Jmp107 Web Services

JMP107: XML, Web Services and Domino 6 JMP107: XML, Web Services and Domino 6 (and other stuff too)(and other stuff too)

Bob Balaban, PresidentBob Balaban, PresidentLooseleaf Software, Inc.Looseleaf Software, Inc.

http://[email protected]

Agenda

Speaker Intro

Review of basic XML

Review of XML in Domino

Web Services defined

XML and SOAP

Finding Web Services "Out There"

Building Web Services "In Here"

Domino as WS client

Domino as WS server

Security?

The Road Ahead

Q & A

Pages 1-2 Copyright 2004 Looseleaf Software, Inc. All rights reserved

25 years as a software developer

10 years at Lotus/Iris

Spreadsheets

Databases

Notes: back-end classes for LS and Java, Agent Manager, etc.

Looseleaf Software since 1997

Technology investigations and Architecture

Development, training, writing

Products!

Member of The Penumbra Group

Is Bob available for consulting/development/training?

But of course!

About the Speaker

This Presentation is NOT on the Conf CD

But you can download a PDF of the slides and a ZIP of the demos from:

http://www.looseleaf.net(follow the link on the home page, check outthe XML Tutorial download too)


Other Sessions This Week

AD402: WebSphere Studio for Domino Developers

Balaban/Hobert, 12:15 Tuesday, Swan 5/6

HND102: Developing Servlets on Domino (Lab)

Paul Calhoun, 2:30 Tuesday, Americas Seminar

BP121: Domino + WebSphere Integrated Apps

Balaban/Hobert, 2:30 Wednesday, Swan Pelican

AD205: Web Services and Domino

Nikopoulos, 2:30 Wednesday, Dolphin S-Hem. 1/2

Review of Basic XML

Topics:

Structure and syntax of XML

Parsing tools for XML

Other tools for XML


XML Example

<?xml version="1.0" encoding="ISO-8859-1"?><OuterTag> <InnerTag attribute="something"> <SomeDataItem>XYZZY</SomeDataItem> </InnerTag>

<SingletonTag flag="whatever" /></OuterTag>

XML Example

<?xml version="1.0" encoding="ISO-8859-1"?><OuterTag> <InnerTag attribute="something"> <SomeDataItem>XYZZY</SomeDataItem> </InnerTag>

<SingletonTag flag="whatever" /></OuterTag>

This line is required!

Special tag delimiters


Big Deal?

So, what's the big deal?

It's a big benefit to put your data into a format that is compatible with transmission via HTTP

Which requires encourages TEXT (least common

denominator)

(In the old days, we'd barf on this idea)

(But now disk/RAM are cheap and CPUs are fast)

What if you really need to send binary data? (E.g., digital signature, encrypted stuff...)

Then you base-64 encode it first!

Big Deal - 2

XML allows for arbitrary nesting

So long as tags are "balanced"

Tag names can be anything

So, very flexible, can represent very complex data

Remember, it doesn't have to be parsed by humans!

And, if EVERYONE obeys the rules...

You can use STANDARD tools!

You don't have to write them yourself

And you can agree with others that you'll use XML to

share data


XML Is NOT A "Magic Bullet"

It's a tool, not a religion

While it does provide a structure for data exchange between applications....

There are many problems that it does not solve:

We still need LAYERS of conformity above the basic

XML spec

Such as:

Grammar (DTD, XSD)

Namespace segmentation

(See XML Tutorial on Looseleaf.net...)

However....

It IS the basis for all kinds of new structured data exchange

(So long as you can agree on the tags and formats)

I.e., Standards!

And it's not just limited to data

What if your "data" is the name of an "operation" and some "parameters"?

Then you have an XML-based RPC

And the basis for Web Services (ta da!)

As we shall see....


