint Policy Operation Policy ProviderRequester

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 18 Policy Assertions Policy assertions are domain-specific Strongly typed  Separate XML schema (syntax) and specification (semantics) Arbitrary nested structure of XML elements and attributes  Allows modeling of domain-specific complexity Separate namespace Assertion complexity Simple assertions Parameterized assertions Consequence for policy processors Support WS-Policy syntax directly Delegate policy assertion processing to assertion-specific handlers  Assertion-specific intersection, merge, and validation

WS-PolicyAttachment Outlook Where we are coming from WS-Policy

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 20 Policy Exchange Peer-to-peer Consumer retrieves policy from provider (e.g. WS-MetadataExchange) Brokered approach Provider publishes policy to broker (e.g. UDDI) Consumers subscribe to Web services used Broker notifies consumers in case changes occur ProviderConsumer P Broker Consumer P'

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 21 WS-Policy Roadmap Republished September 2004 WS-Policy & WS-PolicyAttachments Initial Interoperability Testing  Merging, Intersection, Normalization, Effective Policy Calculation  Live endpoints available Next steps Demonstrate Interoperability enabled by WS-Policy  Using domain-specific scenario Co-authors will develop a standardization plan  WS-Policy is already published with royalty-free licensing terms  WS-Policy will be submitted to a standards body

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 22 Q&A

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 23 Appendix

 SAP AG 2004, WS-Policy Overview / C. v. Riegen / 24 A Business Scenario CPG manufacturers and retailers agree to implement a VMI scenario VMI (Vendor Managed Inventory) means that The manufacturer is responsible for the retailer‘s stock replenishment The retailer has to send sales figures and stock levels regularly to the manufacturer The manufacturer can only guarantee appropriate replenishment, if the retailer sends sales figures and stock levels at a certain frequency The frequency depends on the merchandise category a given product belongs to: Eggs: daily Sugar: weekly