 NEWS
Toolkits tackle standards
By Carolyn A. April , Heather Harreld , and Paul Krill
September 6, 2002 1:01 pm PT
PROMISING ACCESS to a wider set of standards, developer toolkits are emerging to address growing enterprise demand for internal
Web services and application integration.
As toolkits from the likes of Microsoft, IBM, and Cape Clear arrive to help developers expose
enterprise applications as
Web services, momentum builds around a broader effort to unify standards.
To that end, the W3C this month is expected to make available for public review a proposed
Web services reference architecture, according to Eric Newcomer who is working with the W3C on the draft design and is the CTO of Iona in Dublin, Ireland.
The proposed architecture defines the relationships and roles of the
Web services sender, receiver, and intermediaries such as a third-party
security layer or billing service, Newcomer said. Additionally, the architecture will help define the functionality that gets added on top of a
Web services message, and it will show how to represent such things as the registry, metadata, and semantic rules. "It will bring order to chaos," Newcomer said. "It can be used to guide future specifications for
Web services as well."
The architecture comes as enterprises continue to wrestle with the deployment of
Web services to integrate business applications. The toolkits further this process by promising to link systems and business units in nontraditional ways.
In August, Microsoft released a beta version of the its WSDK (Web Services Development Kit), to enable developers to build
Web services that comply with the company's WS-Security, WS-Attachments, and WS-Router specifications.
"What these new toolkits do is give a way for us to deliver the latest and greatest [
Web services] functionality very, very quickly, out of band with the underlying tools release, but in a way that developers can get access to those things and start taking advantage of them as quickly as possible," said Charles Fitzgerald, general manager of Microsoft's .Net solutions division. "Instead of the business application as a black hole, the new challenge is how well can you reach out and connect to other applications, other assets, other partners, other suppliers."
Cape Clear Software this week served up its own graphical WSDL (Web Services Description Language) Editor designed to simplify and encourage development of
Web services. The WSDL Editor, which will be available for free download, is focused on helping developers design the WSDL for a particular Web service up front -- before they do any coding of the application itself, according to officials at Dublin, Ireland-based Cape Clear.
"It's the top-down approach to development, where you are thinking about your interfaces before you code them," said John Maughan, business manager of CapeStudio, Cape Clear's flagship
Web services development environment.
IBM for its part has released a development environment to boost deployment of
Web services in conjunction with existing applications, said Stefan Van Overtveldt, WebSphere's director of technical marketing at IBM. The kit supports
SOAP, UDDI, WSDL, and WS-Security. New kits will be released with support for new standards, Van Overtveldt said. "The key thing for us is to have a toolkit that corresponds with a specific level of
Web services so that you're guaranteed [interoperability] as you develop applications."
But while toolkits will ease development, they don't address the need for a broad-based architecture such as the one being developed by the W3C, said Tyler McDaniel, director of application strategies at Hurwitz Group in Framingham, Mass. "But at same time, the reality is that tools that save us time and cut corners will always be valuable," McDaniel said, particularly when it comes to giving developers control over the explosion of components jetting around in a services-based environment.
Cape Clear officials acknowledge the WSDL Editor is an attempt to encourage
Web services development, but they do not favor the adoption of toolkits for the consumption of
Web services. "Building a Web service is one problem, so yes, you will need tools and it can be a little complex with regard to ensuring performance, reliability, etc.," Maughan said. "But using the Web service is not complex and shouldn't be. All the quality of service features should flow to you seamlessly."
That's a notion shared by Ted Shelton, Borland senior vice president of business development and chief strategy officer, who noted enterprise software is becoming more accessible to end-users. "What I see is with each step in the technology evolution that
Web services becomes usable to a larger array of [application] spaces," Shelton said.
Meanwhile, BEA Systems is tackling the issue by relying on WebLogic Workshop and its extensions to meet the need for
Web services standardization compliance. The next release of WebLogic Workshop will add support for the WS-Security specification and other
Web services standards, according to the company.
Mark Jones and Steve Gillmor contributed to this article.
| |
 |
Dueling toolkits: Microsoft vs. IBM
Microsoft's WSDK (Web Services Development Kit) preview, released on August 26, put some flesh on the bones of a set of specifications including WS-Security, WS-Routing, WS-Referral, and WS-Attachments/DIME (Direct Internet Message Encapsulation). On the same day, IBM revved its Web Services Toolkit (WSTK) to level 3.2.2, reminding between-the-lines readers that its own WS-Security features debuted over a year ago. Considered side-by-side, these toolkits illustrate how SOAP-based technology is morphing from a firewall-piercing, Remote-Procedure-Call mechanism into a document-oriented fabric for the business Web.
The emerging styles seen in these toolkits should resonate well with both technical and business audiences. The dominant technical metaphor is none other than the good old
Unix pipeline. Microsoft's WSDK realizes the pipeline concept using chains of filters integrated with the .Net Framework's client-and server-side mechanisms. IBM's WSTK does the same kind of thing using the Apache Axis chaining framework. Axis handlers can be invoked, on the client or
server, both in front of and behind a requested service.
The dominant business metaphor is document routing. Think of a purchase order traveling through interoffice mail, collecting annotations and signatures. Both toolkits can use the mechanisms defined by WS-Security to sign and/or encrypt
SOAP messages. In practice that means adding XML Signature headers and altering parts of the bodies of the messages using XML
Encryption.
These two styles, pipelining and document routing, nicely complement one another in support of secure deployment of loosely coupled services. Today, for example, a secure
Web services conversation means an end-to-end HTTPS connection between two partners. When you inject intermediaries, each must perform complex gymnastics to facilitate trust and
encryption. With WS-Security's more granular approach, intermediaries can authenticate, decrypt, modify, and act on message parts of interest to them. Other message parts simply pass through, so the ultimate receiver can deal directly with the original sender.
Similarly, document signing is today an all-or-nothing affair. A conventional signature applies to a whole document, and its assertion that the document has not been tampered with fails to verify if even one character changes. Again, WS-Security's granular approach allows more subtlety. A
SOAP message carrying a business form can have regions signed by different people, and integrity checks can apply to parts as well as the whole.
Although Microsoft's WSDK is just catching up to IBM's WSTK with regard to WS-Security and DIME -- which the WSTK demonstrated in July alongside the more conventional MIME-oriented
SOAP with Attachments -- it breaks new ground with support for (and demonstration of) WS-Routing/WS-Referral. The
SOAP
router, which dedicates the ASP.Net interface for processing HTTP requests with custom handlers, acts on the To and Via elements of the WS-Routing specification. In the demo included with the toolkit, a
SOAP message bounces from one instance of a service to another; a referral file uses the rewriting feature of WS-Referral to alter the route dynamically.
These are the early days for this technology, but the prospects are intoxicating. In the network realm, consider how Akamai's EdgeSuite makes its overlay network into an adaptive
Web services grid.
SOAP routing points toward a generalization of that idea. In the business realm, think about workflow and orchestration. The ability to specify and adjust message paths helps bring such things to life.
These scenarios, which KnowNow co-founder Rohit Khare colorfully describes as "application-layer internetworking," could develop rather quickly and easily. The underlying TCP/IP protocols are, after all, well-understood and not controversial, and
SOAP routing does not interact with them in any complex way.
Implementing WS-Security, however, is not so straightforward. In our preliminary test of the WSDK, only the non-PKI-related examples ran without a hitch. Everything related to keys and certificates was, as it always is, a nightmare. This is no fault of the WSDK, whose APIs do an elegant job of encapsulating WS-Security-style signing and
encryption. There are just too many moving parts.
When an X.509 operation failed, was the trouble with permissions on the certificate
database, or the rights of the ASP.Net worker process, or with the certificate's trust chain?
Well, it was none of these, apparently. We'll figure it out eventually, but it's a nasty mess -- and not just on
Windows. The Java and OpenSSL PKIs are brain-melters too.
The XKMS (XML Key Management Specification), which pushes a chunk of
PKI complexity into the cloud, offers some hope. VeriSign and Entrust implement XKMS services today, and IBM's WSTK includes an early XMKS demo. But there's a scary amount of inertia to overcome. Until we get key distribution and management schemes that people can understand and use,
Web services
security is speeding toward a brick wall.
-- Jon Udell
|
|
| |
|
|
|
SPONSORED WHITE PAPERS
EMC
- Lower costs and improve reliability-Get the EMC CLARiiON white paper!
Ciphertrust
- Are you ready for Sobig.G? Learn how to protect your email systems.
CDW
- Personal attention. CDW. The Right Technology. Right Away.
EMC
- Explore key performance features and capabilities of EMC ControlCenter 5.1.1.
Intel
- Free Intel white paper shows you how to deploy a secure wireless LAN
Cisco
- FREE WHITE PAPER: BLUEPRINT to design and implement secure VPNs
Verity, Inc.
- "Mass Consolidation Hits the Web-Search Market"
McDATA
- Download a FREE storage consolidation white paper from McDATA(R).
Lucent Technologies
- Overcoming Common Firewall Limitations
Lucent Technologies
- Leverage Your Mobile High Speed Data Access. Download Free White Paper!
Nokia
- Get the scoop! Mobilizing business white papers & case studies.
BMC Software
- Maximize the Potential of Enterprise Data: Free white paper!
Network Associates
- Free white paper - Strategies for Optimizing Network Costs and Benefits
Entrust
- Manage identities across applications. Improve productivity.
Stalker Software
- CommuniGate Pro - Transform your Email and Calendaring
Remedy
- A NEW Gartner Research Note:Producing Quality IT Services
Search the IDG White Paper Library:
|
SPONSORED LINKS
|