Parsing Tools

"DOM" parsers:

Tree/node orientation

You navigate the tree however you want

"SAX" parsers:

You provide event-oriented callbacks to the parser

You don't do the navigation, you get notified when nodes are reached during parser traversal

"XPath" parsers:

You provide path-like specs for the nodes you want

to examine

Output

DOM Parser

SAX Parser

XSLT

Your tree processing

code

Your SAX event

handlers

Output

Output

XML

Your XSL "stylesheet"

XML Parsers


XML "DOM" Parsing

Parsers available off-the-shelf for Java, C++ (for many platforms) and VB/LotusScript:

Xerces-C: xml.apache.org/dist/xerces-c/stable

Xerces-J: xml.apache.org/xerces2-j/index.html

A version of Xerces.jar comes with Domino and WebSphere

JAXP (Java API for XML Processing)

java.sun.com/xml/jaxp

Apache gives away source code for this (Java and C++)

MSXML - free download (No Sources) from Microsoft

Characteristics of DOM Parsing

The parser reads ALL the source XML at once

Builds an in-memory tree

Each "node" is a Java object

Use method calls on Node objects to navigate and retrieve attributes/data

NOTE: Not particularly appropriate if you have massive amounts of XML


Digression: TLAs

Everybody has heard of TLAs

"Three letter acronyms"

E.g., XML

But have you heard of "Doubly Nested TLAs"?

DNT

Which is itself a DNT!

There are rumored to be TNTs too (Triply Nested TLAs)

But I have not come across one

First person to provide me with a valid TNT wins their choice of a Looseleaf or CULT t-shirt!

XML "SAX" Parsing

SAX: "Simple API for XML"

A Double DNT! (DDNT, or D2NT)

Also available in the Xerces distribution


Characteristics of "SAX" Parsing

Parses input as a stream

Doesn't need to hold everything in memory at once

Invokes registered "ContentHandler" object with "event" notifications

start/end document

start/end element

processing instructions

You can call back (Locator interface) to get current line number, etc.

Content handler is responsible for own context!

Other XML Tools

XPath

XSL & XSLT


XPath: Navigating XML

With DOM you have to traverse the XML tree node by node

With SAX you have to wait for each node to be handed to you

What if you want to go straight to a nested tag in the XML input?

Use XPath!

But realize: XPath is built on top of DOM parsing

All of the XML must be in memory

<?xml version="1.0"?><doc> <name first="David" last="Marston"/> <name first="David" last="Bertoni"/> <name first="Donald" last="Leslie"/> <name first="Emily" last="Farmer"/> <name first="Joseph" last="Kesselman"/> <name first="Myriam" last="Midy"/> <name first="Paul" last="Dick"/> <name first="Stephen" last="Auriemma"/> <name first="Scott" last="Boag"/> <name first="Shane" last="Curcuru"/></doc>

Characteristics of XPath

/doc/name[1]

/doc/name[2]/@last

Disk path-like syntax to address tags in a file

For example:


XSL: XML Stylesheet Language

This makes "XSL" another DNT!!

But if you define it as "eXtensible Stylesheet Language", it isn't ;-(

XSL is really a programming language

Defining how to transform XML into other "shapes"

HTML

Different XML

CSV

Anything!

XSL - 2

And... the syntax is XML

Why? Because you already have parsing tools!

XSLT = XSL Transform

An engine for executing XSL against XML inputs

XPATH is actually part of XSL

XSLT is part of the Apache Xalan distribution

Evolved from LotusXSL

But not backward-compatible!

As we shall see


The Whole Idea of XSLT

XSLTEngine

appprocessingSource

XML

ResultXML

Stream

XSLStyleSheet

Result Tree

one or more templates in the XSL syntax

Apache Xalan, LotusXSL, ...

(Thanks to Mark Colan, IBMwww.ibm.com/developerworks/speakers/colan)

Unfortunately...

We don't have time for a full XSL tutorial

Get Mark Colan's excellent Freelance presentations and sample files

www.ibm.com/developerworks/speakers/colan


Agenda

Speaker Intro

Review of basic XML


Web Services Defined

XML and SOAP



Domino as WS client

Domino as WS server

Security?

