Welcome!

Microservices Expo Authors: Pat Romanski, Matt Brickey, Elizabeth White, Christoph Schell, Liz McMillan

Related Topics: Microservices Expo

Microservices Expo: Article

Snow White's FIRST Web Services

A cautionary fable for IT management

One day, Snow White decided to deploy a Web service. Her IT dwarves immediately went to work and were pleasantly surprised to find how easy it was to create the Web service using modern development tools. To Snow White's development dwarves, it almost seemed like magic.

Since Snow White's cottage was a Java shop, they deployed the Web service in their J2EE application server, but they could have just as easily used .NET and it would have seemed just as magical - maybe even more so, given the wealth and power of the Wizard of Seattle.

Since Snow White had lived in a palace with a wicked witch, she was no stranger to corporate culture in general and risk aversion in particular. Snow White also had clear goals. She had wisely eschewed the use of magic mirrors, and tended to favor a few industry analysts along with a handful of software vendors who seemed both willing and able to partner with her for the long haul. She wanted to achieve a more flexible and agile IT infrastructure by gradually moving IT to a service-oriented architecture (SOA). Snow White understood that you can't build a robust SOA for your enterprise based on a foundation of unmanaged and unsecured Web services. She wisely instructed her IT dwarves to make sure that this first production Web service was manageable and secure before they implemented any other Web services.

Chapter One - The Stage Is Set
Security wasn't difficult to enable for their first Web service. Their application server provided a magical runtime environment that allowed developers to specify security declaratively within an XML file or using a pretty GUI. Her staff used this magic to make sure that their Web service, using WS-Security, would only work with client applications that supported XML Encryption and XML Signature. The identity of her customers was wisely required to be passed as a security token within the WS-Security element of the SOAP messages that she received. There was no need for federated identity management at this early stage since the cottage directory server had the IDs of all their customers firmly in hand, but they had a good plan to expand, as needed, toward a wider community of distributed identities in the future.

With their experience in building and securing a Web service behind them, Snow White's development dwarves next recommended the purchase of a Web services management product to monitor the availability of their Web services. As developers, they were particularly pleased that this product could manage a Web service without having to change a line of code. Also, the product could automatically discover and manage new Web services as needed. Automatic discovery was particularly important, since they were concerned about rogue Web services being deployed in the enterprise. Certain office productivity products had made this almost too easy, even for non-programmers. Of course, this Web services management product could also report on important service metrics and help make sure that the service was responsive and reliable.

Everything was tidy and in place, and Snow White felt safe, secure, and highly profitable in her little house in the woods. Everything seemed fine until one day the head IT dwarf (who used to be Sneezy before he found allergy medication) found his boss on the floor weeping. Six important customers had complained in the last hour about poor performance on the Web service. "How could this have happened?" demanded the tearful Snow White, "I thought you said that our Web services management software would warn us of potential problems!"

Chapter Two - What Went Wrong?
In truth, there were a number of IT management, development, and product evaluation issues that had contributed to Snow White's tears. One important issue was the ineffective and superficial integration between their existing enterprise management system and their new Web services management software. The operations staff was running the entire IT infrastructure (a multitude of hardware and software entities such as operating systems, application servers, messaging middleware, routers, networks, databases, networked storage, and so on) using an enterprise management solution from a different vendor than the one who had provided the Web services management software. This decision had unintended consequences.

Their Web services management software had correctly warned them that their Web service was performing poorly. So, from the perspective of the Web services developers, the Web services management software had performed admirably - reporting a wide variety of metrics that are typically of concern to the operations staff. It had even managed to send its messages to the enterprise management system console. But, the Web services management product used different terminology and had a different user interface than the enterprise management system. Despite some efforts to train some operations staff in the particulars of both management systems, in a crisis the staff was confused and frustrated. They found it difficult to work with two different management systems.

In terms of internal Web services expertise, Snow White had been forced to rely almost exclusively on the development organization since they had been the first to work with Web services. In retrospect, Snow White should have driven greater participation from her operations staff in the product evaluation - providing the training and consultative resources that they would need to better manage the issues from their perspective.

Web services management software is quite naturally focused on the higher-level specifics of Web services, such as messages and service descriptions (SOAP and WSDL). While such software can often identify a troublesome Web service even in complex aggregations of cooperating Web services, it quite properly lacks any root cause-analysis capability down to the IT infrastructure level. In other words, it isn't intended to trace the underlying cause of a problem down to a particular IT software or hardware entity, like a database or router. The underlying business logic and the supporting IT infrastructure are invisible to the Web services management software. So, in the case of Snow White's Web service performance problem, the operations staff had tried to correlate warning messages sent by the Web services management software with the large number of warning and error management messages related to underlying IT infrastructure and business logic reported by the enterprise management solution, but the lack of deep integration between the two management systems made such work tedious, time consuming, and error prone.

In retrospect, Snow White's strategy and evaluation team would have benefited from the understanding that management cannot be done piecemeal. As part of a comprehensive plan to properly manage new technology stacks such as Web services, on-demand computing, and Grid, the team should have considered the long-term interoperability, training, overhead, and partnership challenges that derived from the use of multiple management solutions. The IT dwarves had selected new Web services management software that was unlikely to enjoy a more useful level of integration with their enterprise software solution in the future. Were they prepared to deal with the added cost and complexity? Had they investigated Web services management products from their own enterprise management vendor? What was the current level of integration being offered by that vendor and, more importantly, what was the enterprise management software vendor's commitment to deeper, more useful levels of integration in future releases?

Of equal concern, the security officer had been absent from discussions concerning Web services management because of the common, but mistaken, notion that security and management are two entirely different concerns. These days, security management increasingly interacts with traditional areas of management such as systems and life-cycle management. The interoperability, visibility, and exposure provided by existing and emerging Web services standards are creating ever more interdependence between management and security. Consider the simple example of a denial-of-service attack on a Web service. Is this a Web services security issue (the enterprise is clearly under assault) or is this a Web services management issue (the service has experienced a change in utilization and SOAP message traffic)? The answer, ultimately, is both.

Many organizations are still in the early adopter phase of Web services use and might justifiably defer consideration of the inevitable convergence of security with other management concerns in the short term. However, Snow White's admirable commitment to an SOA and the deployment of her first production Web service clearly demonstrate that Snow White's strategy team should have had a long-term partnership and deployment plan in place that would allow them to steadily evolve their management and security operations toward a cohesive whole, as needed.

The absence of proper input by the security officer during the planning and evaluation phase also meant that enterprise-level security policy played a surprisingly small role in the decision by the development dwarves to utilize the Web services security functionality provided by the application server. While it is often true that platform-provided security can provide a relatively quick and inexpensive way to comply with enterprise Web services security and management concerns, this is not always the wisest course of action.

Tying security to the Web services platform can make it difficult to centrally administer and maintain policy in a heterogeneous enterprise. Even if the enterprise has standardized on one application server, there are often many other legacy processes and data sources that are not able to leverage the security and management capabilities provided by the Web services platform. In any heterogeneous SOA, integrated, enterprise-level Web services security and management solutions that are independent of the Web services platform may be the only way to ensure that all Web services, not just those deployed on the application server, are fully compliant with corporate policy and can be centrally monitored.

Conclusion
What conclusions can we draw from this IT management fable? Snow White's problem wasn't a poisoned apple (Snow White was not the kind of CxO to fall for that old trick!). It appears that even well-run IT organizations like Snow White's, with a clear vision of where they want to go, can be surprised by the complexity and challenges of managing and securing Web services as part of an SOA. The moral of the story is simple and of value to IT shops in enterprise cottages everywhere. To be useful in the long term, Web services management needs to be comprehensive and holistic - a carefully mixed potion of true Web services management genuinely integrated with IT infrastructure management. Also, in terms of implementing security for Web services, an important part of the total management equation, IT organizations would do well to look beyond the security needs of any particular Web service. Rather, they should begin to formulate a more comprehensive security and management policy and mechanisms that extend beyond any one Web services-enabled platform to serve the enterprise and the SOA as a whole. With these lessons learned, Snow White and her IT dwarves should live happily ever after.

More Stories By Paul Lipton

Paul Lipton is VP of Industry Standards and Open Source at CA Technologies. He coordinates CA Technologies’ strategy and participation in those areas while also functioning as part of CA Labs. He is co-chair of the OASIS TOSCA Technical Committee, and also serves on the Board of Directors of the open source Eclipse Foundation, as well as both the Object Management Group and the Distributed Management Task Force in addition to other significant technical and leadership roles in many leading industry organizations such as the OASIS, W3C and INCITS.

