Microsoft previews upgraded Web services pack

Microsoft on Tuesday will release a preview of an upcoming update to its Web Services Enhancements (WSE) kit, focusing on security.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Due for general release by the end of this year, the free kit for Visual Studio .Net users is intended to enable development of what Microsoft describes as advanced Web services. WSE 2.0 features security improvements and enables developers to build Web services that are compliant with a set of Web services specifications released by Microsoft and IBM, including WS-SecurityPolicy and WS-Addressing. These specifications, which have not yet been submitted to an industry standards organization, would receive a volume boost by developers who use Microsoft's kit.

"[WSE 2.0] is fully integrated with Visual Studio and basically provides additional libraries in the .Net Framework for doing security policy and SOAP messaging," said Rebecca Dias, Microsoft product manager for advanced Web services, in Redmond, Wash.

Microsoft is releasing an early version of the kit to give users and vendors time to review it and provide feedback. The new version builds on the security, routing, and attachment capabilities of Version 1.0 of WSE.

Version 2.0, available at http://msdn.microsoft.com/webservices, provides a message-based object model that supports multiple transports, including HTTP and TCP, and asynchronous and synchronous communications, according to Microsoft. In synchronous communications, messages are sent and the sender must wait for a reply, unlike asynchronous communications, in which a request can be sent and retrieved without waiting for a reply. Asynchronous communications is useful for long-running transactions such as with routing of payroll requests or purchase orders, Microsoft said.

A user of WSE 2.0 at Reuters said it has enabled improved security for Web services communications with financial services clients. Reuters provides financial information and news.

"First of all, the WSE was important to Reuters because it enables our clients to use Web services in their enterprises in a more secure manner," said Bill Evjen, technical director for Reuters, in Saint Louis.

Evjen said he is not concerned that most of the specifications Microsoft is implementing in WSE 2.0 have not been submitted to a standards organization, such as the Organization for the Advancement of Structured Information Standards (OASIS). The specifications do build upon the WS-Security specification, which Microsoft and IBM have submitted to OASIS, Microsoft officials said.

"The technology is moving so fast that if we had to wait for a standards body like OASIS to approve them, we would really be behind the curve," Evjen said. Reuters is confident that the backing of vendors such as Microsoft and IBM give weight to the specifications.

New capabilities in WSE 2.0 include the following:

-- Token-issuing framework, providing capabilities that build on the WS-Security specification and define extensions to request and issue security tokens and manage trust relationships and secure conversations. The token-issuing framework is enabled by the WS-Trust and WS-SecureConversation specifications.

-- Role-based authorization with integration into Windows security, enabling users to leverage existing Windows Domain Credentials when accessing Web services or to integrate an access control engine.

-- Declarative programming model, enabling developers to author policies that operate a run-time component, responsible for processing SOAP headers in Web services that contain security and routing information. The run time can automatically sign and encrypt messages based on authored policy without the developer having to write new code. The declarative programming model supports the WS-Policy and WS-SecurityPolicy specifications.

-- Message-based object model, providing a message-based programming model over TCP and HTTP, as alternative types of SOAP-based applications. Web services messages can be sent via other means than over the Web. Peer-to-peer applications are supported, for example. The message-based object model is supported by the WS-Addressing specification.

Version 1.0 of WSE, released last December, was downloaded hundreds of thousands of times, according to Microsoft officials.