1. Web Services Overview and Trends David Purcell MnSCU OoC IT

2. Introduction - Purpose of Presentation Introduce a Service Oriented Architecture Introduce Web Services Review/Explain Technical Details Discuss Different Types of Services Discuss Implementation Challenges with Web Services

3. Web Services and SOA Service-Oriented Architecture - What is It?  Unit of work = Service  Centralized data access/business logic encapsulated by Service Provider  Loose couplings between systems  Reusable services that can serve many needs  Applications can be assembled, rather than built

4. Web Services

5. A way to implement a SOA Mechanism for application-to-application communication (integration!) Uses standard protocols and languages: Typically HTTP and XML Independent of programming language Two main types: SOAP and REST

6. SOAP Web Services SOAP – an XML language for encapsulating messages  What service to invoke  Message contents (input parameters and response info)  Auxiliary information about the sender, errors, etc. Programmers use tools to make SOAP calls (Don’t code SOAP by hand) Self-Describing: Description of Service using wsdl* Many extensions to SOAP are proposed to cover technical challenges (security, etc.) Two main types: RPC and Document

7. SOAP Service Types RPC (Remote Procedural Call) Remote call – Programmer calls a ‘function’ Most Common MnSCU services are currently RPC style Advantages:  Easier to create, consume Disadvantages  Shouldn’t change once in place - Breaks the notion of loose coupling

8. SOAP Service Types Document Style You define the XML returned in SOAP envelope Advantages:  You can define a schema for the xml – any calling app can validate against the schema  Less fragile – you can change the XML without changing the service definition Disadvantages:  More difficult to develop

9. Soap Services – WSDL Web Service Description Language Describes the Service  The exposed functions  The parameters expected in the request/response  Elements / datatypes for the parameters  How to access (bind to) the service Doesn’t have to be SOAP service

10. WSDL Example RPC-style SOAP Service - WSDL

11. SOAP Message XML format for encapsulating messages Important parts:  Header Faults  Body Request Response

12. SOAP Message Example – RPC-style SOAP Service Request Hello!

13. SOAP Message Example – RPC-style SOAP Service Response Hello!

14. REST-Style Web Services Representational State Transfer Applications define their own specs  Typically custom XML defined for the response Resource oriented HTTP protocols – typically using HTTP GET requests for retrieving data, POST requests for modifying data

15. REST http://somesite/a-service/a-resource

16. REST-Style Web Services, cont. Advantages:  Simpler  Don’t need any special toolkits  Like Document-style SOAP services, the XML can be self-validating Disadvantages:  Don’t get underlying infrastructure provided by today’s web services tookits, or tomorow’s extensions Your app needs to handle the http request and any communication problems You need to extract the data from response XML

17. SOAP vs. REST SOAP Advantages  Because of the standard protocol, toolkits can handle SOAP layer for you  Many Standards being built on top of SOAP infrastructure (security, transactions, etc.) REST Advantages  Simple to use  Doesn’t require any special tools

18. Web Services Challenges Security Conversational state Transactions Reliable messaging Orchestrating a set of services

19. Web Services Challenges, cont. There are many web services specs and protocols However..  Competing standards exist  Implementations are not widely available SOAP/WSDL are the most common standards that are widely agreed upon and implemented

20. Web Services Challenges - Security How do you…  Ensure that the message wasn’t altered?  Ensure that the message can’t be observed?  Determine the identity of the requestor?  Determine that the requestor is authorized to use the service?

21. Web Services Challenges - Security Specs and Activities XML Signature - provides data integrity and authentication XML Encryption – data integrity via encryption WS-Security  specifies how to sign and encrypt SOAP messages  Uses XML Signature and XML Encryption, among others SAML  a framework for exchanging identification information among partners  Foundation of Liberty Alliance single sign-on capabilities eXtensible Access Control Markup Language (XACML)  Define authorization / access control in XML

22. Web Services – Security, cont. Other competing specs and standards As security issues get resolved through standards/specs, web service security can be handled with less application programming  Security infrastructure would be more declarative, consistent  WS-Security – vendors starting to provide implementations

23. In the Mean Time… We can’t wait for all specs to solidify We need to implement today

24. Technical Implementation Considerations Security  Authentication  Encryption  Authorization  Basic Web App Security Practices Error Handling  SOAP Fault  Specifying a mechanism to return errors

25. Technical Implementation Considerations, cont. Service Inputs/Outputs for RPC services  Flat ‘arrays’ of data Less fragile (you can add a new, optional parameter without altering the WSDL) Simpler Can’t handle relationships among data  Complex data elements (relationships among data) Used for complex data types More fragile architecture

26. Technical Implementation Considerations - Transactions What if your app does the following? 1. Call Service – Update Info 2. Update your local database - 2.a – Problem occurs - 2.b – Rollback your database input

