Welcome!

Microservices Expo Authors: Liz McMillan, Todd Matters, Pat Romanski, Elizabeth White, Stefana Muller

Related Topics: Microservices Expo, Machine Learning

Microservices Expo: Article

Web Services Specifications and SOA Interoperability

Achieving interoperability is neither simple nor straightforward

Interoperability is an important factor in the success of solutions that are based on Web Services and Service Oriented Architecture (SOA), along with other key factors such as contracts, loose coupling, and reuse. Interoperability is generally accomplished by developing your Web Services using the well-established guidelines for implementing Web Services and by following industry standards such as XML, WSDL, SOAP, and UDDI. However, just following Web Services standards and guidelines during the development phase of a project isn't sufficient to achieve interoperability.

The different products used for development also have to comply with many requirements such as the need to have similar implementations (data types, formats, and schemas) of the standards that you want to use. As different products are provided by different vendors, developed by several sets of people, and employ various types of underlying technologies, achieving a common understanding often becomes very difficult, which makes the products likely to be non-interoperable with each other.

Over the last few years, the basic Web Services standards like XML, WSDL, and SOAP have matured a lot and WS-I has released a Basic Profile (described later) that contains implementation guidelines for basic Web Services standards. Today, most vendors provide products that comply with the Basic Profile and support the standards included in the profile. With the wide adoption of the Basic Profile, software vendors have been able to make their products interoperable to a great extent.

As the Web Services industry evolves, it embraces new specifications like WS-Security, WS-ReliableMessaging (WS-RM), and WS-AtomicTransactions (WS-AT) to provide advanced functionalities such as security, reliability, and transactions that are not provided by the basic specifications. These specifications are generally referred to as the WS-* (pronounced WS-Star) specifications. As they are relatively new and have not been so widely agreed on by the industry, achieving interoperability between Web Services that use WS-* specifications is much more difficult and the WS-* specifications may not even be supported in many products.

This article provides a set of guidelines and best practices that you can follow to accomplish interoperability when developing web services that make use of the WS-* specifications across products provided by different vendors. It also provides insight into the Web Services specifications situation that contains a large number of WS-* specifications that are being developed by different groups.

Author's Note:
1.  This article uses the term "product" as a common term to refer to platforms, technologies, or tools provided by software vendors for developing Web Services.
2.  It uses examples of interoperability between J2EE- and .NET- based Web Services. However, the given guidelines and best practices can be applied to other platforms too.
3.  This article assumes that the reader is aware of basic Web Services concepts and knows the different steps involved in develoing Web Services.

Basic Web Services Interoperability
Achieving interoperability for scenarios involving only basic standards is relatively easy if you follow the guidelines set by the Basic Profile (BP) 1.0 or 1.1 of the Web Services Interoperability Organization (WS-I). The Basic Profile consists of implementing guidelines recommending how a set of core Web Services specifications should be used together to develop interoperable Web Services. The guidelines address technologies that cover four core areas: Messaging, Description, Discovery, and Security. BP1.0 covers the following core Web Services specifications and provides constraints and clarifications to these base specifications, along with conventions about how to use them together:

  • SOAP 1.1
  • WSDL 1.1
  • UDDI 2.0
  • XML 1.0 (Second Edition)
  • XML Schema Part 1: Structures
  • XML Schema Part 2: Data types
  • RFC2246: The Transport Layer Security Protocol Version 1.0
  • RFC2459: Internet X.509 Public Key Infrastructure Certificate and CRL Profile
  • RFC2616: HyperText Transfer Protocol 1.1
  • RFC2818: HTTP over TLS Transport Layer Security
  • RFC2965: HTTP State Management Mechanism
  • The Secure Sockets Layer Protocol Version 3.0
You can see detailed information about the Basic Profile at its home page: www.ws-i.org/deliverables/workinggroup.aspx?wg=basicprofile.

If you can ensure that all the products being used in your solution are compliant with the Basic Profile, you are very close to achieving the interoperability between those products. Additionally, if you build your Web Services by following the Basic Profile guidelines and by using the specifications listed above, you can achieve complete interoperability. However, the guidelines for using basic Web Services specifications aren't within the scope of this article. To find out more on the topic, you can either look at resources listed in the section "Web Services Interoperability Resources" or search for the keyword "Web Services interoperability" on any major search engine. You'll find numerous articles, guidelines, and samples.

Land in the WS-* Space
The basic Web Services specifications such as XML, SOAP, and UDDI have been around for a long time now and have been ratified by one standards body or another (described later in this section) as standards. These specifications have also found wide adoption in the industry and in leading Web Services products. However, the case is not the same for advanced Web Services specifications or WS-* specifications. Figure 1 below graphically represents how different categories of specifications fit in the context of a Web Services framework.

Note that Figure 1 provides high-level categorization of Web Services specifications; it shouldn't be considered a underlying architecture for Web Services implementations. The basic specification provides the core functionalities for Web Services such as messaging, discovery, and description, whereas WS-* specifications provide advanced functionalities such as security, reliability, and transactions. A specification is generally given the status of a standard when it's approved by a standards body. There are two main standard bodies dealing with Web Services standards:

  1. W3C: The World Wide Web Consortium (www.w3.org/)
  2. OASIS: The Organization for the Advancement of Structured Information Standards (www.oasis-open.org)
W3C was founded mainly to focus on Web-based protocols and standards such as HTML, HTTP, and others. It also plays a core role in standardizing the basic specifications for Web Services including SOAP, XML, and WSDL. It's expanded beyond that and has been involved in overseeing higher-level ones such as WS-Choreography Description Language.

On the other hand, OASIS focuses on developing and adopting e-business and higher-level Web Services specifications such as ebXML, UDDI, and many of WS-* specifications including WS-Security, WS-Reliability, Web Services Business Process Execution Language (WS-BPEL), etc.

Besides to these two major standard bodies, there are two other groups involved in Web Services-related standardizations:

1.  The Web Services Interoperability (WS-I) organization (www.ws-i.org/) was founded by Microsoft, IBM, and other vendors primarily to promote interoperability across platforms. It focuses on developing profiles of Web Services standards that enable interoperability. It also provides usage scenarios, sample applications, and testing tools to help you develop applications conforming to the profiles. Its profile, BP1.0, mentioned in the section "Basic Web Services Interoperability" above, has gained wide acceptance in the industry.

2.  The Liberty Alliance (www.projectliberty.org/) was co-founded by Sun with the mission to develop Web Services specifications for identity management using the Security Assertion Markup Language (SAML). It focuses exclusively on identity management and security issues.

Stages of a Specification Before Becoming a Standard
This section describes the process followed by W3C and OASIS to adopt a specification as a standard. The exact process followed by the two standards bodies might be different, but on a high level, they follow the process described here.

Generally, some vendors (such as Microsoft and IBM) get together and create a draft version of a specification that they want widely adopted. They publish that draft specification to get feedback and support from the industry. The authoring vendors make changes to the specification per the feedback and, if they choose to, submit an agreed version to one of the standards bodies. The standards body then enters its process for deciding whether to form a working group (WG) in the case of W3C or a technical committee (TC) in the case of OASIS. If it does form the WG or TC, it calls for participation from industry members to work on the specification. The WG or TC works on enhancing the original submission. At this stage, the specification is called a "working draft." When they are done with enhancements, the WG or TC members publish the specification for public review and take inputs. If the specification gets approved in the public review, the TC recommends to the standard body that it ratify the specification as a standard. In the case of the W3C, the process for promoting a specification to the status of standard is more rigorous.

This process and the availability of numerous Web Services specifications complicate the building of Web Services using WS-* specifications. The complications are described in the next two sections.

Multiple Statuses
The specifications listed in Figure 1 are at different "statuses" or "maturity levels" of the standards process. For example, WS-Security (SOAP Message Security v1.1) is an OASIS standard and WS-Addressing v1.0 is a W3C Candidate Recommendation (almost equivalent to a standard). WS-Policy is only a formal submission to W3C and WS-AtomicTransaction (WS-AT) isn't even submitted to a standard body; it's a joint publication by BEA, IBM, Microsoft, and few other vendors.

Author's Note: The status of the various specifications mentioned in this document is their status at the time of writing. But, their status keeps changing and may be different when you read this.

Competing Specifications
There are some areas where there's more than one specification to address the same functionality; the multiple specifications are supported by different consortia of vendors.

For example, the WS-Choreography Description Language v1.0 is a candidate recommendation (close to becoming a final recommendation or a standard) at W3C for Web Services choreography and was submitted initially by Novell, Oracle, and others. On the other hand, Web Services Business Process Execution Language (WS-BPEL) v2.0 is a committee draft at OASIS for very similar requirements (i.e., Web Services orchestration); it's supported by a mostly different set of vendors like BEA, HP, IBM, and Microsoft.

Similarly, WS-Reliability v1.1 is an OASIS standard, initially submitted by Sun, Oracle, and others. But another group of vendors made up of BEA, IBM, Microsoft, and TIBCO has published a similar but different specification called WS-ReliableMessaging. In some instances, you'll also find a vendor supporting competing specifications.

Because of these complications, achoeving interoperability using WS-* specifications becomes much more difficult compared to using basic Web Services specifications. The following section describes some guidelines that should help you increase the interoperability success rate of your implementations and reduce the time spent in debugging and investigations.

Guidelines for Interoperating Using WS-*
You need to look from a number of perspectives to ensure the interoperability between Web Services (using WS-* specifications) that are built on different products. This section offers insight into these perspectives and provides examples wherever applicable.

Support for the Same Specifications
As mentioned above, there could be more than one specification for the same functionality such as reliability or orchestration. Before you start, ensure that the products on which the Web Services are developed support the same specification.

For example, if you want reliable delivery of messages between Web Services developed on two different products, both products should support the same specification, that is, both support WS-Reliability (WS-R) or both support WS-Reliable Messaging (WS-RM). Otherwise, you may not be able to interoperate between the two products.

Another example is about identity federation, for which there are two different specifications available: Liberty Alliance's Identity Framework ID-FF and WS-Federation. In both specifications, federation is implemented through a Security Token Service (STS) that provides security tokens to the requesting clients. But the two specifications use different kinds of security tokens; Liberty Alliance uses extended SAML assertions, whereas WS-Federation uses WS-Security's profiles of X509 and Kerberos. When two parties (or organizations or security zones) plan to implement identity federation between them, they must ensure that the common security token is supported by the two STSes; otherwise, they won't be able to implement the federation.

Versions of the Specifications Web Services specifications are evolving and new versions keep moving through both the draft and final stage. But the products that implement these specifications don't change at the same pace. Because of that, you find products from different vendors implementing different versions of the specifications and the different versions of the same specification may not interoperate with each other. In such cases, check if the product that supports the newer version of the specification supports the older version too. Generally, products support the older version to maintain backward compatibility. You should configure a product to use an older version of the specification, if necessary, so that both products use the same version.

For example, BEA WebLogic Server (WLS) 9.0 only supports SOAP 1.1 whereas Microsoft Windows Communication Foundation (WCF) February 2006 Community Technology Preview (CTP) supports both SOAP 1.2 and SOAP 1.1. WCF provides out-of-the-box configuration settings for different kinds of bindings. All of the bindings except basicHTTPBinding are configured to use SOAP 1.2 by default. If your WCF Web Services use any of these bindings, they won't be able to communicate with WLS 9.0 clients and vice versa. To enable communication, you need to configure the WCF Web Services with a binding that uses SOAP 1.1. You can do that by creating a custom binding in WCF.

You also have to ensure that versions of the other specifications that are being used by the specification you're implementing are the same. For example, WS-RM makes use of WS-Addressing. By default, the WCF Feb 2006 CTP uses the version of WS-Addressing given below:

wsa10=http://www.w3.org/2005/08/addressing

Whereas the WLS 9.0 supports only the older version of WS-Addressing as given below:

wsa=http://schemas.xmlsoap.org/ws/2004/08/addressing

In this case also, you have to configure the WCF Web Service with a custom binding that uses an older version of WS-Addressing. If you don't want to create a custom binding, you can manually change the generated WSDL of the WCF service and use the changed WSDL for generating a proxy that the WLS client uses to call the WCF service. This will work only when the two versions are compatible with each other.

Sometimes, vendors provide service packs or refresh packs to overcome discrepancies in the released version of the product. These packs might bring in changes in the supported specifications. These changes might break the existing interoperability or enable interoperability where it was absent earlier. For example, IBM WebSphere Application Server (WAS) 6.0 supports the element <CoordinationContextType> for WS-AT, but when the refresh pack 6.0.2.9 is applied over it, the supported element changes to <CoordinationContext>. You should analyze all such changes in the refresh packs before deciding to apply these packs.

