Enterprise Service Oriented Architectures - Concepts, Challenges, Recommendations

TABLE OF CONTENTS

ENDORSEMENTS

ABOUT THE SERIES

Series Editors

FOREWORD

PREFACE

ABOUT THIS BOOK

Audience

What This Book Is Not!

How to Use This Book

Motivation for Writing This Book

Disclaimer

About the Authors

ACKNOWLEDGEMENTS

ABOUT THE REVIEWERS

Argentina

Australia

Belgium

Canada

Finland

Germany

India

Israel & Palestine

Pakistan

Scotland

Singapore

Ukraine

United Kingdom

United States

1 UNDERSTANDING SERVICE- ORIENTED ARCHITECTURE

1. Introducing Service-Oriented Architectures

1.1. Web Services

1.1.1. Enterprise IT and Web Services

1.1.2. WSDL and SOAP

1.1.3. UDDI

1.1.4. The Beginnings of Enterprise Service Orientation

1.2. Enterprise Service-Oriented Architecture

2. Service-Based Collaboration through Federation

2.1. A Federation Is …

2.2. Federation and Mature CBSE

2.3. The Federation Spectrum

2.4. The Spectrum as a Service Taxonomy

2.5. Federation Example

2 COMPONENT-BASED SERVICES

1. Component-Based Software Engineering ( CBSE)

1.1. Understanding CBSE

2. A Component De.nition

2.1. The UML2 Component

2.2. The Enterprise Component

2.3. Network-Style Interfaces

3. Component Granularity

3.1. Distribution Domains and Tiers

3.1.1. Looking at the Big Picture

3.1.2. Distribution Domains and Tiers

3.1.3. The BPM Domain

3.2. Granularity Scheme

3.2.1. The Distributed Component (DC)

3.2.2. The Business Component (BC)

3.2.3. The Application Component (AC)

3.3. Dependency Management

3.3.1. Inter-Tier Interactions

3.3.2. Business Function Layers

4. From Requirements to Design

4.1. Requirements

4.1.1. Business Elements

4.1.2. Processes and Resources

4.2. Business Element Analysis

4.2.1. Resource Business Element (RBE)

4.2.2. The Service Business Element (SBE)

4.2.3. Delivery Business Element (DBE)

4.3. Mapping to Components

5. Summary

3 ORCHESTRATION

1. Work.ow and Business Process Management

1.1. Intra-Enterprise Work.ows

1.2. Interoperability Concerns

2. The Business Process Execution Language ( BPEL)

2.1. Relationship to XPath

2.2. Variables

2.3. De.ning Business Relationships

2.4. Message Correlation

2.5. Activities

2.5.1.

2.5.2.

2.5.3.

2.5.4.

2.5.5.

2.5.6.

2.5.7.

2.5.8.

2.5.9. <.ow>

2.5.10.

2.5.11.

2.5.12.

2.5.13.

2.5.14.

2.5.15.