27. Technical Implementation Considerations - Transactions You need to consider order 1. Update your local database - 1.a – Problem occurs - 1.b – Rollback your database input 2. Don’t call the Service

28. Technical Implementation Considerations - Interoperability Be sure you are using the same version of specs on client/server XML mapping – data types Exceptions/Errors Java Collections

29. Getting Started Get to know your web services toolkits Understand the services you need Web Services Resource Site: http://its.mnscu.edu/isrs/webservices/

30. Tools Example Generate Web Service Code with Axis: set mypath = C:/my-axis-libraries/libraries… java org.apache.axis.wsdl.WSDL2Java http://some-host/someservice/services/my- service?wsdl

31. Example – Client call to Query Service IsrsQueryServiceLocator locator = new IsrsQueryServiceLocator(); locator.setIsrsQueryEndpointAddress("http://some-host/ws- isrsquery/services/IsrsQuery"); IsrsQuery query = locator.getIsrsQuery(); Response result = query.executeQuery( “queryname", “id", "password",new String[]{“rcid", "20055"}) ;

32. Web Services – Moving Forward Web Services and Portals  WSRP Web Services and Business Assembly  BPEL - a language for orchestrating services to make a business process Discovering Web Services  UDDI - a means of discovering a service  Notion of a registry where you would find a service – hasn’t really caught on

33. Portals

34. Web Services and Portals WSRP Spec (Web Services for Remote Portlets)  Most web services require an intermediate app to display data  Portlets are a good candidate for consuming web services  Why not provide user interface code with a service?  WSRP! – A generic portlet can consume and display many different web services.

35. Web Services and Portals, cont. WSRP  Support by major portal vendors  Might be good alternative to a portlet code library  For example: Provide a summary of a student’s course schedule Provide a listing of messages for a student

36. Business Process Execution and Web Services BPEL – Business Process Execution Language  An XML spec for coordinating web services  Combine web services into a business process  Specify order to call the services: conditionals, looping, parallel paths  BPEL servers provided by many vendors

37. Conclusion A Service-Oriented Architecture has advantages for a system like MnSCU Web Services is becoming part of application development environment We need to implement services properly: SOAP/RPC/Doc type/REST We need to keep an eye on future trends – take advantage of them as they solidify

38. Questions?

39. References Doc style services: http://www- 106.ibm.com/developerworks/webservices/library/ws-docstyle.htmlhttp://www- 106.ibm.com/developerworks/webservices/library/ws-docstyle.html Apache web services: http://ws.apache.org/http://ws.apache.org/ OASIS WSRP Spec: http://www.oasis- open.org/committees/download.php/3343/oasis-200304-wsrp- specification-1.0.pdfhttp://www.oasis- open.org/committees/download.php/3343/oasis-200304-wsrp- specification-1.0.pdf WSRP overview from IBM - http://www- 106.ibm.com/developerworks/webservices/library/ws- wsrp/?Open&ca=daw-ws-drhttp://www- 106.ibm.com/developerworks/webservices/library/ws- wsrp/?Open&ca=daw-ws-dr http://www-128.ibm.com/developerworks/xml/library/ws-wsrp/ W3C SOAP spec: http://www.w3.org/TR/soap/

40. References, cont. SAML  http://www.xml.com/pub/a/2005/01/12/saml2.html http://www.xml.com/pub/a/2005/01/12/saml2.html  http://www.oasis- open.org/committees/tc_home.php?wg_abbrev=security http://www.oasis- open.org/committees/tc_home.php?wg_abbrev=security Web Services Security  http://webservices.xml.com/pub/a/ws/2003/03/04/security.html http://webservices.xml.com/pub/a/ws/2003/03/04/security.html  http://webservices.xml.com/pub/a/ws/2003/01/15/ends.html REST services  http://www.xml.com/pub/a/2004/08/11/rest.html?page=1 http://www.xml.com/pub/a/2004/08/11/rest.html?page=1  http://www.xfront.com/REST-Web-Services.html http://www.xfront.com/REST-Web-Services.html BPEL  http://www.theserverside.com/articles/article.tss?l=BPELJava

41. Technical Examples – Hello World – Creating a Service using Java 1. Create a Function public class TestService { public String helloWorld(String name){ return "Hello " + name; } 2. Download Apache Axis Library – add to your app 3. Modify Config Files (axis config file and web app config file) 4. You have a service!

42. Technical Examples – Hello World – Consuming a Service using Java 1. Get the web service description (WSDL file) 2. Use a Utility to Generate Helper Code 1. Apache Axis has wsdl2java 3. Create Code to call the service, using the helper code 1. Lets tool handle all the ‘plumbing’