You are on page 1of 20

Business White Paper

Getting Started:
Prepared by

y o u r g u i d e t o s o a s u c c e ss
the soa competency center
Content
contents Introduction

Introduction 2 More and more organizations are turning to a Service-Oriented Architecture


(SOA) to increase productivity, enhance operational efficiency and agility, and
What is a align their IT infrastructures with business strategies. To help enterprises take
Service-Oriented Architecture? 3 advantage of these significant benefits, Software AG has created a unique SOA
¬ SOA Assumptions 3 Competency Center – an organization with dedicated and extensive SOA exper-
¬ What is Re-use? 3 tise. The SOA Competency Center exists solely to help organizations:
¬ Re-use Hurdles 4
¬ Starting Point 5 ¬ Understand the value of SOA in their unique environments
¬ Develop and implement an SOA strategy
Building an SOA Roadmap 5 ¬ Measure the benefits of SOA based on business objectives
¬ Establish an SOA Vision 6
¬ Establish an SOA Methodology 6 This high-level white paper, created by the SOA Competency Center, gives you
¬ Link SOA with Key Business Initiatives 6 insights into key considerations that can help you successfully launch an SOA.
¬ Create Architectural Blueprints 6 Use this guide to understand best practices that can get your organization off
¬ Assess Risks 6 to the right start.
¬ Create an SOA Risk Mitigation Strategy 7
¬ Re-use through Services-Design Approach 8
¬ SOA Governance 8
¬ SOA Security 9

Software AG’s Approach to


Implementing SOA 11
¬ Step 1: SOA Enablement 11
¬ Step 2: Synthesis – Single Views
and Service Orchestration 13
¬ Step 3: Process-Driven Integration 16
¬ SOA Visibility and Governance with
a Services Repository 17

Conclusion 18

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

What is a Service-Oriented services are but one example of a standards-
Architecture? based implementation.

The SOA landscape is strewn with buzz- SOA Assumptions


words, conflicting technologies, architec- Most people make these basic assumptions
tures and pitfalls. There’s no single approach about SOA:
or “solution.” So exactly what is an SOA –
and what does it provide? ¬ No need to rip-and-replace existing sys-
SOA is an application architecture, in tems
which application components or “services“ ¬ SOA and Web services standards help to
are well defined using common interfaces, ease the pain of integration
utilize a contract to define how services ¬ SOA allows the re-use of existing applica-
will be invoked, and interact in a loosely tions (home-grown and packaged)
coupled manner.
In this paradigm, the terms “client” Re-use is one of the prime motivating and
and “server” are purely situational. At one success factors of SOA. But what does re-
moment, an application could act as a cli- use mean in the context of SOA? Does it
ent by calling an external service, while imply the re-use of only newly created
moments later, it may act as a service-pro- Web services? Does it also include the re-
vider when called by another application to use of existing applications? Does it include
perform a task. the re-use of existing programming and
When properly implemented, SOA technology best practices, and/or software
promises to end the building and mainte- development guidelines? Also, how do we
nance of point-to-point integrations. Using achieve re-use?
SOA, businesses will be able to generate Many organizations that have em-
new services in a flexible and agile way by barked on the SOA path have come to real-
combining existing logic and exposing it via ize that achieving true re-use is not as
reusable services. simple as creating Web services and mak-
SOA isn’t new. In fact, technologies ing them available for consumption. Many
like CORBA and DCOM promised SOA in the different factors complicate the simple act
1990s. Both CORBA and DCOM introduced a of using services that have been made
high degree of complexity, and services available within an enterprise.
based on these protocols were not truly Understanding the nature of re-use
interoperable by being vendor-dependent. within the context of SOA and how to gen-
Thankfully, today XML and Web services erate the adoption of services are key steps
offer a truly standards-based approach to toward realizing the promise of SOA.
developing services that can be consumed
by many different types of applications – What is Re-use?
regardless of the application-development Let’s take a moment to explore what re-
technologies at work. use means in the context of SOA. Re-use
It’s important to note that not every can take many different forms. A simple
SOA is based on Web services. Rather, many definition of the term is the ability to
different technologies, protocols and stan- repeatedly use the exact same service,
dards can be at play within an SOA. Web component, procedure, guideline or pro-

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

cess by various people or service consum- Many organizations find that to successfully
ers in order to fulfill a given task. From this implement an SOA and get the appropriate
definition, it is clear that reusability extends levels of re-use, they need firm support
beyond the mere re-use of Web services or from all levels within the IT organization.
existing applications exposed as Web ser- Management support is most crucial
vices. This definition also implies other since management drives the IT strategy,
focus areas and disciplines that build a cul- provides funding for these kinds of initia-
ture of collaboration – which provides the tives and provides backing when important
means to create true services re-usability. decisions have to be made.
When planning and designing an SOA, Likewise, without the support and
Software AG focuses on the following areas participation of IT architects, managers and
to establish a culture of re-use: development teams, an SOA initiative is
likely to fail. It’s much easier to achieve
¬ Best practices SOA re-use goals when development
¬ Guidelines and policies teams are committed to soundstrategy and
¬ Architectural blueprints follow established guidelines and best
¬ Organizational structure practices.
¬ Communication
¬ Services and metadata repository Lack of guidelines and best practices: Many
SOA implementations struggle with lack of
We call this the “Services Adoption Frame- focus and conflicting agendas. That’s why
work.“ (See Figure 1.) you need to establish a clear SOA discipline
with pragmatic best practices and program-
Re-use Hurdles ming guidelines. Most programmers learn
Re-use of services is often more compli- to code by example. The most effective way
cated in practice than in theory. There are of helping programmers adopt Web ser-
many reasons for this. The most frequent vices and SOA is by providing them with
problems include: practical examples and guidance on how
Lack of organizational support: You to create and consume Web services. At
need the appropriate support from both the same time, you have to help program-
developers and management when imple- mers avoid common mistakes and bad pro-
menting an SOA. The biggest challenge is gramming techniques that cause inefficien-
not always related to technological issues. cies and interoperability issues.
The biggest challenge is usually the busi-
ness culture. Interoperability: Interoperability issues make
Implementing an SOA implies change, it difficult for consumers to interact with
sometimes lots of change, and people deal service producers. Often a consumer can
with change in different ways. To some interact with a Web service that uses the
extent all of us are resistant to change – RPC binding style. Yet the consumer can’t
especially when we haven’t been included interact with a similar Web service that
in a decision that impacts us or when we exposes itself using a Document/Literal
might not agree with a given approach. binding style. Sometimes consumers are

