Enterprise service buses hit the road

Cape Clear, Iona, and Sonic suites lead the way toward services-based integration

See correction at end of article

EAI (enterprise application integration) has come a long way since our early ancestors fashioned the first custom connectors out of wood, shell, and stone. Back then, the goals were modest, the work was difficult, and the results were brittle. They were also costly to maintain. Change required starting over from scratch.

Today we know that IT systems must adapt more quickly to business needs, and there’s no shortage of middleware vendors promising to make that happen. The magic ingredients are SOA (service-oriented architecture) -- an integration paradigm that prescribes open standards and lightweight, distributed components -- and the ESB (enterprise service bus), a newfangled integration platform designed to support the SOA paradigm and tie into legacy assets.

The golden dream behind the ESB is to replace proprietary integration brokers with open communication layers through which distributed services and business processes are readily exposed and easily managed. The immediate reality, however, is that it may be too soon to leave the old messaging subsystems behind.

Regardless of the underlying messaging core, an ESB must somehow -- through open standards or by proprietary means -- create a foundation for reliable messaging. Until WS-* specifications for reliable messaging fall into place, that reliability continues to come from the likes of JMS (Java Message Service), homegrown messaging engines, proprietary MOM (message-oriented middleware), and J2EE servers.

Among the seven ESB packages in this roundup, all but two incorporate an old-school messaging subsystem; Fiorano Software and Sonic Software are based on proprietary messaging middleware. Iona Technologies extends its legacy EAI architecture. PolarLake and FusionWare take a server-centric, connector-based approach. Only Cape Clear Software and Cordys use a truly open and distributed SOA.

What else must an ESB suite provide? It should have tools that streamline development, a data-transformation engine, intelligent message routing, and a management interface supporting real-time monitoring and exception handling, as well as deployment and management of actual services. Most of the products reviewed here meet all of these requirements to varying degrees.

Additional features may include process orchestration and management, BAM (business activity monitoring) and QoS capabilities, support for enterprise management systems such as HP OpenView and IBM Tivoli, and the inclusion of ready-made adapters for quick integration of enterprise apps, data sources, application servers, alternative transports, etc. These were all key differentiators among the products tested. Further, not all of these suites support service discovery and re-use, accelerate XML processing, or offer content-based message routing. In short, each of the products offers a distinct set of strengths. Not all of them, however, would meet the challenges of large, complex integration projects.

Cape Clear 6.1

Born from members of team Iona, Cape Clear made its name as an early pioneer in Web-services platform infrastructure. Cape Clear 6 is a well-equipped Java-based ESB suite that combines Web-services messaging with content-based routing and data-transformation capabilities, BPEL (Business Process Execution Language)-driven orchestration and workflow, and a battery of wizard-driven helpers and administrative tools for monitoring and managing system health.

Striving for completely standards-based integration, Cape Clear eschews the need for proprietary messaging subsystems, like Sonic’s, in favor of open WS-* specifications. Cape Clear also has opted not to supply a J2EE/JMS messaging backbone, choosing instead to mesh with those from BEA Systems, IBM, Sonic, Tibco Software, and others. This approach will change July 26, when Cape Clear 6.2 ships with a fully integrated version of the JBoss JMS.

Version 6.0 supports the WS-ReliableMessaging protocol, a QoS mechanism for building delivery assurances between end points. Version 6.0 also ushered in a BPEL orchestration engine and an Eclipse-based orchestration toolbox for building composite applications from process flows.

The Version 6.1 update makes some notable orchestration enhancements including support for the missing Wait action — necessary to support multibranching, asynchronous processes — and auto-generation of BPEL variables. It also improves the orchestration engine’s ability to recover from system failures, adding database persistence that allows the orchestrator to resume processes exactly where they were left off.

The WS-ReliableMessaging specification has yet to be officially locked down, but Cape Clear is firmly committed to its support. Using a plug-in adapter, Cape Clear can also speak with JMS transports such as SonicMQ and WebSphere MQ.

The Orchestration Studio’s BPEL scripting toolkit is one of the best I’ve used. Using the drag-and-drop building blocks, it was a cinch to define and build up workflows. Debugging and simulation capabilities could use a kick-start, however.

Cape Clear’s monitoring and management tools are sufficient for smaller deployments, but they’re not up to the task of managing large numbers of distributed servers as a group. The admin interface shows a general overview of running processes but offers limited reporting and BI insights. The built-in monitoring and alerting cover the essentials, but they’re inadequate for keeping a close eye on QoS. Services management is also very basic, with no change-management or dependency-checking features.

On the plus side, I drilled down easily through process-activity lists to examine run-time conditions and intervene to give stuck processes a manual push. Thanks to support for XPath and XQuery, which allow dynamic routing based on both document header and body content, Cape Clear handled complex routing and errors without a hitch.

Specifying XSLTs (XSL Transformations) proved straightforward using the included graphical mapper, a wizard-driven tool made for quick and easy mapping of unstructured data and Excel documents, hiding much of the underlying complexity in data translation.  I did run into a minor bug in a date-transformation function, however.

Security mechanisms are good but not spectacular. Cape Clear can handle SOAP digital signatures and client-side certificate authorization as well as SAML. Tapping LDAP and Windows NT domain controllers for authorization is not a problem, and JAAS (Java Authentication and Authorization Service) can be plugged in as well. It would be great to see Cape Clear round out the security choices in a future release.

Good load balancing and fail-over management, as well as integration with SNMP and JMX (Java Management Extension)-ready management platforms, make a good case for enterprise deployment. Cape Clear could further strengthen the case by beefing up the management tools and adding some industry-specific process templates or best-practice workflows, such as those in Fiorano.

Nevertheless, with solid links to J2EE and provisions for ORB (object request broker)-protocol integration, Cape Clear presents a finely wrapped, pure-play ESB package suitable for boutique and midsize integration projects.

Cordys 4.2
Founded by Jan Baan, Nordic creator of the once-innovative Baan ERP system, Cordys is the only vendor in our roundup to incorporate a collaborative portal in its suite. Formerly known as the Cordys Business Collaboration Platform, Cordys 4.2 also includes integration middleware, an orchestration engine, and a design studio for developing business rules and modeling processes and workflow.

In addition to being the window into graphical activity monitoring, the portal serves as a foundation for centralized content development and e-learning, thanks to a WebEx plug-in. (No surprise; WebEx is a company in which Baan also has a hand.) Although the portal is a nice touch, the specific KPI (key performance indicator) templates and business intelligence capabilities still have room to grow.

Unlike the other vendors here, Cordys requires you to supply your own Web server (Microsoft IIS or Apache) and database (Oracle Database or Microsoft SQL Server), increasing up-front licensing costs. Cordys also requires you to set up a central LDAP registry for storing configuration information. The Cordys Admin Repository Server (based on OpenLDAP) is provided, but Netscape Directory Server 4 may also be used.

Cordys’ browser-based interface offers access to centralized management and development tools, including run-time monitoring and debugging. The IDE provides good graphical tools for process and application modeling, easy configuration and deployment of applications, and standard mapping for XML data transformations. On the downside, process simulation is absent and Cordys’ WSDL format is proprietary.

The Cordys IDE allows development from several vantages, focusing either on value chain, business context, or straightforward process modeling. Although modeling is currently based on BPML (Business Process Modeling Language), Cordys indicates that BPEL import is forthcoming with eventual migration to full native support.

Architecturally, deployment used to require that each SOAP-processing end point be configured in its own JVM. With this release, Cordys allows you to reduce resource overhead by running multiple processors in a single virtual machine. Caveat deployer, however: Doing so would also make it possible for one nasty bug or system restart to bring down your entire system.

All of the Cordys platform’s functions are extended as Web services and reachable through SOAP calls. Cordys’ message bus also supports Microsoft MQ and includes fair provisions for fail-over. Cordys also offers a JMS connector, but it has not been certified as compliant with the Sun spec and it has never been tested in a customer deployment.

The basic security features include support for Windows-based authentication and ACLs (access control lists). The bundled ACL editor is a nice touch.

Cordys’ ESB shows good promise. Despite various shortcomings, the components of the suite are surprisingly mature for a five-year-old company. The absence of provisions for enterprise management systems (SNMP or JMX), and overdependence on third-party adapters for business-to-business and mainframe integration may limit its appeal in certain circles.

FioranoESB Suite 3.7
Fiorano Software steps into the ESB arena with a Java-based integration stack that combines JMS messaging (FioranoMQ), BPM, and SOA adaptability. Although Fiorano has come to refer to its architecture as “brokered peer-to-peer,” the reality is that — in the absence of a WS-* spec like WS-ReliableMessaging, which Fiorano does not yet support — ensuring the reliability and integrity of transactions will require deploying FioranoMQ (or a similar middleware component) centrally or at the end point.

Click for larger view.

Fiorano’s Event Process Orchestrator, a NetBeans-based IDE, presented a great palette of prebuilt components that could be modified, saved, and inserted into my flows. From flow controls, database adapters, and MOM connectors to Web-services call-outs, XML transformations, and data-aggregation services, developers gain some good tools to construct intricate processes fairly easily.

The development interface goes a step further with support for real-time simulation, and the debugger enabled capturing and inspecting message-queue contents on the fly. I viewed the flow of transaction data among components, while simple plug-in adapters offered display services that simplified real-time message inspection and even the capability to chat with other admins and troubleshooters.

Not that the IDE couldn’t be improved. The terribly inefficient drawings quickly became convoluted without manual reorganization, and the inability to specify start and end points in the event process -- allowing data flows, in theory, to start at any point along the chain -- proved disorienting. In the plus column, Fiorano’s XSLT mapper, which graphically depicts its Funclets (functions you insert into translations) for easy manipulation, was one of the easiest I’ve used. And the content-based routing capabilities are finely grained.

In addition to Fiorano’s own orchestration, BPEL development is offered to a lesser degree. BPEL is not completely implemented, resulting in limited transaction management and fault- and event-handling capabilities.

Administration and service-specific management also need improvement. For example, although you can easily view active sessions, the queue manager interface makes it difficult to trace past ones.

Furthermore, although Fiorano’s messaging subsystem is hardy, the bus and related components remain light on features. Not all system components can be exposed as Web services without programming, and supported transports don’t go beyond the basics (HTTP, FTP, e-mail). Fiorano doesn’t support JMX-based management systems or integrate with LDAP for access control. Security features do include programmatic support for JAAS and JSSE (Java Secure Socket Extension), but not good options for federated security, for example. Finally, performance can be sluggish, although the inclusion of FioranoMQ 8 in the next release will likely provide a boost.

On the upside, FioranoESB offers solid messaging underpinnings and a good set of prebuilt services. You can easily extend the system using a variety of programming languages, including Java, C/C++, COM, and C# for .Net client development. Fiorano’s messaging architecture may create a lot of overhead, but the end points are chock-full of resources.

FusionWare Integration Server 3.0
FusionWare’s flagship product features a Java server framework for mediating communications, backed by a Windows-native IDE for designing process workflows and a GUI for server management. The Integration Server’s licensing model offers an interesting way to control deployment costs, and the IDE provides some nice wizards for easing development. Ultimately, however, this suite is suitable only for small, centralized integration projects.

FusionWare’s licensing structure is unique among vendors in our roundup. Licensed by the number of concurrent processing threads, the server ticks down the number of available threads with each inbound request. When a server’s thread count is exhausted, new requests sit in the message queue until a running process completes or is suspended, and a thread becomes available again.

The licensing scheme offers a sign of the solution’s limited scalability. Although you can purchase and install additional worker threads to meet growing demand, I was disappointed to discover that there was no way to pool licenses across multiserver installations.

FusionWare’s tools are also a mixed bag. The Designer IDE is adequate for creating workflows, but can be somewhat cumbersome at times, as it lacks many of the visual queues and graphical tools for streamlining tasks that are commonly available from competing vendors. On the upside, the Business Process Wizard does a good job of jump-starting a project framework, including storing assets and text-based workflow configurations.

FusionWare’s XSLT wizard takes a different approach than most XSLT tools, which typically offer a visual map of inputs to outputs. Instead, XML transforms are done through an interesting two-step process, which involves pre-parsing the input structure to isolate pertinent data items before mapping them out. I personally found the process somewhat convoluted, but it would certainly minimize complexity in handling large document structures.

I’d like to see FusionWare adopt a workflow standard, such as BPEL, and incorporate features for transaction compensation and exception handling. Although a new tool has been added to test deployments, tighter integration of versioning, management, and project deployment is needed. Debugging also could be more efficient. The IDE allowed me to set basic breakpoints, but having to jump to a text-based, command line interface to execute debug processing was a pain. This would not pass muster in high volume shops.

FusionWare is also light on administrative features. It provides only very basic insight into queue conditions and service status. Better metrics and auditing will be a definite requirement for enterprise installs. Until FusionWare drops them in, customers should plan on building their own.

This product also lacks a strong enterprise footing when it comes to transport support -- currently limited to HTTP and e-mail -- and security, where FusionWare’s support for the basics, such as HTTP/S and simple password-based authentication, may not be sufficient to meet advanced encryption and authentication requirements. These and other shortcomings, including the absence of extensions to external management systems, the failure to support advanced b-to-b protocols (RosettaNet, ebXML, etc.), and the lack of ERP or SCM adapters, for example, relegate FusionWare to small-scale implementations.

Iona Artix 3.0 Advanced
One of the biggest names in legacy integration is Ireland’s Iona Technologies. Not surprisingly, Iona brings to its ESB a strong feature set for mainframe transaction bridging, MOM-based systems, and CORBA transports, as well as its Adaptive Runtime Technology plug-in architecture and a new J2EE service connector.

What impressed me most about Artix is its ready adaptability for old-school protocols such as IIOP (Internet Inter-ORB Protocol) and CICS, and support for security services such as single sign-on. Iona is truly a top-tier player in these respects.

The new Eclipse-based development environment could benefit from more wizard-driven shortcuts like the one for pulling WSDL out of old Cobol Copybooks. Although a bit buggy, it does a wonderful job.

In addition to supporting port- and protocol-based routing, Artix can be configured to take routing directives from message headers but not yet message content. Artix supports dynamic services binding through a central directory and repository called the Locator service.

Data format translations within the bus are performed directly, without first having to convert data into an intermediate language such as XML, speeding throughput but also creating hard-coded, application-specific interfaces. Artix supports XSLT scripts, as well.

Security underpinnings are good. Artix supports LDAP and Microsoft Active Directory, ACLs, single sign-on, and role-based authorizations, as well as Kerberos authentication and WS-Security.

Note, however, that this platform fails to implement process orchestration and activity monitoring. For simple, stateless transactions, I linked together services using the included Chain Builder, a plug-in for constructing services and transformations into preformed process definitions. For processes of any complexity, though, you’ll want to layer on third-party BPM.

Clearly Iona has chosen to focus on fundamentals, but a few other additions would help to round out the Artix package. These include real-time dashboards, tighter services version control, the ability to monitor dependencies among services to better facilitate change management, and better plug-ins for enterprise applications from vendors such as SAP and Oracle. Customers in financial services, health care, and other verticals would also benefit from best-practices process templates.

Provisions for transactional reliability and integrity, however, are top notch. Artix supports session management, two-phase commit (XA/2PC) for long-running processes, and the WS-AtomicTransaction and WS-Context specifications. It is solidly fortified with redundancy, load balancing, and hot-swap of services, and it offers a run time that can be deployed on almost any platform — from IBM AIX and z/OS to Linux and Windows. And the QoS features are among the best I’ve seen in an ESB implementation.

Naturally, such creature comforts (or enterprise necessities) come at a price. The per-CPU run-time licensing associated with each distributed container means that large deployments won’t come cheap, especially when you consider that a good number of enterprise “extras,” such as operational logging and management system adapters come at additional cost.

On the other hand, you get what you pay for. Committed to modernizing old-world systems with the new, Iona’s Artix 3.0 Advanced does what it does very well. This package is a heavyweight contender for addressing large-scale system integration projects in a services-oriented way.

PolarLake Integration Suite 4.0
Built on PolarLake’s Java-centric service bus, JIntegrator, the PolarLake Integration Suite 4.0 sports a nice collection of tools and connectors plus some basic features for ensuring quality of service that make it worthy of consideration for small to midsize deployments. Limited BPEL support and shortcomings in tools and activity monitoring make it a difficult sell for large installations.

PolarLake makes use of a “circuits” metaphor to represent collections of XML-based configuration files, processes, and transports controlled by its servers. Circuits may contain details for data transformation, database integration, attaching to a JMS pipe, or adding monitoring and reporting functionality within a process, to name a few. A unique XML streaming architecture boosts performance by “pre-processing” inbound XML documents before transmission of the document is complete.

For process modeling, the Eclipse-based IDE was not bad. Its graphical interface offered a pallet of drag-and-drop components for assembling processes and let me test the flows between my circuits before they were deployed. The capability to simulate run-time testing within the development environment sped up debugging tremendously. On the downside, I could not perform debugging during true run time, nor could I manually intervene in live processes. These would be nice improvements to PolarLake’s activity monitoring.

PolarLake’s newly added BPEL engine enables sophisticated exception handling, transaction compensation (rollbacks, alerts, and workflows in response to failed transactions), and message correlation (re-syncing a stream of messages for continued processing). Data transformation was standard stuff, although the graphical interface quickly became cluttered when handling anything beyond a one-to-one mapping. Transformation and content-based routing are strong thanks to XPath and newly added XQuery support.

On the development front, PolarLake’s biggest shortcoming is limited support for WS-* standards, but there are others. For example, you get no tools for tackling complex, non-XML-ready data structures. Incorporating Excel docs in processes won’t go as easily as with Cape Clear.  Convoluted pop-ups in the new WSDL editor had me pining for a simple text editor.

Security, too, could use some improvement. PolarLake’s SecureXML module, which provides basic public key support for XML signatures and encryption, is a good step in the right direction, but the only adapter included is for the VeriSign Trust Service Integration Kit. For anything else, such as Baltimore’s KeyTools or Apache signatures, you’ll need to create your own adapters.

A basic management console, drawing on the sensor feedback data I built into my circuits, let me monitor and restart applications, as well as view error messages. I could not drill through to underlying specifics, making troubleshooting difficult, but remote monitoring and alerting — key to managing distributed services — were good. The system can generate SNMP traps to integrate with enterprise management systems.

Large customers may want a more complete toolset, richer activity monitoring, and fuller BPEL support from their ESB vendor, but the PolarLake Integration Suite has a lot going for it, including good process simulation, adapters for enterprise applications, and decent QoS provisions. Support for SWIFT, FIX, and XBRL document formats warrant a look from financial services companies.

Sonic SOA Suite 6.1
Sonic SOA Suite may be the most well-rounded and mature ESB solution in the marketplace today. This Java-powered package combines separate servers for the ESB, process orchestration, database services, and even XML processing. A separate product, the Sonic Collaboration Server, offers strong support for integrating external business partners.

Like Fiorano, Sonic lays a services bus atop its own messaging backbone, SonicMQ, to provide a cushion of reliability across transactions — raising the same concerns as Fiorano about vendor lock-in and the rigidity of centralized, heavy-duty hubs versus the more flexible, lighter-weight distributed end points that are the hallmark of true SOAs.

Sonic’s CAA (Continuous Availability Architecture), a software-based approach to high availability and guaranteed message delivery, demonstrated good performance and fault tolerance in my tests. Although hardware clustering for load balancing is still supported, CAA can help reduce your reliance on costly hardware as a hedge against system failures.

Although I’d prefer to see a cross-platform IDE, I didn’t mind the Windows-only development kit. Sonic Workbench includes a UML-style interface for building and managing business process flows. Workbench does not support BPEL and lacks process simulation capabilities, but its process-orchestration capabilities hit the mark.

Workbench made easy work of developing complex routing scenarios, using XSLT for transformations and XQuery for content-based routing, in addition to its itinerary-based routing, using specified instructions within the document. 

Workbench also provided good facilities for testing and debugging, but be prepared to bring your programming skills along. Workbench demands a good degree of Java and JavaScript programming to get things done. I would prefer a simpler way, but the results were superb. Tools for editing, testing, and debugging SQL queries, as well as a newly added Call Editor for testing Web services, round out the set.

Sonic makes the movement from development to staging server to deployment a seamless process. I easily configured, deployed, and checked dependencies among services with little effort. A solid security foundation includes pluggable authentication and encryption options, as well as embedded RSA support, which can be uniformly implemented across multiple domains for completely federated management. Also, although the majority of Sonic’s adapters will require additional third-party expense, the company offers one of the best selections of tried-and-tested application, b-to-b, and transactional adapters I’ve seen.

Sonic’s new Collaboration Server, which focuses on trading-partner integration, may seem redundant. Shouldn’t an ESB natively support your SOA-based business partners? Moreover, the cost of the b-to-b server will double the initial outlay required. Nevertheless, Collaboration Server’s support for protocols such as ebXML and RosettaNet, the capability to build ad hoc run-time bindings, and the ease with which human workflow is integrated make the b-to-b server worthwhile. Best of all, you can manage the Collaboration Server and the ESB within the same management framework.

Sonic maintains a thumb firmly in its proprietary SOA pie. Like Fiorano’s MOM, Sonic’s SonicMQ goes beyond the JMS spec to bring a layer of transparency to variations in client connectivity (point-to-point, store/forward, publish/subscribe, sync/async messaging) and hide the complexities of queue structure, process prioritization, transaction management, and session control. True SOA it’s not, but there’s no denying its suitability for enterprise deployments. Sonic has the stuff for high-volume utilization.

Waving a Checkered Flag
As with all of the EAI frameworks that came before, an ESB must be able to improve access and control over application resources, streamline development, and ultimately reduce integration costs over the long term. Among the products reviewed here, Sonic’s SOA Suite is best equipped to achieve these goals on an enterprise scale.

Cape Clear, with the most open approach to ESB implementation, delivers a good solution for boutique and midsize integration projects in need of strong process orchestration, advanced routing, and open transformation capabilities.

Despite a strong (and potentially costly) reliance on third-party infrastructure, as well as an aging BPML-based orchestration engine, Cordys’ focus on collaboration will appeal to some shops striving to integrate the human factor into enterprise processes. Cordys also provides analytic insight that small groups might find useful.

Fiorano’s ESB offers strong middleware but came off a little too proprietary in the absence of healthy transport and adapter libraries and the lack of support for advanced Web-services specs. Its advantages, though, can be found in areas such as process management and real-time simulation.

The unique per-process-thread licensing of the FusionWare Integration Server makes it a likely candidate for smaller shops who don’t mind the centralized server approach, don’t require visual tools, and don’t need strong analytics.

Iona Artix will bring strong and reliable messaging capabilities to your legacy integration projects at an affordable price, but at the cost of some features, including lifecycle management tools, process orchestration, and advanced routing capabilities.

Like Sonic, PolarLake Integration Suite requires too much Java-centric programming, but supplies good process simulation, some basic QoS, and good enterprise application adaptors. Ultimately, this suite comes up short on activity monitoring and management that would be essential to larger deployments.

Despite a proprietary architecture that is sure to alienate SOA purists, the Sonic SOA Suite is the most powerful, flexible, and scalable ESB among the group. Customers should weigh the risks of vendor lock-in and be prepared to foot additional costs -- both with respect to price and skill-set requirements. Until the Web-services fabric matures enough to support a fully reliable open integration platform, however, or until larger players finally enter the ESB arena, Sonic is best overall for larger-scale SOA implementations in need of high transactional reliability.

In this article, the prices for Sonic Software's Sonic SOA Suite 6.1 and Collaboration Server were originally incorrect. The prices have been corrected.

InfoWorld Scorecard
Features (20.0%)
Management (15.0%)
Value (10.0%)
Security (10.0%)
Scalability (15.0%)
Interoperability (30.0%)
Overall Score (100%)
Cape Clear 6.1 8.0 6.0 8.0 7.0 8.0 8.0 7.6
Cordys 4.2 6.0 7.0 6.0 6.0 6.0 7.0 6.5
FioranoESB Suite 3.7 7.0 7.0 6.0 6.0 7.0 7.0 6.8
FusionWare Integration Server 3.0 5.0 4.0 6.0 5.0 5.0 6.0 5.3
Iona Artix 3.0 Advanced 6.0 7.0 7.0 9.0 9.0 8.0 7.6
PolarLake Integration Suite 4.0 7.0 7.0 7.0 5.0 7.0 7.0 6.8
Sonic SOA Suite 6.1 8.0 7.0 7.0 9.0 9.0 9.0 8.3
From CIO: 8 Free Online Courses to Grow Your Tech Skills
Join the discussion
Be the first to comment on this article. Our Commenting Policies