The Road Ahead

Q & A

XML in Domino R5

There are a few ways to use XML with Domino:

Embed XML in pages

Write an agent to emit XML

Get Domino data in XML formats (from inside and from outside Domino)

Use XSLT to transform "native" Domino XML

Note: LotusXSL, NOT Xalan

Note: LOTS of info in the Designer online help

Search for "XML"

See my "XML Tutorial" on www.looseleaf.net


Writing an Agent to Print XML

Print "Content-type: text/xml" ' NOTE: don't need <?xml....?> tag, depending on destinationPrint "<BOOKCATALOG>"

While Not ( doc Is Nothing )Print "<BOOK>"Print "<bookTitle>"+doc.bookTitle(0)+"</bookTitle>"Print "<bookAuthor>"+doc.bookAuthor(0)+"</bookAuthor>"Print "<bookPrice>"+Cstr(doc.bookDiscountPrice(0))+"</bookPrice>"Print "<bookCategory>"+doc.bookCategory(0)+"</bookCategory>"Print "</BOOK>"Set doc = view.GetNextDocument( doc )

Wend

Not much to worry about

Using ?ReadViewEntries

This is what some of the R5 applets use

Many query options, see online help

Output conforms to the Domino View DTD


Using Notes APIs to Get XML

Notes/Domino use XML4J.jar

Original version of what is now Xerces

Also comes with LotusXSL.jar

Original version of Xalan.jar

If you have Sametime on the server too, you'll also have XercesImpl.jar and Xalan.jar

NOTE: LotusXSL packages (com.lotus.xsl) are DIFFERENT from the Xalan packages

And there's no Javadoc....

Notes APIs (R5)

Java only (can use from agents, servlets, JSPs, etc...)

Document.generateXML()

Can pass PrintWriter

Can return String

Creates "DXL" for document data

parseXML() on Item, RichText Item, EmbeddedObject, MimeEntity

ONLY IF THEY CONTAIN "raw" XML!

Returns org.w3c.dom.Document

XML DOM tree


Notes APIs - 2

String parser = "com.ibm.xml.parsers.NonValidatingDOMParser";NonValidatingDOMParser engine = (NonValidatingDOMParser)ParserFactory.makeParser(parser);String xml = .....;engine.parse(xml);org.w3c.dom.Document doc = engine.getDocument();

Or, you can use lower-level XML4J calls

But there's not much doc

Or, you can use the Xerces library

Which has full javadoc from Apache

XML In Domino 6

New LotusScript classes

"DXL"


LotusScript Java

Standard XML Tool Classes

NotesXSLTransformer

NotesDOMParser

NotesSAXParser

XSLTransformer

DOMParser

SAXParser

DXLClasses

NotesDXLExporter

NotesDXLImporter

DXLExporter

DXLImporter

"Helper" Classes

NotesStream

NotesNoteCollection

NotesStream

NoteCollection

New XML Classes in Domino 6

XML Standard Tool Classes

NotesDOMParser

Processes XML and produces a DOM tree

Tree consists of notes that represent design elements, attributes, text values, ...

NotesSAXParser

Inputs XML and signals events for each part of XML it encounters

Element events and comment events

Customer item, product item, ...


XML Standard Tool Classes

NotesXSLTransformer

Transforms DXL using a style sheet

Two inputs:

XML document

style sheet

Output can be final form

Output can be directed to:

NotesStream, NotesRichtext, or NotesSAXParser objects

DXL Classes

NotesDXLExporter

Exports Domino data to DXL

Converts a Domino document, document collection,

or entire Domino database to DXL

NotesDXLImporter

Takes data outside Domino and expresses it as DXL

Output from importer must be a Domino database


"Helper" Classes

NotesStream

Treats files and data as streams of binary data

Streams XML data to or from a memory buffer or file

NotesNoteCollection

Use to export just the design elements or data required

Reduces amount of data exported

Improved performance

Domino and XML

DXL Utilities in Designer

Select Tools -> DXL Utilities

Exporter

Viewer

Transformer


XML in Domino - Summary

Domino has added support for storing and parsing XML gradually since R5.0

Still not really treated as a "native" data encoding

You can use the "internal" tools via Java/LS agents

You can export/import XML (data & design!) with DXL tools

None of this has much to do with Web Services

Yet

Agenda

Speaker Intro

Review of basic XML



XML and SOAP



Domino as WS client

Domino as WS server

Security?