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS


unable to deal with complex data types SOA requires improved levels of communi- and implementing an SOA, it is best not to
created by exposing a legacy application. cations, which can be facilitated by the cre- just dive right in.
Developers can prevent such issues ation of a cross-functional team of people The initial methods used to create,
by establishing programming guidelines who represent different areas within the deploy and consume Web services usually
and best practices and by following estab- organization. This core group (or Compe- establish a pattern of behavior, which might
lished architectural blueprints. By anticipating tency Center) can be instrumental in estab- be difficult to change later. It is best to first
interoperability issues, the architectural team lishing and adopting best practices andcor- establish practical guidelines and best prac-
can put a framework in place to address porate standards. First and foremost, tices. Experience is a great teacher, and trial
these incompatibilities if they arise. however, the function of such a group is to and error helps establish what works and
share their thoughts, experiences and what doesn‘t. If you don‘t have the
Lack of standards: This can lead to compet- knowledge. By improving the way in which resources or experience, it might be worth
ing approaches of how to create, expose we relate and communicate with each the effort (and expense) to obtain the help
and consume services. Some developers other, the more likely we are to succeed in of someone who has a proven track record
assume you have to use Web services our SOA implementation efforts. of planning and implementing SOA.
when creating an SOA. But Web services
are not mandatory. Other developers prefer Starting Point
to use XML or XML RPC or even REST style When implementing an SOA, you need to
of Web services. This can lead to many prac- decide where to start. The temptation Building an SOA Roadmap
tical issues when implementing an SOA. might be to immediately start building
The best approach is to establish and Web services. Many organizations take this Software AG believes an organization needs
adhere to relevant standards. These standards route. If the scope of the project is only to to consider many different factors that are
can be enforced through the use of a ser- create a number of Web services, this critical to SOA success before undertaking a
vices repository. This repository can perform approach might work. But when designing project of this scope.
compliance tests against a Web services
Interoperability (WS-I) basic profile, for
example, to ensure that all published ser-
vices comply with relevant specifications.

Communication
Services discovery: Many organizations have
no effective means of determining which
services exist and how to get to them. To Services
avoid this, we encourage a structured man- Organization Best Practices
agement approach and a central location to
store all the metadata and artifacts related
Services
Services

Existing
to the services within the SOA. Applications

Poor communication: The adoption of SOA Architecture Guidelines & Policies


is driven by the ability to integrate silo- Services

based applications. In order for the applica-


tions to communicate in more efficient
Services & Metadata
ways, the IT organization also has to adopt Repository
the way it communicates. Figure 1:

Services Adoption Framework

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS


Establish an SOA Vision processes into highly leveraged, shared once and documenting them by creating
The first step to creating an SOA is estab- services that cost less to maintain. architectural blueprints and/or best prac-
lishing a clear vision of what the SOA will tices, your team can achieve a certain mea-
be and what value it will provide. Too often, Responsiveness: Rapid adaptation and sure of re-use. Establishing these blueprints
companies rush to implement an SOA with- delivery of key business services can meet is one area where re-use can have a direct
out clearly identifying the business value or market demands for increased service lev- effect on how services are created and on
the ideal end-state. Once expectations are els to customers, employees and partners. their reusability within the established SOA
misaligned, the success of the overall SOA infrastructure.
implementation can be jeopardized. Adaptability: Changes can be made through-
out the business with minimal complexity Assess Risks
Establish an SOA Methodology and effort, saving time and money. As with any new IT initiative, an SOA imple-
Establishing a clear and consistent method- mentation will introduce some level of risk
ology is equally important to an SOA initia- These promises are certainly attractive. Yet into the organization. Ultimately, the orga-
tive. For instance, exposing a specific func- what’s most important is establishing the nization needs to evaluate and assess the
tion in an application as a Web service may tangible value of an SOA by linking its ini- risks that will be assumed. Only then can
be possible. But, will it serve the needs of the tial implementation to a specific business you develop a clear plan for risk mitigation.
overall SOA? Your IT organization needs to initiative.
establish core principles surrounding the SOA At the start of your project, you must Security: Security is a critical component of
then consider potential applications. It may ask this fundamental question: “How will any SOA implementation. Yet, often secu-
be useful to build a set of best practices the development and deployment of ser- rity is an afterthought. Security should be a
over a period of time. These practices will viceshelp meet a stated business objec- key concern because the amount of XML
become the core of a proven methodology. tive?” A definitive answer to this question documents will increase dramatically as
will helpdefine initial steps related to pur- your organization begins to introduce a
Other important questions to consider: pose and goals. larger number of Web services. The increase
¬ What constitutes a service? in XML traffic will raise questions about the
¬ Will you use a consistent toolset for build- Create Architectural Blueprints vulnerability of the data that is shipped
ing and deploying services? Next, you will need to define an architec- between endpoints. Security and risk are
¬ Will different groups be able to make tural roadmap and blueprints. These blue- not always limited to outside exposure and
independent implementation decisions? prints are extremely useful in guiding the may even play just as an important role
¬ Would it make sense for the organization development teams by addressing specific internal to the organization.
to establish a cross-functional SOA work design areas within their applications. You will need to verify some basic
group to develop and share best practices? properties of these documents, such as:
¬ How will the organization measure prog- Blueprints may include:
ress, and how will it judge end results as ¬ Common security model ¬ Where a particular document originated
successful or unsuccessful? ¬ Service orchestration model ¬ Who created the document
¬ Metadata management ¬ How documents were received
Link SOA with Key Business Initiatives ¬ Process integration model ¬ If documents have been tampered with
The vision of SOA promises a number of ¬ Web services compliance model or modified in any way
high-level business benefits, such as: ¬ Whether the content is accurate or correct
Too many times development teams have ¬ Whether the content is safe
Efficiency: Business processes can be trans- to “reinvent the wheel” to solve a particu- ¬ How the documents are routed to mis-
formed from isolated silo and replicated lar problem. By solving these problems sion-critical applications

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS


¬ What impacts would occur should appli- you will need to consider how to handle
cations receive malformed documents instances in which services do not interoper-
¬ What impacts would occur if a document ate properly. How will you deal with these
contains an incorrect or false date exceptions? What are the best practices for
¬ How the inflow and outflow of XML and ensuring interoperability in the future?
Web services are tracked and audited
across the enterprise Approaches to failure: As with any initia-
tive, some approaches will be deemed
These are just some of the topics that must overly risky or doomed to failure. As part of
be addressed. We will discuss some of the a risk assessment, you can identify such
options for security later in this document. approaches based on experience and exist-
ing best practices.
Interoperability: Interoperability is another
key risk of an SOA. Despite the promise of Generally, avoid these flawed approaches:
Web services, organizations will discover that ¬ Unnecessary re-engineering of existing
not all Web services are truly compatible. For applications
example, Web services created in .NET and ¬ Unnecessary extension or change to exist-
Java have slightly different implementations ing standards
based on different interpretations of exist- ¬ “Big-bang” approach to implementation
ing standards. Moreover, software products rather than focusing on a tactical project
that function as “Web service adapters” for
existing applications may not always inter- Create an SOA Risk Mitigation Strategy
operate with other Web services. As change is introduced into the IT infra-
structure, new risk is introduced as well.
As your organization moves towards SOA SOA is not a magic solution, no matter how
implementation, Software AG recommends easy technology vendors make it sound.
that you monitor the efforts of the WS-I There are some clear and recognizable risks.
organization. The core mission of the WS-I Identifying these risks upfront and creating
is to be: “an open industry organization a thorough mitigation strategy are impor-
chartered to promote Web services interop- tant steps to limit risk. The value of follow-
erability across platforms, operating sys- ing these steps should not be underesti-
tems and programming languages.” The mated.
WS-I develops test suites such as the basic
profile, which provides an interpretation of Identify Key Win Areas
a core set of Web services specifications Risk mitigation usually begins by assessing
(such as SOAP, WSDL and UDDI) to promote the general SOA implementation approach.
interoperability among implementations. Avoid the “big-bang” approach, since there
In practical terms, the WS-I produces test are so many unknown factors that might
suites that can be run on Web services to arise and jeopardize the project. Keep in
ensure their adherence to the basic profile. mind that every situation and organization
While such efforts help prevent is unique, and each SOA implementation
instances of incompatibility in the future, will face its own unique set of challenges.

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS


By identifying quick-win scenarios, you can ¬ Services needed used to discover the existence and location
design, build and deploy a first use case, ¬ What their interfaces should look like of services.
which can serve as a reference for future ¬ Scope of each service
projects and provide valuable insight into ¬ Granularity of each service Monitoring, logging and tracking services:
SOA principles as well as your chosen Due to security concerns, industry and gov-
approach. This process also helps you eval- Often services are created, and no consid- ernmental regulations, it is prudent to track
uate the technologies used to build the eration is given to these factors. This has a which services are being used, how often
prototype – whether they will work for the direct impact on how usable the service and by whom. Keeping track of this infor-
application and be able to sustain a larger, will be to potential consumers. By follow- mation can be crucial for future reference
more demanding scope. More importantly, ing the services-design process, you can and audit events.
this process helps bring problem areas and evaluate the requirements for different ser-
challenges into focus. vices and how they will be used. A good Creating and enforcing contracts and ser-
The objectives of a first use case are services-design process yields a highly vice level agreements: Due to the loosely
to learn from the experience and to test reusable set of services. coupled nature of an SOA, it’s a good idea
the SOA principles being investigated. Your Figure 2 on page 9 shows a service- to investigate new technological develop-
thorough test research should look at all design specification and its various aspects. ments that can help specify and enforce
aspects of the SOA implementation, namely: basic service levels between consumers
SOA Governance and producers. For example, a service such
¬ Interoperability SOA governance is a key concept to address as trade date routine might be invoked by
¬ Security when starting your SOA initiative. Here’s why: many different applications. Due to the
¬ Performance In large, complex SOA implementa- financial nature of many of these consum-
¬ Scalability tions, service management problems can ers of the trade date routine, it would be
¬ Ease of use arise after the first services have been reasonable to expect a minimum level of
¬ Manageability deployed. The larger the number of ser- service. For instance, if the maximum
vices created and the more people involved, expected response time for the trade date
This valuable process provides a perfect the more complicated the problem is likely routine is 500 ms, any scenario in which
learning experience that can be used to to become. response time exceeds this value might be
better understand different aspects related SOA governance is about how the indicative of a problem and should be dealt
to the SOA implementation. This experience SOA efforts should be managed and con- with accordingly. Unless a prior contract
can also be used to train staff in the wide trolled. It is about how the different groups, exists between the consumer and the trade
range of skills and technologies required to participants and services should operate date service itself, there would be no way
successfully implement an SOA. Use this within the larger SOA framework. Core con- to measure and enforce such a service
approach to learn and improve techniques siderations for SOA governance include: level agreement.
used during development, deployment and
management of the SOA infrastructure. Adhering to standards: It’s best to create a Managing services and metadata related
common standard to be followed by every to each service: Initially you may create
Re-use through Services-Design service provider. For example, in the case only a small number of services. But as the
Approach of SOAP, different binding protocols can be SOA becomes more widely accepted and
When creating services, it is important to used. But the standard should dictate a pre- understood within the organization, the
start with a services-design specification. ferred method. adoption rate and corresponding creation
By starting here, you can identify: of services can rise dramatically. You will
Publishing and identifying services: Each need to manage these newly created ser-
service should be published in a common vices. To do this, you must determine:
services repository. This repository can be whether a particular service exists; whether