Schemas, Namespaces, and WSDLs
In some instances, the two products might use the same version number of a specification, but the namespaces for the specification might refer to different schemas. For example, both WCF Feb 2006 CTP and WLS 9.0 use the February 2005 version of the WS-RM Policy specifications but refer to different namespaces. The WCF Feb 2006 CTP generatesw WSDLs that refer to the following namespace for WS-RM Policy Assertions:

xmlns:wsrm=http://schemas.xmlsoap.org/ws/2005/02/rm/policy

Whereas the WLS 9.0 generates WSDLs that refer to this namespace:

xmlns:wsrm=http://schemas.xmlsoap.org/ws/2005/02/rm

The namespace above is actually for WS-ReliableMessaging specification and not for WS-RM Policy specification (which is different from WS-ReliableMessaging). But for some reason, WLS 9.0 uses this namespace to refer to RM Policy assertions.

In such cases, you can change the WSDL of a service manually to refer to a namespace that is understandable by the client. Subsequently, when you generate the client proxy from that changed WSDL, the client proxy would refer to the changed namespace. Hence the clients can communicate with the service successfully.

There's also not much standardization on the location of WS-Policy references in WSDLs. For example, WLS 9.0 adds the policy expression reference in the <operation> element, whereas WCF adds the policy file reference in the <binding> element. In such cases, you have to change the WSDL of a Web Service according to the client requirements.

Author's Note: In WebLogic Server 9.2, the namespace has been corrected and the WSDLs generated refer to the WS-RM Policy namespace for policy assertions.

Specifications & Actual Implementations
Although products may claim to support a particular specification, they may not support all the features in the specification that aren't mandatory. For example, WS-RM specifies four kinds of delivery assurances: AtMostOnce, AtLeastOnce, ExactlyOnce, and InOrder. However, WCF Feb 2006 CTP supports only two options: ExactlyOnce and InOrder. Hence, you need to make sure that both the products that you're trying to interoperate support the option you're choosing for implementation.


More Stories By Sanjay Narang

Sanjay Narang is a Senior Technology Consultant at Global Delivery India Center (GDIC) of Hewlett-Packard. He is based in Bangalore, India and has around 8 years of IT experience. Sanjay has done Post Graduate Diploma in IT (PGDIT) and holds MCSD for .Net Framework and SCJP certifications. He has been involved in designing and developing solutions based on Microsoft technologies for a long time. Apart from software process automation and VSTS, he is working on SOA related projects around Microsoft technologies and their interoperability with other technologies. He has published papers around IPv6, VSTS, SOA, and Web Services and writes extensively about VSTS in his blog: http://sanjaynarang.wordpress.com/ He can be contacted at [email protected]

Comments (1) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
SOA Web Services Journal News 12/17/06 11:56:05 AM EST

Interoperability is an important factor in the success of solutions that are based on Web Services and Service Oriented Architecture (SOA), along with other key factors such as contracts, loose coupling, and reuse. Interoperability is generally accomplished by developing your Web Services using the well-established guidelines for implementing Web Services and by following industry standards such as XML, WSDL, SOAP, and UDDI. However, just following Web Services standards and guidelines during the development phase of a project isn't sufficient to achieve interoperability.

@MicroservicesExpo Stories
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists examined how DevOps helps to meet the de...
For most organizations, the move to hybrid cloud is now a question of when, not if. Fully 82% of enterprises plan to have a hybrid cloud strategy this year, according to Infoholic Research. The worldwide hybrid cloud computing market is expected to grow about 34% annually over the next five years, reaching $241.13 billion by 2022. Companies are embracing hybrid cloud because of the many advantages it offers compared to relying on a single provider for all of their cloud needs. Hybrid offers bala...
"When we talk about cloud without compromise what we're talking about is that when people think about 'I need the flexibility of the cloud' - it's the ability to create applications and run them in a cloud environment that's far more flexible,” explained Matthew Finnie, CTO of Interoute, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
@DevOpsSummit at Cloud Expo taking place Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center, Santa Clara, CA, is co-located with the 21st International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is ...
What's the role of an IT self-service portal when you get to continuous delivery and Infrastructure as Code? This general session showed how to create the continuous delivery culture and eight accelerators for leading the change. Don Demcsak is a DevOps and Cloud Native Modernization Principal for Dell EMC based out of New Jersey. He is a former, long time, Microsoft Most Valuable Professional, specializing in building and architecting Application Delivery Pipelines for hybrid legacy, and cloud ...
Containers, microservices and DevOps are all the rage lately. You can read about how great they are and how they’ll change your life and the industry everywhere. So naturally when we started a new company and were deciding how to architect our app, we went with microservices, containers and DevOps. About now you’re expecting a story of how everything went so smoothly, we’re now pushing out code ten times a day, but the reality is quite different.
There's a lot to gain from cloud computing, but success requires a thoughtful and enterprise focused approach. Cloud computing decouples data and information from the infrastructure on which it lies. A process that is a LOT more involved than dragging some folders from your desktop to a shared drive. Cloud computing as a mission transformation activity, not a technological one. As an organization moves from local information hosting to the cloud, one of the most important challenges is addressi...
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
"We are a monitoring company. We work with Salesforce, BBC, and quite a few other big logos. We basically provide monitoring for them, structure for their cloud services and we fit into the DevOps world" explained David Gildeh, Co-founder and CEO of Outlyer, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Microservices are increasingly used in the development world as developers work to create larger, more complex applications that are better developed and managed as a combination of smaller services that work cohesively together for larger, application-wide functionality. Tools such as Service Fabric are rising to meet the need to think about and build apps using a piece-by-piece methodology that is, frankly, less mind-boggling than considering the whole of the application at once. Today, we'll ...
Cloud Expo, Inc. has announced today that Andi Mann and Aruna Ravichandran have been named Co-Chairs of @DevOpsSummit at Cloud Expo Silicon Valley which will take place Oct. 31-Nov. 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. "DevOps is at the intersection of technology and business-optimizing tools, organizations and processes to bring measurable improvements in productivity and profitability," said Aruna Ravichandran, vice president, DevOps product and solutions marketing...
In his session at Cloud Expo, Alan Winters, an entertainment executive/TV producer turned serial entrepreneur, presented a success story of an entrepreneur who has both suffered through and benefited from offshore development across multiple businesses: The smart choice, or how to select the right offshore development partner Warning signs, or how to minimize chances of making the wrong choice Collaboration, or how to establish the most effective work processes Budget control, or how to ma...
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business - from apparel to energy - is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
In the decade following his article, cloud computing further cemented Carr’s perspective. Compute, storage, and network resources have become simple utilities, available at the proverbial turn of the faucet. The value they provide is immense, but the cloud playing field is amazingly level. Carr’s quote above presaged the cloud to a T. Today, however, we’re in the digital era. Mark Andreesen’s ‘software is eating the world’ prognostication is coming to pass, as enterprises realize they must be...
A common misconception about the cloud is that one size fits all. Companies expecting to run all of their operations using one cloud solution or service must realize that doing so is akin to forcing the totality of their business functionality into a straightjacket. Unlocking the full potential of the cloud means embracing the multi-cloud future where businesses use their own cloud, and/or clouds from different vendors, to support separate functions or product groups. There is no single cloud so...
Both SaaS vendors and SaaS buyers are going “all-in” to hyperscale IaaS platforms such as AWS, which is disrupting the SaaS value proposition. Why should the enterprise SaaS consumer pay for the SaaS service if their data is resident in adjacent AWS S3 buckets? If both SaaS sellers and buyers are using the same cloud tools, automation and pay-per-transaction model offered by IaaS platforms, then why not host the “shrink-wrapped” software in the customers’ cloud? Further, serverless computing, cl...
Hybrid IT is today’s reality, and while its implementation may seem daunting at times, more and more organizations are migrating to the cloud. In fact, according to SolarWinds 2017 IT Trends Index: Portrait of a Hybrid IT Organization 95 percent of organizations have migrated crucial applications to the cloud in the past year. As such, it’s in every IT professional’s best interest to know what to expect.
The taxi industry never saw Uber coming. Startups are a threat to incumbents like never before, and a major enabler for startups is that they are instantly “cloud ready.” If innovation moves at the pace of IT, then your company is in trouble. Why? Because your data center will not keep up with frenetic pace AWS, Microsoft and Google are rolling out new capabilities. In his session at 20th Cloud Expo, Don Browning, VP of Cloud Architecture at Turner, posited that disruption is inevitable for comp...
In 2014, Amazon announced a new form of compute called Lambda. We didn't know it at the time, but this represented a fundamental shift in what we expect from cloud computing. Now, all of the major cloud computing vendors want to take part in this disruptive technology. In his session at 20th Cloud Expo, Doug Vanderweide, an instructor at Linux Academy, discussed why major players like AWS, Microsoft Azure, IBM Bluemix, and Google Cloud Platform are all trying to sidestep VMs and containers wit...