The Road Ahead

Q & A


"Web Servcices" Described

The "Web" evolved from static, hyperlinked text pages:

First to dynamic queries

Then to interactive form-based processing

But, always optimized for a Human at the browser

B2B, B2C, B2B2C.....

What about A2A?

Description - 2

Why not use the infrastructure of the Web for Application-initiated transactions?

HTTP, SSL

Same business logic and data stores

What would we use for data transfer formats?

XML!

We can also create conventions for using XML to invoke COMMANDS, not just "queries"


Description - 3

Web Services are analagous to RPC:

"Client" initiates a parameterized request over a network to a "server"

Server and target application are locatable over the network (DNS)

Request has well-known ID (method name)

Request has well-known parameters (primitives, objects...)

Response has well-known structure

So, What's the Big Deal?

This architecture has several big advantages:

Uses HTTP (and other!) transports

XML "wire protocol" allows for vendor (and OS!)

independence

"Meta" standards for description and publishing allow for additional automation

WSDL, UDDI

Publish, discover


Big Deal - 2

Provides standard ways for a business to:

Describe and Publish externalized services

Discover and use other businesses' externalized

services

Services can be used independent of:

Implementation

Platform/OS

Big Deal - 3

So, Web Services can be thought of as Business Components

Implementations of client (user) and server (provider) are no longer tightly-coupled!

Invocation/response are message-based

And the message structure is standardized


Web Services Building Blocks

XML - Data description

SOAP - Simple Object Access Protocol

XML request/response messaging

WSDL - Web Services Description Language

XML description of a service

And the usual XML Parser suspects!

Note: There's nothing about this thatis Java only!


Application Server

WebService WebServiceWebService



Application Server


WSDL(XML file)

Create WSDL description ofthe service


Application Server


WSDL(XML file)

SOAP Client Implementation

Use WSDL to implement SOAP clientcode



Application Server


WSDL(XML file)


SOAPRequest

Client sends SOAPinvocations to server...


Application Server


WSDL(XML file)

Client sends SOAPinvocations to server, receivesSOAP responses


SOAPResponse

SOAPRequest


Agenda

Speaker Intro

Review of basic XML



XML and SOAP



Domino as WS client

Domino as WS server

Tooling for XML & Web Services

Security?

The Road Ahead

Q & A

XML and SOAP Basics

Topics:

Syntax basics

Doing SOAP with Java is easy!

Doing SOAP with LotusScript is possible!

J2ee/.NET SOAP interoperability


Sample SOAP Message

POST /StockQuote HTTP/1.1Host: www.stockquoteserver.comContent-Type: text/xml; charset="utf-8"Content-Length: nnnnSOAPAction: "Some-URI"<SOAP-ENV:Envelopexmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><m:GetLastTradePrice xmlns:m="Some-URI"><symbol>DIS</symbol></m:GetLastTradePrice></SOAP-ENV:Body></SOAP-ENV:Envelope>

Sample SOAP Message

POST /StockQuote HTTP/1.1Host: www.stockquoteserver.comContent-Type: text/xml; charset="utf-8"Content-Length: nnnn

Standard HTTP POST wrapper


Sample SOAP Message

POST /StockQuote HTTP/1.1Host: www.stockquoteserver.comContent-Type: text/xml; charset="utf-8"Content-Length: nnnnSOAPAction: "Some-URI"