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS


there might be duplicates of the same ser- SOA Security
vices; and who owns a particular service. XML and Web Services Security Challenges
These issues can be addressed by using a Application-level security is an important
central repository to store and publish exist- aspect of the overall security program. As
ing services. new technologies and protocols become
available and are implemented in produc-
Secure services management: When you tion situations, you should give careful con-
create viable SOA governance policies early sideration to the overall security architec-
on, your organization can cultivate good ture. With the advent of Web services and
habits, and avoid less desired habits or XML, there are new ways to exchange data
approaches. The SOA initiative, in all likeli- and interact with dynamic online services.
hood, will be very visible within the orga- The requirement for security is directly
nization. With sound governance policies related to the extent of the services pro-
and procedures in place, you can limit the vided, as well as the reputation of the ser-
risk of potential failure or conflict due to vice provider. It is crucial that the end user
bad design, conflicting approaches, and or business partner trust the service pro-
poorly documented and publicized services. vider. Likewise, the service provider must
Governance is important in the main- establish a trust relationship with the end
frame world and in many other areas user or business partner. This trust relation-
within the IT infrastructure. The same holds ship is crucial when conducting e-business.
true in the SOA world. (See next section on With the introduction of XML and Web
SOA security for details.) services, hackers are finding new ways to

Figure 2:

Sample Service Design Specification

SOA Governance

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS


attack and exploit the corporation’s internal the control of user identities (accessing the
systems. This occurs even though services XML and Web service-based applications)
may not be commercial in nature. XML and as well as the data they transmit. The
Web services use standard protocols such server blocks unauthorized access, mali-
as HTTP and TCP/IP and technologies such cious attacks and malformed data.
as Web servers and applications servers.
These protocols and technologies are Identity management: Web services secu-
the frequent target of hackers, and the rity servers usually integrate or synchronize
cases of security breaches are numerous. It with the existing identity management
is, therefore, essential that you give partic- infrastructure, such as LDAP, to perform
ular care to how these technologies and authentication and authorization for XML-
protocols are implemented and used. You and Web service-related traffic.
can mitigate many vulnerabilities simply
through the correct configuration of Web Real-time monitoring: Web services secu-
servers, application servers and other com- rity servers also provide real-time alert and
ponents. intrusion detection. This information can be
useful when monitoring XML- and Web ser-
Web Services Security Server vice-related traffic and performance. The
There are a number of commercial products servers log incoming traffic as well as any
and companies in the marketplace that intrusion attempts. They also notify secu-
focus exclusively on Web services security. rity personnel of attacks in progress so per-
The role of the Web services security server sonnel can act appropriately. In addition,
is to protect XML and Web service traffic this information can be directed to a net-
according to a set of configurable security work management tool using SNMP.
rules. It protects XML- and Web service-
based applications by ensuring that only Threat awareness: Web services security
authorized users and applications are servers include support for a wide range of
allowed to send data or connect to the ser- rules related to content filtering and traffic
vices provided, that the appropriate level of analysis. These rule sets are designed to
encryption is applied and so on. protect the XML and Web service applica-
Web services security servers can be tions from malicious or malformed XML
devices or software, and they will play an and SOAP data. In addition, the Web ser-
increasingly important role in the adoption vices security server plays an important
and implementation of XML- and SOAP- part in guarding against:
based applications within the enterprise.
Here’s a general overview of the fea- ¬ XML denial-of-service attacks
tures and functions of Web services secu- ¬ Buffer-overflow attempts
rity servers: ¬ Malformed or invalid XML
¬ Unexpected MIME-Types in SOAP attach-
Policy-driven security: A Web services secu- ments
rity server can be configured with appropri- ¬ Service scanning
ate policies to combine content filtering ¬ Brute-force “flooding“ denial-of-service
with identity-based rules. This allows both attacks

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

10
These security servers also can perform to leverage your existing investments. We ated with such a change could be too great.
blacklisting functions and alert network then identify which parts of these systems However, allowing these applications to
firewalls further upstream by reporting the need to be “exposed;” that is, which would participate in an SOA can be extremely
IP addresses of senders of malicious or provide the most value when transformed valuable. In this case, an integration solu-
malformed XML data. into services. tion can provide flexible access to terminal
Next, we determine the types of sessions and allow them to participate in
Audit capability: Today’s businesses are information typically requested, so we can an SOA.
faced with a growing number of regula- determine what functionality would solve Session integration is the ability to
tions, statutes and standards. To comply the most pressing information demands. intercept and interpret the screen informa-
with these mandates, organizations have Only then can we determine the different tion that is passed back and forth between
to provide audit capabilities for security approaches that can be followed to expose a client and the server (for example, z/OS,
and application monitoring. the identifiedfunctions as services. AS/400 and UNIX). The terminal session or
Web services security servers can Generally, there are three ways to screen information can be packaged using
provide comprehensive auditing capabili- integrate with these legacy systems, and different protocols, such as 3270, vt100
ties related to XML and Web services traffic. Software AG can integrate at any of them: and 5250. These protocols describe the
The information can be stored in a data- data related to the user interface and how
base, such as DB2 or Oracle, and typically ¬ Session level that data should be interpreted and ren-
details who accessed which services and ¬ Transaction level dered by the receiving application (termi-
how frequently. Each message sent and ¬ Data level nal emulator).
received can be logged, which allows for a With session integration, it’s possible
complete audit trail of actions and corre- By exposing legacy applications as services to intercept the terminal emulation proto-
sponding results. through one of these approaches, we can col data and render it in non-traditional
make existing application functionality ways. For example, the 3270 session data
Standards-based: Web services security reusable by other applications. This saves can be displayed in HTML format to be ren-
servers also provide support for a variety of time and money by taking advantage of dered within a Web browser.
security and XML-related standards. Tech- existing resources. In the past, this type of integration
nologies such as SSL, WS-Security and SAML was called “screen scraping.” Screen scrap-
are some of the important specifications Session Integration ing is an inefficient technique that is tightly
and standards supported and implemented Many z/OS applications are only accessible coupled to the screen layouts. The moment
by many of these Web services security through terminal data streams, typically a screen layout changes, the client applica-
servers. referred to as “green-screens,” and 3270 or tion has a problem interpreting the data
5250 terminals. This implies that applica- correctly.
tions are written in such a way that busi- Session integration, on the other
ness logic and presentation interface are hand, can interpret the data received more
Software AG’s Approach to not cleanly separated through the use of efficiently via the emulation protocol.
Implementing SOA callable routines. Rather than looking at the data in a fixed or
positional manner, it actually parses the
Step 1: SOA Enablement There are a number of reasons not to mod- data and recognizes patterns (or data, fields,
When taking the first steps toward an SOA, ify or re-engineer such existing monolithic constants and screen identifiers) by locat-
we nearly always start with the familiar. applications into modular versions. Many ing them wherever they are within the
Because legacy systems form the core of organizations, for example, lack the knowl- data stream.
most mission-critical applications, we want edge and technical skills required. For some
to know how we can re-use these systems organizations, the risks and costs associ-

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

11
and presentation. Ideally, the transactions decimal, packed decimal or integer formats.
that contain the business logic could be In a programming environment like .NET,
accessed as a Web service in an SOA. How- numeric data can be defined as byte[],
This allows more flexibility in how the data ever, several challenges still remain. The float, double, sbyte, short, int and decimal.
can be manipulated and represented to the application could be written in any number Again, transaction integration helps per-
consuming application. of languages, including Natural, COBOL or form the character translations between
Session integration is often used to PL/1. In addition, the application may have the respective platforms and also does
expose z/OS applications as Web services been written to operate either in BATCH or automatic marshalling of the data, ensur-
or XML documents. The use of either XML online modes. Any viable solution will need ing the data is properly converted between
or Web services allows the consuming to access a myriad of transactions, regard- the various applications.
application a wider margin of flexibility in less of their language or mode of operation. Transaction integration is also valu-
dealing with the session data received. The It is equally critical this solution allow the able because it offers the potential for
ability to abstract the consuming applica- application components to participate in an “two-way” integration. Instead of only offer-
tion from the actual implementation on z/OS SOA without introducing change or risk into ing z/OS functionality to the outside world,
is a powerful concept. It provides the means the environment. transaction integration allows z/OS appli-
to expose existing z/OS applications as Therefore, these legacy transactions cations to consume external services with-
Web services to a new generation of appli- need to be “wrapped” in such a way that out having to know they may be Web ser-
cations – without requiring any changes to they are callable as Web services without vices. Just as a CICS transaction can be
the existing z/OS applications. disrupting the original state of the applica- wrapped to look like a Web service, a Web
Session integration clearly offers value tion. service can be wrapped to look like a leg-
in a number of scenarios. However, it does Transaction integration refers to a acy transaction.
have some notable limitations. And be- style of integration in which existing trans-
cause of them, there may be scenarios actions, such as BATCH programs or online Despite the benefits of this approach, trans-
where session integration is not sufficient. CICS transactions on z/OS, can be accessed action integration has its own set of limita-
from distributed platforms. External appli- tions that must be considered:
Here are a few limitations to keep in mind: cations should be able to call these transac- ¬ Transaction integration assumes that
¬ Session integration is “one way” only. In tions as methods or procedures without existing applications are well structured
other words, the z/OS applications can having to know that they may in fact reside with callable subprograms or procedures.
be exposed as services. But they cannot on thez/OS platform. If not, these applications must be re-
participate fully in an SOA by consuming Transaction integration allows this to engineered to use this approach.
other services that aren’t on the z/OS happen by wrapping the existing transac- ¬ Depending on the nature of the original
platform. tion and exposing it as a service, whether it application, services created using trans-
¬ Session integration can expose and en- is a Web service, a Java object or a .NET action integration may be too fine-grained
capsulate only functionality that exists in object. To do this, a transaction integration to be of value to an SOA.
the original application. There is no ability solution needs to be able to handle the dif- ¬ Organizations may want to get directly to
to extend the application with this approach. ference between the z/OS platform and data sources without having to call exist-
¬ Session integration cannot access BATCH the open-edition platforms, such as UNIX, ing business logic. Transaction integration
applications or processes. It can access Linux or Windows. For instance, on z/OS, allows access only to applications, not
only those that are exposed via a user data is encoded in EBCDIC, while on the data sources.
interface or callable routine. open-edition platforms, data is encoded in
ASCII. Transaction integration helps make Data Integration
Transaction Integration this conversion transparent to the applica- In some scenarios, organizations need to
In other scenarios, applications may in fact tions. gain access to operational and transactional
be well structured with separate and dis- Here’s another example. Natural de- data residing on z/OS databases without
tinct layers for data access, business logic fines numeric data as numeric, unpacked going through business logic. Typically, new

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

12
applications are developed outside of the ¬ Data may be stored in a format that is ¬ SOAP/XML documents may need to be
original z/OS platform. These new-genera- unintelligible outside the context of the transformed via XSLT.
tion applications need to access and often application built to access it. ¬ Web service requests may need to be
times even update data stored within the ¬ Accessing data directly may imply that routed to specific endpoints based on
z/OS databases. business logic may be replicated on dif- content.
ferent platforms. This may defeat the ¬ In a typical organization, information des-
In this case, you’re faced with two new principle of an SOA. cribing key items of interest, such as cus-
challenges: tomer, product and financial condition,
¬ You need to provide a standard of con- Step 2: Synthesis—Single Views and are scattered across multiple systems. It
nectivity (via ODBC or JDBC) to the z/OS Service Orchestration may be better to use a model-driven
databases and data sources Once you’ve implemented Web services semantic-integration tool rather than cre-
¬ You must be able to encapsulate SQL and taken the first steps to an SOA, you’ll ating and maintaining ad-hoc program-
statements or stored procedures as Web typically find that XML and Web services matic Web services to create single views
services introduce additional complexities into your of such items.
environment. For instance:
Data integration is the ability to provide a In short, you will need to ensure that your
standard level of connectivity (typically ¬ In many organizations, Web services first SOA remains agile, loosely coupled and main-
ODBC or JDBC) to disparate data sources. were employed at a departmental level. tainable. To do this, you’ll need an infra-
This functionality is important for legacy Each department may have taken a structure that offers value-added services
databases that do not support SQL or pro- slightly different approach in its imple- to resolve conflicts and manage the SOA
vide ODBC connectivity natively. The ability mentation. It is important to introduce environment. For this purpose, Software AG
to offer standard connectivity to these data enterprise standards without re-imple- recommends using a combination of service
sources allows data to be accessed in new menting existing Web services. orchestration and semantic integration.
ways and for new purposes. For example, ¬ Web services created from legacy trans-
an organization may have data in a data- actions may be too fine-grained to be of Service Orchestration
base on z/OS but would like to make that value to other applications in theenter- Web services are created to address a vari-
data available to business intelligence tools. prise. It may be valuable to orchestrate ety of needs, and different Web services
Data integration provides the facilities to several fine-grained Web services into a may perform business functions with dif-
make this possible. omposite Web service that performs a ferent levels of granularity. For example,
defined business function. you may find it necessary to define Web
Data integration has its own set of limita-
tions. Some of these are:
¬ Accessing data directly may introduce risk Figure 3: Comparison between Integration Approaches

