Web services intermediaries evolve

WSI (Web services intermediaries) address the need for faster, more flexible application integration with configurable tools for creating reliable, scalable Web services networks. There are more than a dozen WSI product vendors — more if you throw in XML firewalls, which are quickly adding Web services deployment and management to their security capabilities.

I recently sat down with product managers and engineers from Actional, AmberPoint, Flamenco Networks, Infravio, and Westbridge Technology to get a preview of the new WSI products they are releasing this quarter. I discovered maturing conceptual models, more sophisticated and intuitive user interfaces, and evolutionary changes to product features.

Service virtualization is one of the staple features of WSI products. In its simplest form, service virtualization creates a proxy of the Web service, hiding implementation details from service consumers. In addition to the security benefits you get from a proxy, service virtualization has practical benefits as well. For example, it allows you to move a service from one machine to another or run it on multiple machines without affecting service consumers.

In the latest round of WSI products, service virtualization has matured and expanded to become one of the central organizing concepts. As an example, Westbridge Technology’s XMS (XML Message Server) 3.0 uses service views to create an abstraction layer for back-end services. Westbridge has already made a name for itself in the XML firewall space, and XMS is a capable WSI product in its own right.

In XMS, service administrators focus on creating service views for service consumers. Service views can be configured in one-to-many or many-to-one relationships; as examples, a single view can incorporate methods from multiple back-end services or the methods of a single back-end service can be split apart and used in different service views.

The messages destined for the methods in each view, and the responses returned, travel on a message processing pipeline that performs as many as 28 separate checks on the message. These rules incorporate steps such as authentication and authorization of consumers, message validation against a schema, signature validation, encryption, and message transformation. Each service consumer can have a custom service view if necessary, and each view can be associated with the custom-designed message processing pipeline.

The administrator can set and test properties associated with a single message on its round-trip through the pipeline. In this way, pipeline steps and properties can be combined to create sophisticated behavior. For example, an intrusion detection trap can be created by setting a custom property to true whenever a schema fails to validate so that these schema can be routed to a special “honeypot” server.

Web Self-Services

As Web services move from internal pilot projects to large-scale deployments involving partners and suppliers, managing the myriad interactions places a significant burden on the enterprise. The service provider must provision accounts for new consumers, allow them to select services, manage versions, negotiate SLAs, provide monitoring and reporting data and alerts, and authenticate each consumer transaction. Automation and self-service could spell the difference between a successful rollout and one that requires so much staff time that it becomes untenable.

Infravio’s Ensemble 4.0 offers a fresh perspective on this problem by introducing the concept of a Web services delivery contract. Contracts can be open-ended, meaning that they can be applied to any consumer, or they can be negotiated between the provider and consumer. Terms can include delivery preferences, service levels, and notification arrangements. Each service is then handled uniquely according to the terms of the specific consumer’s contract.

What distinguishes contracts from service virtualization is the interaction of the service consumer in creating the contract. Once a contract has been negotiated, the account is automatically provisioned and the consumer may begin using the service. The contract also provides a context for presenting monitoring data and system reports to the service consumer. Infravio provides a portal for consumers to view the management data in terms of their contract.

Although the notion of contracts is strictly Infravio’s, other WSI vendors understand the importance of consumer self-service. Actional’s new MyServices Portal product allows provider organizations to create a customizable portal for service and SLA monitoring by service consumers. Flamenco Networks also provides consumer self-provisioning, service selection, and service monitoring, making it possible for an organization to manage thousands of partners without blowing the budget on a large technical support staff.

Exceptional Behavior

One of the constant battles a service provider faces is handling exceptions. Some exceptions occur due to system errors such as SOAP faults or the failure of a system to respond. Others occur in the normal course of business. For example, a service provider may want to ensure that no order is billed without being shipped or that an international airline ticket is never sold for less than $100. Regardless of type, exceptions should be identified and handled swiftly.

The decentralized nature of Web services makes exception handling more challenging than in traditional systems. Detecting and alerting when an expected action fails is fairly easy; discovering where the problem is in a jumble of integrated legacy and partner systems is much more difficult.

AmberPoint’s Exception Manager is designed to identify exceptions as they occur and to initiate a resolution. As an active participant in the service delivery, Exception Manager can intercede before or after a message is delivered and take preventive or corrective action. For example, when a platinum customer orders an “out of stock” item, the order could be queued and sent to customer service for resolution.

Exception Manager assigns monitoring tasks to AmberPoint agents, telling them what events to watch for and what events to correlate. The agents alert Exception Manager to any symptoms related to those set points, and Exception Manager then collects correlated data and raises exceptions to business and system owners.

With similar goals, Actional’s Service Stabilizer technology creates an adaptive infrastructure that automatically reacts to changing service and network conditions. Actional splits the task of managing exceptions into two parts: First, service operations personnel define the exceptional condition, and then system development personnel implement an appropriate action for the trigger.

For example, operations could implement a trigger that says, “The order management service is overloaded if more than 10 orders are backed up or if order processing takes more than 3 seconds on average.” Actional 5.0 could then be configured to respond to the trigger by queuing orders rather than processing in real time or by processing high value orders first. Actional’s appraoch is unique in that it gives both operations and engineering staff the hooks necessary for each group to do its job.

Building strong exception handling into a Web services intermediary allows the system to evolve to cover error conditions that weren’t anticipated and wouldn’t be worth fixing if the fix involved recoding a method. In this model, the system evolves to meet business needs in ways that more tightly coupled systems cannot.

The latest offerings from WSI vendors show that the market is continuing to deliver innovative fixes to IT problems. As the number of back-end Web services available for mixing and matching grows, WSI products will give IT shops the opportunity to show real agility in meeting business needs through custom solutions.

But the wide range of vendors, architectures, interfaces, and conceptual metaphors can be daunting. My advice is to look past feature sets, sit down with the interface, and find the product that feels most comfortable and matches how your organization plans to use Web services.