HTTP extended header for SOAP,specifies the "service" name

Sample SOAP Message

POST /StockQuote HTTP/1.1Host: www.stockquoteserver.comContent-Type: text/xml; charset="utf-8"Content-Length: nnnnSOAPAction: "Some-URI"<SOAP-ENV:Envelopexmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">...</SOAP-ENV:Envelope> Specifies content as a

SOAP message


Sample SOAP Message

POST /StockQuote HTTP/1.1Host: www.stockquoteserver.comContent-Type: text/xml; charset="utf-8"Content-Length: nnnnSOAPAction: "Some-URI"<SOAP-ENV:Envelopexmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><m:GetLastTradePrice xmlns:m="Some-URI"><symbol>DIS</symbol></m:GetLastTradePrice></SOAP-ENV:Body></SOAP-ENV:Envelope>

The "payload": Service method andargument(s)

Sample SOAP Response

HTTP/1.1 200 OKContent-Type: text/xml; charset="utf-8"Content-Length: nnnn<SOAP-ENV:Envelopexmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/><SOAP-ENV:Body><m:GetLastTradePriceResponse xmlns:m="Some-URI"><Price>34.5</Price></m:GetLastTradePriceResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>

The response"payload"


SOAP & XML

Obviously there's more to it than that

E.g., security (we'll come back to that)

What if your parameters (or the response) is a complex type?

Syntax allows for that

Apache SOAP can automatically serialize/de-serialize JavaBeans and other objects

Same with .NET

Upcoming sample shows this

Do you need to learn the syntax?

NO! (Only if it doesn't work....)

Sample WSDL

Nah, too boring

You never really read it anyway, not meant for human consumption

Most IDEs will generate it for you anyway

From JavaBean or EJB

From .NET interface

You can find one on the Web and download it

http://soap.amazon.com/schemas3/AmazonWebServices.wsdl


So, What's "UDDI"?

Universal Description, Discovery and Integration

(Doesn't that sound IMPORTANT??)

Really nothing more than a "Yellow Pages" for WSDL files

Store, categorize and make available

Businesses register their web services as WSDL

With some wrapper description

And a URL to their server

See www.uddi.org

Web Services and Java

Does Web Service implementation require Java?

NO!

Because any code that can generate/consume SOAP

messages (it's just XML!) can do Web Services

BUT: the best tools are available in Java

Many for free

E.g., IBM Web Services Toolkit (AlphaWorks)

Apache SOAP processor


How to Build a Web Service in Java

Client Java Code

SOAP.jar Web Container

SOAPServlet

Target JavaBean/EJB

(HTTP)

SOAP.jar

How to Build a Web Service in Java

Client Java Code

SOAP.jar Web Container

SOAPServlet

Target JavaBean/EJB

(HTTP)

SOAP.jar

Off-the-shelf code!(e.g., Apache.org)


How to Build a Web Service Client in Java

You can start with the Java class

Generate WSDL from a JavaBean, or EJB

You can start with the description (WSDL)

Generate a JavaBean stub

Implement the Client

Generate client stub from WSDL

Java code uses org.apache.soap package calls

You NEVER need to see the actual XML!

Provide the method name and parameters

Parse the response

Simple Client Code

Call call = new Call();call.setEncodingStyleURI(Constants.NS_URI_SOAP_ENC);call.setTargetObjectURI("urn:CourseRegistration");call.setMethodName("makeNewReservations");

Step 1: set up Call object with service& method names, encoding style

Based on Apache.org SOAP toolkit


Simple Client Code - 2

Vector parms = new Vector(2);params.addElement("arg1"); params.addElement("arg2");call.setParams(parms);

Step 2: Set up argument Vector, load into Call

Assumes arguments are all primitive types

No need for object serialization/de-serialization


URL url = new URL ("http://bblaptop1.looseleaf.net/soap/servlet/rpcrouter");Response resp = call.invoke(url, "");

Step 3: Set up the target server URL,send the message





Response resp = call.invoke(url, "");Parameter retvalue = resp.getReturnValue();result = (int)retvalue.getValue();

Step 4: Pull the response value out



Comments on Client Code

Normally you wouldn't write all this code

Just use your Web Services IDE (e.g., WSAD, VS.NET...) to generate it

Easy, given a WSDL description!

The Apache classes we used for the sample are NOT standard

But they are FREE!

What's standard is the XML message produced, and the response generated by the server


Comments - 2

Note that HTTP is not the only transport supported by SOAP

Just the easiest one to use

SMTP also supported (1-way SOAP)

Others coming

We don't even know (for sure) what the server side is implemented in

Implementing Web Services In J2EE

All the major IDEs have wizards for this now

We'll look at WebSphere Studio Application Developer

All generate approximately the same code

Java

Servlet-based SOAP parser

Registry of SOAP services


(Tells theservlet how to map servicename to Java class)

J2EE SOAP Implementations

HTTP Web Server

SOAP Servlet

ServiceRegistry Java Service

Java ServiceJava Service

Java ServiceJava Service

Java Service

(Classes loaded& invokeddynamically)

WSAD Steps

public class UniqueNumber{

private int theNumber = 0;

public synchronized int nextNumber(){

return ++theNumber;} // end nextNumber

} // end class

Create new Web Project (in some Enterprise Application)

Create the JavaBean (UniqueNumber.java)


Steps - 2

Invoke Web Service wizard

Right-click project, New->WebService

Select "JavaBean Service"

Next, select UniqueNumber as the class

Next, select URI for the service

Next, select/de-select public service methods

Specify that you want a proxy and test client automatically generated

Steps - 3

WSAD will:

Generate JSPs for client-side testing

Generate WSDL files

Add the SOAP servlets to the project

Create an Admin client to access the SOAP services registry

Configure a server test environment

Launch the test client (1 time only!)


Demo: Amazon.com

Download free toolkit from amazon.com

Register, receive "developer tag" (also free)

Used to track who is accessing their server

Point WebSphere Studio wizard to amazon.com WSDL

Generate Java SOAP client

With all supporting JavaBeans!

http://soap.amazon.com/schemas3/AmazonWebServies.wsdl

Agenda

Speaker Intro

Review of basic XML



XML and SOAP



Domino as WS client

Domino as WS server

Security?

The Road Ahead

Q & A


Can We Move It to Domino?

Yes, with some tweaking

Copy/paste client code as a Domino Agent

Put support JARs in \notes\jvm\lib\ext

Does NOT work if you add them to the Agent!!

NOTE: Do NOT waste time trying to build a Domino Web Service using the Domino Servlet Manager

Incompatible with Apache soap.jar

Not reliable under load

Domino Java Web Service Client

Demo: AmazonWSSample.nsf


Domino/LotusScript Web Service

Domino can be the server too, using LotusScript

Or Java

But you have to do more typing

You would probably use the MSSoap/MSXML libs

Web Services in Domino With LotusScript

LS agents can operate just as servlets do

We could write a bunch of LS code to parse XML/SOAP requests....

Or, we could use the Microsoft COM library for SOAP

Microsoft SOAP Toolkit

Call it from LS

Or, in ND6, call Java from LS

LS code can be either client or server


WebServices/Domino Demo

Demo: WebServiceAgentR5.nsf

LotusScript agent that uses MS COM libs to parse incoming SOAP/XML

Responds with XML via "Print" statements

Domino is the server

VB client

Thanks to Gary Devendorf of IBM Microsoft

Overview: Web Services and .NET

It would be a mistake to think of Web Services as belonging only to Java or J2EE

Visual Studio.NET makes creating Web Services very easy

VB.NET, C#, J# or (managed) C++

In fact, easier than WSAD

Of course, it requires using IIS


.NET - 2

.NET client

j2ee client

j2ee server

.NET server

Web services implemented in .NET are fully inter-operable with J2EE

Because of the SOAP/XML "wire protocol"

IF: everyone does their job and follows the specs!

.NET - 2

And, everyoneuses compatiblecharacter sets!