by circumventing the business logic typi-


Service Characteristic Screens and Sessions Data Transaction (Business Logic)
cally used to access it. This might not be
Granularity Coarse Coarse, fine Fine
desirable, since the integrity of the data e.g., user interaction on e.g., developers can pick a
of the z/OS database cannot be ensured many screens is turned into particular piece of code –
a Web service not imited to a screen scope
when multiple different applications up-
Code Change No No Yes/No
date the same data. It might be preferable Depending on the applica-
tion design/modularity –
to implement one set of business logic on might require reengineering
the z/OS to enforce the corectness of the Extensible Limited Dependent Enhance
(Functionality) Restricted to original Extensibility depends on Coding of new functionality
data stored within the database. This type
functionality business logic
of application should be exposed as a ser-
vice that can be consumed by the new- Communication One-way Two-way Two-way
(z/OS can only provide (z/OS can provide data and (z/OS can provide services
generation applications. services) consume data) and consume services)

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

13
services with fine-grained functionality, gration scenarios today, this common syn-
especially when such services are created tax is provided by XML and HTML. Web
to expose or wrapper functionality in leg- services and service-oriented integration
acy applications. Yet, such services are too further define the level at which syntactic
fine-grained to be consumed directly by integration operates.
other parts of the SOA.
In such cases, you may need to exe- Level 3 – semantic integration: Once we
cute multiple fine-grained Web services in have universal access to our information
sequence (with additional business logic in- systems and a lingua franca for exchanging
serted between the steps) and from them information between systems, we can
“compose” a new, more coarse-grained focus on formally mapping the meaning of
“orchestrated” service. This is service orches- information between one system and
tration. It allows us to create a single, re- another, resolving terminology, representa-
usable and consistent definition of a busi- tion and even data accuracy or currency as
ness process that may be comprised of a we proceed.
number of lower-level Web services calls Until recently, specialized tools for
to the underlying systems. A composite model-based semantic integration were
Web service generated from such a process lacking, and instead this task was handled
is referred to as an orchestrated service. by creating a set of foundational Web ser-
vices that programmatically resolved these
Software AG recommends use of Enter- differences. Unfortunately, without a mod-
prise Services Bus (ESB) for service or- eldriven approach, creating and maintain-
chestration. ing these foundational Web services is a
chore in itself – especially when changes in
Semantic Integration one underlying system create a ripple effect
When we pull data from multiple systems across multiple Web services that access
to create a single view, say, of a customer, information contained within.
we can identify three distinct levels of Semantic integration tools provide a
information integration: model or extended dictionary of an enter-
prise’s information. In addition to simple
Level 1 – technical integration: The first metadata, the model allows the creation of
level, technical integration, is concerned rules that govern how information is valida-
with providing universal access to data ted, rationalized and even combined with
regardless of the platform, database, oper- other information to allow inferencing.
ating system or location of the data. The Inferencing is a technique by which
familiar Internet and World Wide Web pro- we can derive additional information by
tocols and standards we use every day, looking at the relationships between items.
such as TCP/IP and HTTP, are well suited to For example, if our hypothetical customer
this task. data included information about close fam-
ily relationships, like parent and child rela-
Level 2 – syntactic integration: Once we tionship and sibling relationships, we could
can access information in disparate systems, use rules to derive extended-family rela-
we have to agree on a common syntax for tionships between people such as “uncle-
representing this information. In most inte- nephew” and “sister-in-law” and then ask

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

14
questions such as: “What is the family rela- and Service-Oriented Integration (SOI) to can interact with them as they would other
tionship between these people?” provide an optimal implementation of an metadata in an enterprise, modifying val-
This model-based approach connects SOA.” ues via GUIs and forms much as other
data from disparate data sources to a com- online data are managed.
mon business model that provided a uni- Role of the ESB
fied, realtime view of information using Software AG views the ESB as an important ESB Use Cases
dynamic data aggregation. The information component of the overall SOA. The imple- The true value of an ESB stems from its
model is capable of providing information mentation and use of ESB is much more ability to allow users to manage the entire
about all connected data sources, while than just technology. It is also an architec- process of receiving SOAP requests and
being flexible enough to accommodate tural approach. The ESB is intended for XML documents, manipulating them accord-
changes. This provides the users an ability designing and assembling loosely coupled ing to explicit rules and ultimately routing
to receive different perspectives into the applications and services. them to the intended destination. An ESB
same information in their preferred termi- Mediation, defined in the dictionary could facilitate these processes:
nology. Web services that provide informa- as “negotiation to resolve differences con-
tion from such a model-driven approach ducted by some impartial party,” is a key Conversion of incoming scanned documents:
are referred to as information services. concept in such systems. Just as in the dic- Incoming non-XML documents can be con-
A semantic integrator product like tionary definition, the ESB is well suited to verted into a standard XML format as
Software AG’s enterprise information inte- resolve different assumptions about data described by a specified schema definition,
grator provides modeling capabilities and format, data location and exchange proto- orincoming XML documents can be con-
also auto-generates information services. cols among applications or components in verted to different XML schema definitions.
a distributed environment.
Enterprise Service Bus (ESB) For example, consider an online store Document validation: Often the first step in
The term ESB has been coined by analysts that employs the services of a credit card a typical business process would be to vali-
to describe a standards-based infrastruc- company, a shipping company and various date an incoming XML document structure
ture solution that offers a core set of capa- suppliers of the goods sold. The basic pro- against the defined XML schema to ensure
bilities, which may include: cess of selling goods, getting paid and ship- the correctness of the document. The ESB
ping them may be fairly stable. But the can determine the document type received
¬ Full XML and Web services support details of which companies we deal with, and can use the correct XML schema to do
¬ Content-based routing what data formats they use and the precise the necessary document validation checking.
¬ Validation and transformation Web addresses at which they can be
¬ Load balancing reached are very likely to change on short Content validation: The next step often is
¬ Logging and message persistence notice. By building the application with an to validate the actual data values via inter-
¬ Security ESB, these differences can be resolved as action with external systems. As long as an
they become apparent, without actual ESB is based on open standards, it can
The goal of an ESB is to provide the infra- Java programming, or even recompilation leverage open-source components exten-
structure necessary to offer value-added and library deployment. sively as part of its internal architecture.
services to an enterprise SOA without forc- The ESB can’t “negotiate” these dif- This results in an extremely flexible design
ing IT organizations to rely on tightly inte- ferences in the dictionary sense of the time environment, allowing the user to
grated or custom-built solutions. ZapThink, word. But since the ESB builds on XML, Web create custom components, such as con-
an analyst firm specializing in SOA, services and Web standards, it uses skills tent validation routines, which can be
observed that an ESB isn’t a solution to pro- learned in other domains (such as XPath, made available from the design time pal-
vide SOA in itself. But rather: “ESBs will XSLT and XML schema construction). While
combine with other integration approaches ESB processes may fill the same role as
such as Business Process Modeling (BPM) Java or .NET code in an application, users