2.6. Transactions

3. A Worked Example of Web Services Orchestration

4. Design-Time Demonstration

4.1. Task De.nitions

4.2. The ProcessOrderApplication Flow

4.3. The PaymentAuthorization Sub-Task

4.3.1. Testing the Sub-Task within the Design Tool

4.4. Gluing Them Together

4.5. Fault Handling

4.6. The Entire Flow

5. Run-Time Demonstration

5.1. Tracking the Flow

5.2. The Audit Trail

6. Summary

4 WORKING WITH REGISTRY AND UDDI

1. Introducing the Registry

1.1. Why Do I Need It?

1.2. How Do I Use It?

1.3. Registry vs Repository

2. Universal Description, Discovery and Integration ( UDDI)

2.1. Technical Overview

2.2. Informational Structural Model

2.2.1. Business Information: The BusinessEntity Element

2.2.2. Service Information: The BusinessService element

2.2.3. Specification Information: The BindingTemplate Element

2.2.4. Technical Fingerprint: The TModel Element

2.2.5. Relationships: The PublisherAssertion Element

2.2.6. Operations Information: The OperationalInfo Element

2.3. UDDI Keys

2.3.1. UUID

2.3.2. DomainKey

2.3.3. DerivedKey

2.4. Classification – Where Is My Data?

2.4.1. Categorization

2.4.2. Identifiers

3. Programming UDDI

3.1. Searching with UDDI

3.1.1. Browse Pattern

3.1.2. Drill-Down Pattern

3.1.3. Invocation Pattern

3.2. Publishing with UDDI

3.3. Subscribing with UDDI

3.3.1. Asynchronous Noti.cation

3.3.2. Synchronous Noti.cation

4. Internationalization

4.1. Multilingual Descriptions, Names and Addresses

4.2. Multiple Names in the Same Language

4.3. Internationalized Address Format

4.4. Language-Dependent Collation

4.5. Federation of Registries

4.6. Private Test Registry

4.7. Shared Registry

4.8. Security

5. Summary

5 UNDERSTANDING ENTERPRISE SECURITY

1. Need for a Message Level Security Solution

1.1. Point-to-Point vs End-to-End Security

1.2. Application Independence

1.3. Technology Independence

2. Security Concepts

2.1. Authentication – Who Is It?

2.2. Authorization – What Can They Do?

2.3. Integrity – Ensure That Information Is Intact

2.4. Con.dentiality – You Can’t Read

2.5. Non-Repudiation – You Sent It, I Got Proof

2.6. Single Signon – How Many Times Do I Have to Tell You?

2.7. Key Management – Give Me a Key Chain

3. Security Technologies

3.1. Authenticaton and Security Tokens

3.1.1. Username/Password

3.1.2. PKI through X.509 Certi.cates

3.1.3. Kerberos

3.2. Integrity and Signing

3.3. XML Signature

3.3.1. Generate Certi.cate

3.3.2. Signing

3.3.3. Veri.cation

3.4. Canonicalization

3.5. Con.dentiality and Encryption

3.5.1. Symmetric Encryption

3.5.2. Asymmetric Encryption

3.6. XML Encryption

3.6.1. Encryption

3.6.2. Decryption

3.7. Authorization

3.8. Extensible Access Control Markup Language ( XACML)

3.8.1. Key Concepts

3.9. Top-Level Constructs: Policy and PolicySet

3.10. Key Management

3.11. XML Key Management Speci.cation ( XKMS)

3.11.1. XML Key Information Service Specification ( XKISS)

3.11.2. XML Key Registration Service Specification ( XKRSS)

3.12. Single Sign-On

3.13. Identity Management

3.14. Liberty Alliance Project

3.15. Security Assertion Markup Language ( SAML)

4. Web Services Security (WSS)

4.1. Security Tokens

4.2. Signature

4.3. Encryption

5. WS-Policy

6. WS-Trust

7. WS-Privacy

8. WS-SecureConversation

9. WS-Federation

10. WS-Authorization

11. Summary

6 SOA MANAGEMENT

1. Problem Space

1.1. Management Scenarios

2. Systems Management

2.1. Logging

2.2. Auditing

2.3. Monitoring

3. Alerting

3.1. Round Trip

3.2. Transaction Size

3.3. System Fault

3.4. Trending

4. Provisioning

5. Leasing

6. Billing

7. Pricing/Chargeback Models

7.1. Per Transaction

7.2. Fixed Fee/Subscription

7.3. Lease/License

7.4. Business Partnership/Percentage of Revenue

7.5. Registration

8. Lifecycle Management

8.1. Routing

8.2. Versioning and Deprecation

8.3. Transformation

8.4. Provisioning

8.5. Quality Assurance

8.6. Business Processes

8.7. Message Prioritization

8.8. Business Activity Monitoring

9. Management Architecture

9.1. Gateways

9.2. Agents

9.3. Centralized Policies

9.4. Operational Rules

9.5. Components

9.6. Persistent Storage

10. Policy Architecture

10.1. Policy Execution

11. Framework Vendors

12. Summary

7 TRANSACTIONS

1. What Are ACID Transactions?

1.1. The Synchronization Protocol

1.2. Optimizations to the Protocol

1.3. Non-Atomic Transactions and Heuristic Outcomes

2. Why ACID Is Too Strong for Web Services

3. A Brief History of Web Services Transactions

4. The Coordination Frameworks

4.1. Coordination Architecture

4.2. Creating a Coordinator

4.3. The Context

4.4. Registering Participants

4.5. Terminating the Coordinator

5. Web Services Transactions

5.1. Atomic Transaction

5.1.1. Supported Protocols

5.2. Business Activity

5.2.1. WS-BusinessActivity

5.2.2. Long Running Action

5.3. Business Process Model

6. Security Implications

7. Interoperability Considerations

8. Summary

8 EVENT-DRIVEN ARCHITECTURE

1. Overview

2. Events

2.1. Descriptive

2.2. Prescriptive

2.3. Factual

2.4. Assumptive

2.5. Business Rules

3. Agents

3.1. Service Design

3.2. Pools

4. Threads

4.1. Thread per Request

4.2. Thread Pools

5. Alternative Pattern-Based Approaches

5.1. Strategy Pattern

5.2. Chain of Responsibility Pattern

5.3. Interpreter Pattern

5.4. Flyweight Pattern

5.5. Memento Pattern

6. Language Specific Constructs

6.1. Soft References

6.2. Forking

6.3. Non-Blocking I/O

6.4. Enterprise Service Bus

6.5. Callbacks

7. Finite State Machines

8. Event Notification

8.1. Brokered Notification

8.2. Security Concerns

8.3. Message Order Alteration

8.4. Availability Attacks

8.5. Replay Attacks

8.6. Redirection Attacks

9. Practical Considerations

9.1. Return on Investment

9.2. Canonical Form

9.3. Integration

9.4. Retirement

10. Summary

OUTTRO

APPENDIX A: UNDERSTANDING DISTRIBUTED COMPUTING

1. Distributed Computing

1.1. Anatomy of a Distributed Application

1.1.1. Understanding the Network Layer

1.1.2. Building the Application Layer

1.1.3. Operating System Components

1.2. Interprocess Communication

1.3. Communications Infrastructure

1.4. Remote Procedure Calls (RPC)

1.5. Object Request Brokers (ORB)

1.6. Transaction Processing Monitors

1.7. Message-Oriented Middleware ( MOM)

1.8. Service Description

1.9. Versioning

1.10. Operations

1.10.1. One-Way

1.10.2. Request/Response

1.10.3. Solicit/Response

1.10.4. Noti.cation

1.11. Service Discovery

1.12. Application Services

1.12.1. Stateless Services

1.12.2. Conversational Services

1.12.3. Cached Services

1.12.4. Singleton Services

2. Practical Considerations

3. Summary

APPENDIX B: QUALITY ATTRIBUTES

1. System Qualities

1.1. Availability

1.2. Manageability

1.3. Performance

1.4. Scalability

1.5. Security

2. Design vs Run-Time

APPENDIX C: REFERENCES

Books

Magazines

Docs

Web Sites

Presentations

APPENDIX D: ADDITIONAL READING

APPENDIX E: UPCOMING BOOKS

Agile Enterprise Architecture – Fall 2006

Enterprise Portal Architecture – Fall 2006

Enterprise Open Source – Spring 2007

Enterprise BPM Patterns – Summer 2007