UTF-8, UTF-16ISO-8859-1,ISO-8859-8

SHF-JIS?Chinese

Web services implemented in .NET are fully inter-operable with J2EE

Because of the SOAP/XML "wire protocol"

IF: everyone does their job and follows the specs!

.NET client

j2ee client

j2ee server

.NET server


Can You Do Domino Web Services on .NET?

Sure, why not?

Install XP (comes with .NET), or install .NET on Win2000

Write a Web Service in VS.NET using C# (or whatever you like)

Use the Domino COM interfaces to access NSFs

NotesSession s = new NotesSession();

See Lotus Advisor, Sept. 2002 article by John Duggan

www.advisor.com, article ID DUGGJ08

Agenda

Speaker Intro

Review of basic XML



XML and SOAP



Domino as WS client

Domino as WS server

Security?

The Road Ahead

Q & A


Web Services and Security

What security?

"Optimistic security" == "No security"

What About Security?

Let's think about what you would need:

Message reliability (did it get there, or not?)

Make the XML traffic unreadable (encrypt it)

Selectively encrypt message (e.g., payload only, not routing info)

Authenticate requests on server

Authenticate responses on client

Specify access control to services on server


Security - 2

What do we have "accepted" solutions for?

Meaning: standards, plus implementations

Make the XML traffic unreadable (encrypt it)

SSL (easy)

Or other key-exchange (easy)

Authenticate requests on server

Requires some kind of digital signature

Which requires shared certificate chains

And trusted directory

And PKCS infrastructure

Security - 3

Authenticate responses on client

Ditto all

Specify access control to services on server

Requires authenticated user (as above)

And a trusted directory service

In short, nothing has quite made it happen yet

Therefore, most implementations are for:

Trivial, public data (weather, phone numbers, zip codes...)

On secure intranets


Security Standards for WS

But some standards are emerging:

SSL client certs

Can authenticate client with server, but what if the service is multi-hop??

Still need access control infrastructure

No digital signature/integrity

No selective encryption (all or nothing)

Security Standards - 2

WS-Security

Message-level, credentials are attached to the XML

Credentials travel with the message

Proposed by IBM, Microsoft, Versign, April 2002

WS-Security requires some kind of key-management

Interoperable with:

PKI, Kerberos, SAML, XrML, X.509....

Not complete, doesn't address all issues


Other Security-Related Spec Work

HTTPR - "reliable HTTP"

Extension to HTTP 1.1

If message arrives, guarantees that only 1 copy

arrived

If message doesn't arrive, you know it

Proposed by IBM July, 2001

Still in the works

More Specs to Come - 2

BPEL-WS

"Business Process Execution Language for Web Services"

Proposal by IBM, Microsoft, BEA, August 2002

Meant to replace Microsoft XLANG, IBM WSFL

Transactions:

WS-Coordination, WS-Transaction

Synchronous (you wait) and Asynchronous (you

don't) modes


So, Where Is WS Security Today?

Requirement Solution Spec(s) Wide use?Message reliability Custom

(hard!)HTTPR No

Wire encryption SSL, HTTPS many Yes

Selective message encryption

Custom WS-Security, etc. No

Authentication Custom X.509, SSL Certs, Digital sig., SAML

No

Access control Custom LDAP, various products Maybe?

Of the requirements we had:

Security Issues Needing Solution

Multi-hop SOAP

Client->Server->Server->Server

Credentials, signature, etc. must follow all the way

Agreement on order of operations

Sign first, then encrypt?

Encrypt first, then sign?

Is there a way to do ACL in a cross-product fashion?

Perhaps not. Directories will rule!


Security Within WAS

If you're using all IBM platforms you get more choices

WebSphere Studio lets you create Web Serivces (and clients) with WAS-only security options

WAS v5.02

WSAD 5.1

XML digital signatures

XML encryption

NOTE: You have to pick the SAME security option for BOTH client and service!

Agenda

Speaker Intro

Review of basic XML



XML and SOAP



Domino as WS client

Domino as WS server

Security?