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

15
cate with the end user and external Web zations to build enterprise views of infor-
services as part of the business process. mation important to the business, such as
This could mean sending detailed mes- customers, products or employees. An
ette. These components can be “dragged sages or notifications to the end user or enterprise-level view aggregates and
and dropped” into a sequence providing- even sending complete XML documents. materializes data in real time from source
maximum re-use of existing components. More importantly, it is the ability to orches- systems, presents relevant information in
trate various Web services via the SOAP the user’s terminology and gives different
Data cleaning: Java classes, XSLT transfor- gateway that allows the ESB to fulfill an perspectives into the same information.
mations, XSL-FO and custom transforma- important role in the overall SOA. Here are some examples of how this capa-
tions can be invoked to format data into bility can be used to describe aspects of a
the expected format. For example, inputs Transformation: A transformation of the company’s business:
that are not well-formed XML could be run XML document could be invoked at any
through a “tidy” program if a validation time during the business process. This is Customer: Tower Research Group, for exam-
step fails. very helpful when the end user/customer ple, states that “developing an enterprise
requires the data to be in a specific format. view of the customer is one of the primary
Aggregation of multiple inputs: While an requirements of a CRM-based sales and serv-
ESB process can be triggered by a single- Content-based routing: The contents of an ice strategy.” Semantic integration can pull
request message, multiple inputs could be XML document, in process, can be evalu- together information from an organization’s
retrieved and consolidated. For example, ated. Based on this evaluation, content CRM and ERP systems and other sources to
we could build an RSS/Atom aggregator. decisions can be made as to whether the present a complete and consistent real-
The sequence could go through a number document should be stored or to which time view of any customer. For a call center
of steps to identify the basic type of data customer it should be routed. operator, that might include the customer’s
(RSS 0.91, 1.0, 2.0, Atom …), perform the order history, a summary of critical support
frequently necessary cleaning to make it Replication: The ESB allows for documents calls the customer has logged and any
well formed, transform it to a standard XML to be replicated within a business process. items they have returned for refund.
format or an HTML display format, and These replicated documents could be com-
archive the cleaned data in an accessible plete copies of the original XML document Products: An enterprise view of products
location. or subsets of specific portions of the origi- might aggregate information from the
nal XML document. product catalog, the sales and service sys-
Persistence: Incoming XML documents can tem and return materials authorization
be stored to RDBMS or native XMLDB data- Aggregation: Various XML document instanc- information so the COO can see what the
bases. This can happen at various stages of es could be combined into a single XML most “troublesome” products are.
the business process and allow for the re- document instance. The ESB provides the
use of the XML documents in other ability to design rules for how this aggrega- Employees: An enterprise view of employ-
sequences of business processes at a later tion process should work. This is extremely ees might aggregate information from the
stage. This caching mechanism can be used useful when orchestrating various Web ser- human resources and payroll systems, the
to improve performance and throughput. vices. Each of the Web services invoked will corporate travel system, the employee cal-
reply with a proper SOAP response docu- endar system and the company’s employee
External gateways: An ESB usually provides ment and, through the aggregation process, directory so everyone in the company can
a number of external gateways or adapters will be able to select the responses or locate their colleagues, know the best way
allowing a business process to send XML selected parts of a particular response that to contact them, who to contact in their
documents and communications to cus- should be used to build the final result. absence, and so on.
tomers, end users, external Web services or
applications. These gateways allow a very Semantic Integration Use Cases Step 3: Process-Driven Integration
flexible and effective means to communi- A semantic integration tool enables organi- Historically, Business Process Management

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

16
(BPM) has not been easy to implement or the group of consumers is small. In this
integrate into the enterprise. BPM imple- case, there usually is no pressing need to
mentations have proven to be costly and manage the artifacts related to the Web
complex undertakings, fraught with risk, services (such as WSDLs, XML schemas and
partly due to the complex nature integrat- XSLT), and there usually is an informal
ing business processes that span multiple agreement about how to deal with upcom-
applications. With every application inter- ing changes in the service contracts.
action, the problem became more complex, As we have seen, SOA enablement,
since many different technologies were services orchestration and BPM are great
required to enable the interaction. tools for building a flexible and reusable IT
Software AG believes that SOA pro- architecture that enables a business to Implementing SOA is about much
vides an excellent foundation for imple- react quickly to new market conditions and more than adopting the latest
menting process-oriented integration sce- customer expectations. This approach soon technology or following the latest
narios that solve complex business process breaks down, however, when the adoption IT trends. It‘s about investing in
management and orchestration problems. of services expands to dozens or hundreds the IT infrastructure to leverage
Today’s BPM solutions provide a rich of services in the organization. existing IT assets and increasing
toolset that facilitates modeling and engi- business agility.
neering business processes while, at the Suddenly, the organization is faced with a
same time, leveraging services exposed as number of new problems. For example, an
part of the SOA. SOA is becoming a key organization may ask:
enabler for BPM, providing a flexible archi-
tecture that’s easy to extend and also capa- ¬ Where do we go to determine which ser-
ble of adapting to changing requirements. vices exist within the organization?
Through the use of SOA, BPM processes can ¬ How do we determine whether the ser-
be shielded from the underlying changes vice contract is the most recent version?
within the services infrastructure. ¬ How do we determine the consumers of
Just as business processes can lever- a particular service?
age the services within the enterprise, these ¬ How do we determine the potential
same business processes also can be ex- impact of a change to a services con-
posed as services to be consumed from with- tract?
in applications. The end result is that BPM ¬ How are new services documented, and
becomes part of the SOA fabric, in which where do we publish a newly created
the business processes are viewed as noth- service?
ing more than a new kind of service. ¬ How do we enable and maximize re-use
to build composite applications and new
SOA Visibility and Governance with a processes and to shorten development
Services Repository time?
Many organizations start their SOA initia- ¬ How do we coordinate different teams of
tives by creating ad hoc Web services. The business analysts, architects and devel-
existence of these Web services is usually opers, and compel them to respect the
known to select developers, and the infor- norms set by the enterprise architecture?
mation related to these Web services is ¬ How do we govern and set policies over
usually shared in an informal way, such as the deployed services and other compo-
e-mail. This approach usually works when nents that will proliferate across the orga-
a small number of Web services exists, and nization?

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

17
and warehousing worlds have been lever- Conclusion
aging metadata based on relational stan-
dards for years. But, things have been dif- As organizations continue to explore ways
ferent for application integration, plagued to implement an SOA, they need to con-
These considerations will have a direct im- by proprietary technologies until now. sider utilizing a consistent vision and metho-
pact on the reusability of existing services. Unlike proprietary integration, SOA dology throughout the process. This meth-
This is precisely why a services repository creates the opportunity to easily analyze odology should enable the organization to:
can play a prominent role in the success of metadata of models, processes, integration
SOA projects. Organizations have found that flows and Web services that are standards- ¬ Assess and mitigate risk
to properly manage services within the and XML-based. The self-describing nature ¬ Adopt best practices
SOA infrastructure, they have to have a cen- of XML and the ability to query XML files ¬ Link SOA implementation with key busi-
tral services repository, where all the ser- (XQuery/XPath) make metadata analysis ness initiatives
vices can be published and documented. feasible. XML-based metadata also offers
The services repository provides stan- the opportunity to represent a wealth of Implementing SOA is about much more
dardized interfaces, such as UDDI, through information extracted from different SOA than adopting the latest technology or fol-
which service producers can publish their management tools, such as XML firewalls lowing the latest IT trends. It’s about invest-
services. These repositories also allow ser- and services-monitoring tools. You can then ing in the IT infrastructure to leverage exist-
vice producers to document their services centralize this information into a central ing IT assets in order to increase their
by providing additional metadata that help repository that holds the “DNA” of the reusability, thereby:
consumers find appropriate services via dif- entire SOA.
ferent classification and search mechanisms. By bringing total visibility and gover- ¬ Reducing the expense of integrating appli-
Consumers can be assured that whenever nance over different SOA assets through a cations that are vital to each organization’s
they bind to a service, they will do so with central point of control, organizations are ability to remain competitive
the latest service contract. Likewise, serv- more likely to reap the benefits of SOA and ¬ Providing a better level of service to inter-
ice producers gain the ability to track how BPM. In concrete terms, this means that nal and external customers
their services are used and by whom. business analysts, who need to create new
The resulting implementation of the processes or integrate new systems in Implementing SOA is about increasing busi-
services repository greatly increases the existing processes, can determine which ness agility while reducing the risk and
communication between the service pro- systems can be re-used via Web services. complexity associated with integrating
ducer and consumers, as well as the devel- They also can determine what to expect applications.
opment teams. It is the central mechanism from them in terms of information, logic Software AG is a strategic provider of
from which the various development teams provided and performance. IT solutions to enterprises globally. We
can obtain the latest information regarding On the other side of the fence, a believe that a collaborative partnership with
the service they need. Most IDEs today pro- developer, who must update the Web ser- our customers helps them to be successful
vide support for UDDI or provide plug-ins vice interface to comply with a new stan- in their SOA initiatives. In this manner, we
that allows developers to browse the ser- dard, can be aware of the processes that focus our combined resources and technol-
vices repository without having to leave use the Web service and may be disrupted ogy base to help IT leadership respond to
their IDE environment. This ease of use because of the change. Metadata analysis the unprecedented needs of today’s
inspires “integration“ between the various brings the needed benefits to well-planned dynamic and demanding world.
parties involved in the SOA. and cross-functional integration: discipline, SOA and technologies such as Web
The usage of metadata to bring disci- and horizontal and vertical collaboration. services can effectively support and
pline and visibility to IT projects is nothing enhance your strategic business initiatives.
revolutionary. The data integration (ETL) Leverage our expertise to explore how.

B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

18
B U S I NE SS W H I TE PA P E R | YO U R G U I D E TO S OA S U CC E SS

19
TO F I ND THE O F F I CE NEAREST YO U , P L EASE V I S I T W W W . SO F T W AREA G . COM
Contents
Dunt ero odolestrud moloreet 2

Lortio core conullu 3


S o f t w a r e a g h a s o ff i c e s i n o v e r 7 0 c o u n t r i e s .

Obor aliquam consenibh 3

Dunt ero odolestrud moloreet 4

Lortio core conullu 4

Obor aliquam consenibh 5

© Copyright Software AG and/or its suppliers


SOAUSWP0506

All rights reserved. Software AG and/or all Software AG products are either
trademarks or registered trademarks of Software AG. Other product and
company names mentioned herein may be the trademarks of their respective
owners.

You might also like