Lipton is also an approved US delegate to the international standards organization ISO, as a member of the subcommittee focused on international cloud standards. He is a founding member of the CA Council for Technical Excellence where he leads a team focused on emerging technologies, a Java Champion, and Microsoft MVP.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@MicroservicesExpo Stories
"At the keynote this morning we spoke about the value proposition of Nutanix, of having a DevOps culture and a mindset, and the business outcomes of achieving agility and scale, which everybody here is trying to accomplish," noted Mark Lavi, DevOps Solution Architect at Nutanix, in this SYS-CON.tv interview at @DevOpsSummit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
If you read a lot of business and technology publications, you might think public clouds are universally preferred over all other cloud options. To be sure, the numbers posted by Amazon Web Services (AWS) and Microsoft’s Azure platform are nothing short of impressive. Statistics reveal that public clouds are growing faster than private clouds and analysts at IDC predict that public cloud growth will be 3 times that of private clouds by 2019.
"Outscale was founded in 2010, is based in France, is a strategic partner to Dassault Systémes and has done quite a bit of work with divisions of Dassault," explained Jackie Funk, Digital Marketing exec at Outscale, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
From personal care products to groceries and movies on demand, cloud-based subscriptions are fulfilling the needs of consumers across an array of market sectors. Nowhere is this shift to subscription services more evident than in the technology sector. By adopting an Everything-as-a-Service (XaaS) delivery model, companies are able to tailor their computing environments to shape the experiences they want for customers as well as their workforce.
"We focus on SAP workloads because they are among the most powerful but somewhat challenging workloads out there to take into public cloud," explained Swen Conrad, CEO of Ocean9, Inc., in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"DivvyCloud as a company set out to help customers automate solutions to the most common cloud problems," noted Jeremy Snyder, VP of Business Development at DivvyCloud, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"I think DevOps is now a rambunctious teenager – it’s starting to get a mind of its own, wanting to get its own things but it still needs some adult supervision," explained Thomas Hooker, VP of marketing at CollabNet, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Your homes and cars can be automated and self-serviced. Why can't your storage? From simply asking questions to analyze and troubleshoot your infrastructure, to provisioning storage with snapshots, recovery and replication, your wildest sci-fi dream has come true. In his session at @DevOpsSummit at 20th Cloud Expo, Dan Florea, Director of Product Management at Tintri, provided a ChatOps demo where you can talk to your storage and manage it from anywhere, through Slack and similar services with...
There is a huge demand for responsive, real-time mobile and web experiences, but current architectural patterns do not easily accommodate applications that respond to events in real time. Common solutions using message queues or HTTP long-polling quickly lead to resiliency, scalability and development velocity challenges. In his session at 21st Cloud Expo, Ryland Degnan, a Senior Software Engineer on the Netflix Edge Platform team, will discuss how by leveraging a reactive stream-based protocol,...
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to w...
For over a decade, Application Programming Interface or APIs have been used to exchange data between multiple platforms. From social media to news and media sites, most websites depend on APIs to provide a dynamic and real-time digital experience. APIs have made its way into almost every device and service available today and it continues to spur innovations in every field of technology. There are multiple programming languages used to build and run applications in the online world. And just li...
If you are thinking about moving applications off a mainframe and over to open systems and the cloud, consider these guidelines to prioritize what to move and what to eliminate. On the surface, mainframe architecture seems relatively simple: A centrally located computer processes data through an input/output subsystem and stores its computations in memory. At the other end of the mainframe are printers and terminals that communicate with the mainframe through protocols. For all of its appare...
"Peak 10 is a hybrid infrastructure provider across the nation. We are in the thick of things when it comes to hybrid IT," explained Michael Fuhrman, Chief Technology Officer at Peak 10, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Data reduction delivers compelling cost reduction that substantially improves the business case in every cloud deployment model. No matter which cloud approach you choose, the cost savings benefits from data reduction should not be ignored and must be a component of your cloud strategy. IT professionals are finding that the future of IT infrastructure lies in the cloud. Data reduction technologies enable clouds — public, private, and hybrid — to deliver business agility and elasticity at the lo...
"As we've gone out into the public cloud we've seen that over time we may have lost a few things - we've lost control, we've given up cost to a certain extent, and then security, flexibility," explained Steve Conner, VP of Sales at Cloudistics,in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"I will be talking about ChatOps and ChatOps as a way to solve some problems in the DevOps space," explained Himanshu Chhetri, CTO of Addteq, in this SYS-CON.tv interview at @DevOpsSummit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In their Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, and Mark Lav...
"NetApp's vision is how we help organizations manage data - delivering the right data in the right place, in the right time, to the people who need it, and doing it agnostic to what the platform is," explained Josh Atwell, Developer Advocate for NetApp, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
"We do one of the best file systems in the world. We learned how to deal with Big Data many years ago and we implemented this knowledge into our software," explained Jakub Ratajczak, Business Development Manager at MooseFS, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.