The Road Ahead

Q & A


Web Services: What's Coming?

Agreement on all the security issues

(We hope!)

Better inter-op between IBM and Microsoft

(We hope!)

Better performance

Migration to Apache Axis lib

Domino 7 "Web Services" object

Designer framework for WS clients and servers

On Domino!

Go to the Nikopoulos session, 2:30 Wednesday

Wrap Up

Web Services: Another flavor of RPC

EXCEPT that you don't need to know/care what the other end is implemented in

AND you might not have to touch any code at all

WSDL describes everything in XML

Pretty good tools now for:

Generating proxies for a given WSDL

Generating WSDL for a given interface

Publishing your WSDL to public/intranet repository


Is Domino a Player?

A lot depends on the D7 "web services" object

We should all show up at that session

The best tools are Java and .NET

Domino can still be the back-end data source, via COM/Java APIs

You can do "real" Java Web Services with Domino + Apache Tomcat, or WebSphere

WebSphere Studio has great code generation and testing/deployment tools

Summary

Web Services is an important technology frontier

Web Services is still in the early stages of specification

By which we mean: it isn't secure yet!

There are many benefits:

Based on widely accepted standards (XML, SOAP)

Provides inter-operability among vendors

And platform architectures!

Unlocks A2A data/service transfers


Summary - 2

But there are lots of limitations

Domino may be a minor player

Domino can be a W-S consumer, for sure

Security is not there yet

More standards needed

So real-world implementations are restricted

Intranet

Public data/services

Summary - 3

One interesting bit of speculation:

The future of W-S may not lie with HTTP transports

Imagine doing W-S over IIOP

Secure, session-oriented

Solves some reliability issues

Doesn't solve all security issues

Or wireless....

Or SMTP (fire and forget)


Resources

UDDI: www.uddi.org

SOAP: www.apache.org

xml.apache.org/soap

WSDL: www.w3.org/TR/wsdl

IBM Web Services Toolkit

www.alphaworks.ibm.com/tech/webservicestoolkit

(Production version embedded in WSAD)

Sun Web Services- samples, doc, etc.

java.sun.com/developer

Resources - 2

Microsoft SOAP Toolkit

www.microsoft.com/soap

Redbook "Web Services Wizardry with WSAD" (SG24-6292)

Redbook "WSAD Programming Guide" (SG24-6585)

"Web Services Wizardry with WSAD" (SG24-6292)

Mark Colan's "speaker" page

www.ibm. com/developerworks/ speakers/ colan

IBM-.NET Inter-op tutorialhttp://www-106.ibm.com/developerworks/websphere/techjournal/0202_lu/lu.html


Resources

"Lotus Notes & Domino 6 Programming Bible", Brian Benz and Rocky Oliver

http://www.ndbible.com

Lotus and WebSphere Advisor Magazines

http://www.advisor.com

WebSphere Advisor, Feb. '04 (in your conf. bag), "Web Services Step-By-Step", Jeff Miller

Lotus Advisor, Jan. '04, "Mapping With Microsoft MapPoint.NET", John Duggan

Apache Web site - http://www.apache.org

IBM developer resources - http://www.developer.ibm.com, http://www.alphaworks.ibm.com

Resources - 2

Microsoft - http://msdn.microsoft.com/webservices

Nice article on Microsoft/J2ee Web Services interoperability

Lotus - http://www.lotus.com/ldd

No special area for WS, need to search around

Gary Devendorf's sites

http://lotuspro.e-promag.com/DPGary.nsf/GarysList?OpenForm

"Gary's Page"

Looseleaf Technical Forum

http://www.looseleaf.net

IBM Redbooks

http://www.redbooks.ibm.com

Search for "Domino"


Please complete your evaluations

Q&A

Visit the Looseleaf technical forum:http://[email protected]

Any takers on the TNT contest?


Jmp107 Web Services

Technology

Transcript of Jmp107 Web Services