sapienti sat: Making SOA Ready for the Enterprise

A must have for real life SOA

The Problem

Now that we have established that Aspect-based Governance is a must-have for an enterprise-grade SOA governance solution, let us look at how contracts and policies can and should be enforced at run-time. By now everyone agrees that building the enforcement functionality directly into service implementations is not a very good idea. Doing so burdens the developers and results in tight coupling between the enforcement mechanisms and the business functionality. Even more importantly it limits the enforcement to the services that have been developed on-site and after the decision to enforce a particular governance aspect has been made. So most run-time governance vendors took the obvious route of embedding the enforcement mechanisms into their enforcement agents. Products based on this architecture are easy to implement, understand and optimize. However they all share one important drawback: IT governance was not invented for SOA, it existed log before. And companies have built and acquired a wealth of governance solutions to address the specific aspects of it. Here are just a few of the examples of what I call point or legacy governance solutions:

• Sun’s Access Manager and CA’s SiteMinder and a host of WS Security appliances for security;
• IBM’s Tivoli and CA’s Unicenter for monitoring and management;
• Sun’s Identity Manager, Tripwire Enterprise and Consul InSight for audit;
• Mercurial for version control and change management;
• A multitude of metering and billing packages, etc.

Thus any time a SOA governance vendor decides to embed a particular aspect enforcement and/or monitoring mechanism into their gateway or other run-time enforcement engine, they effectively force their clients to adopt a parallel mechanism for governing that aspect in services to the one they already use elsewhere in throughout their IT. This leads to many inefficiencies including:

• Training operations personnel to use two systems instead of one;
• Defining and maintaining policies in two different formats and places;
• Monitoring two sets of alerts, logs or feeds, etc.

And since companies rarely adopt SOA in one shot but typically evolve towards it for years, the cost of this duplication can grow over time to quite significant levels.

At the same time because the market is so diverse and there are at least two of everything, one can never assume that all clients will have a particular (or any) point governance solution for even most common aspects, so no governance platform should solely rely on delegation of enforcement functions, but rather offer a gamut of options, as described below.

The Solution

As it is probably obvious from the title of this post, I believe that Delegated Governance is the only viable answer to the challenge that was presented earlier. By this I mean not simply integration with a few popular legacy governance packages, but the ability to delegate enforcement and monitoring of any SOA governance aspect either entirely or in par to any solution (packaged, customized or home-grown) that is being used for this purpose in non-SOA parts of the IT and has suitable integration points or APIs. Coupled with aspect-based governance architecture it gives the adopters almost unlimited flexibility, including the freedom to:

1. Delegate enforcement of the same aspect to more the one package;
2. Combine native and delegated enforcement;
3. And, most importantly, change their mind about any of this later!

In addition to native (non-delegated) enforcement, an enterprise-grade SOA governance platform should supports the following types of delegation:

• Complete delegation – when a legacy governance solution implements the entire set of the required governance functionality and exposes it through an API at the right level of granularity its endpoint can simply be registered as an Aspect Enforcement Method for the corresponding aspect. For example SecureSpan Gateway from Layer 7 when configured in the echo mode can be registered as a Security Aspect Enforcement Method.
• Partial delegation – when a legacy governance solution implements only a subset of the required governance functionality, a simple aspect enforcement method would implement only the missing functionality and delegate to the existing governance solution the parts that it supports. For example many SOA Security products that evolved from Web Site/Portal security solutions lack many key functions such as non-repudiation, but still can be used for authentication and authorization of the requests.
• Orchestrated delegation – when a legacy governance solution implements the required governance functionality but does not expose it through an easily accessible API or the exposed API has a wrong level of granularity, a simple aspect enforcement method would serve as an adapter between the SOA governance platform and the existing governance solution invoking its functionality through a sequence of low-level API calls. This way governance would still happen inside the legacy solution, eliminating the need for duplication of principle and policy information. For example some SOA Security solutions can not look inside the SOA message and perform all facets of security processing, but provide APIs for verifying credentials, validating security tokens and performing authorization decisions.

Please note that the fact that a run-time governance product integrates with a particular legacy governance solution, such as a security package, doesn’t mean that it is capable to delegate the corresponding aspect to it. For example we have recently looked at a Web Service security product, which amongst other features claimed integration with Sun Access Manager. However a detailed analysis revealed that this integration was used to secure web access and did not allow to leverage any of the SOA Security capabilities of the latter. Also notice that integration has to be done by the platform vendor at development time and can only cover few of the most popular legacy governance solutions while delegation is done on demand at the client site and can cover industry- and geography-specific targets as well as home-grown solutions.

Please bookmark with social media, your votes are noticed and appreciated: