oracle application server 10g release 3 (10.1.3 ... · web services and enterprise java bean (ejb)...

Oracle Application Server 10g Release 3 (10.1.3.1) - Enterprise Web ServicesAn Oracle White PaperOctober 2006

Oracle Application Server 10gR3Enterprise Web Services

Introduction.............................................................................................3Oracle Application Server Web Service Architecture............................3Oracle Application Server Web Services Features.................................4

J2EE 1.4 Web services........................................................................4Web Services Metadata – Annotations Based Web Services..............5Database Web Services ......................................................................6Web Services Invocation Framework Support (WSIF)......................6Web Services Attachments..................................................................7

Web Services interoperability.................................................................8Oracle and WS-I..................................................................................8

Quality of Services and Management.....................................................9Web Services Management...............................................................10Web Services Security.......................................................................10Web Services Reliable Messaging ...................................................12Web Services Monitoring.................................................................13

REST Web Services..............................................................................13Developing Web Services.....................................................................13

Implementing the Web Services........................................................13Consuming Web Services.................................................................14OracleAS 10g Web Services and Tooling.........................................14

Oracle Fusion Middleware and Web Services......................................16Conclusion.............................................................................................16

Oracle Application Server 10g Release 3 (10.1.3.1) - Enterprise Web Services

Oracle Application Server 10gR3Enterprise Web Services

INTRODUCTION

With the advent of the Internet, enterprise applications evolved from a client/server to an Internet computing architecture, growing rapidly in complexity as a consequence. Faced with this architectural shift and with ever-changing business pressures, many information technology departments deployed enterprise applications using fragmented, piecemeal software infrastructure called middleware. The resulting middleware complexity represents nearly 50% of IT costs in most organizations. Further, 60% of organizations today consider their enterprise application infrastructure an impediment to their ability to meet business requirements. Enterprises are also evolving their applications from being monolithic, closed systems to being modular, open systems with well-defined interfaces. This new application architecture, called Service-Oriented Architecture (SOA), represents a fundamental shift in the way new applications are being designed and developed.

Web Services are in the center of the SOA by providing a standard based solution that answer the needs of having distributed system that can interoperate independently of the technology that it is used to implement the service itself or the client that consume it. Oracle Application Server 10g Release 3 (10.1.3.1) has complete support for Web Services. With a comprehensive offering, Oracle provides the ability to combine technologies to deliver unique and innovative business opportunities that will differentiate your business. This white paper provides a technical overview of Oracle Application Server 10g Release 3 (10.1.3.1) Web Services features.

ORACLE APPLICATION SERVER WEB SERVICE ARCHITECTURE

The Oracle Application Server Web Services framework has been designed from customer requirements, with a focus on usability, performance, interoperability and manageability. In addition to customer requirement Oracle is committed to support key enterprise standards that are emerging from Web services standard bodies like the World Wide Web Consortium (W3C), Java Community Process


(JCP) and the Organization for the Advancement of Structured Information Standards (OASIS).

Figure 1 provides an architectural overview of the Oracle Application Server Web Services environment. This shows that the Web services framework is built on the top of the proven J2EE 1.4 infrastructure of Oracle Application Server. The Web service runtime fully leverage the scalability, reliability and performance characteristics of that core runtime.

Figue 1: OracleAS 10g R3 Web Service Architecture

In addition to supporting publishing and consuming Java Web services, the Oracle Application Server Web Service environment also enable declarative quality of services (QoS) characteristics on those endpoints such as WS-Security, WS-Reliability, content based logging and auditing. The Oracle Application Server Web Service framework is used across the Oracle platform in a variety of component areas as foundation infrastructure in addition to being a standalone developer platform for developing Web Services.

ORACLE APPLICATION SERVER WEB SERVICES FEATURES

J2EE 1.4 Web services

The J2EE 1.4 specification outline a family of standards that make up the programming model for portable Web services. OracleAS 10g Release 3 (10.1.3.1) offers a complete implementation of these standards.

From a core programming API, this includes the Java API for XML Remote Procedure Calls (JAX-RPC 1.1) and the SOAP Attachment API for Java (SAAJ) 1.2.

Also impacting component developers is the addition of a native mechanism to declare an EJB 2.1 Session Bean as Web services. Lastly, Enterprise Web


With JAX-RPC and related APIs, J2EE 1.4

introduces standard development and

deployment models to develop Web

services applications

Services 1.1 (also known as JSR 921) defines a portable packaging and deployment model for Web services.

Using this standards based infrastructure the following Java artifacts are publishable as Web services in Oracle Application Server 10g R3:

·Java classes

·Stateful Java classes

·EJB 3.0 components



·JMS queue and topics

Web Services Metadata – Annotations Based Web Services

In addition to the fully specified Web services programming API provided by J2EE 1.4, Oracle Application Server Web Services debuts on of the first commercial implementations of Java 5.0 annotation programming model for Web services, compliant with Web Services Metadata (JSR 181)

This approach enables a significantly simplified programming model for Web services where developers add simple annotation markup to their Java classes to describe them as Web services. No other configuration is necessary. A sample class annotated for Web services is shown in Listing 1.

import javax.jws.WebMethod;import javax.jws.WebService;

@WebServicepublic class Echo {

@WebMethod public String echoString(String p) { return "echo" + p; }}

Listing 1: Annotated Java Class for Web Services

The annotation approach to programming in Java 5.0 is considered a major step forward in usability and productivity across the entire Java platform. Oracle has taken deliberate steps to ensure this model is available to the developer community as early as possible to ensure developers are able to understand how best to use it in their environments.

In addition to the standard JSR 181 annotations, Oracle provides


With Web Services Metadata (JSR-181),

OracleAS 10g R3 leverages Java 5

annotations to simplify Web Service

development

Web Services and Enterprise Java Bean (EJB) 3.0

Oracle Application Server 10g Release 3, is the first J2EE containers to support the EJB 3.0 specifications. EJB 3.0 simplifies the development of beans by using Java 5.0 annotations. In addition to the base EJB annotations, OracleAS 10g Web Services also provide JSR-181 annotation to EJB developers. With the support of EJB 3.0 published as Web Services using JSR-181, Oracle Application Server 10g R3 provides early features of Java Enterprise Edition 5 (JEE5).

Database Web Services

Oracle Application Server Web Services has supported publishing PL/SQL as Web service since Oracle9iAS Release 2. Oracle Application Server Web Services is also used as the Java runtime in the Oracle Database 10g for call outs to Web services. This support continues going forward but based on the new J2EE 1.4 Web services infrastructure.

In this release Oracle Application Server Web Services extends its database capabilities and tooling to include the ability to declaratively define the following database artifacts as Web services:

·SQL statements

·DML statements

·AQ queues

·Java classes loaded within the database Java virtual machine

Figure 2: Database Web Services

In addition to the capability of publishing database resources as Web service it is also possible to consume Web services from the database itself.

Web Services Invocation Framework Support (WSIF)

Developers often would like to describe resources using WSDL yet not require the abstraction of requiring the invocation model to be XML SOAP message based. The Apache Web Services Invocation Framework (WSIF) provides a general-purpose, extensible mechanism to describe arbitrary programmatic


OracleAS 10g R3 provides a simple and

powerful way to leverage Oracle RDMS

objects in a Services Oriented Application.

artifacts using WSDL as well as a framework to invoke those programmatic artifacts using their native protocols rather than through SOAP based messaging. Oracle Application Server Web Services provides an implementation of WSIF along with tooling to generate WSIF bindings within standard Java, EJB and PL/SQL Web services.

Figure 3: WSIF Architecture for OracleAS Web Services

Oracle WSIF implementation is designated to work hand in hand with the Oracle BPEL Process Manager which uses both loosely coupled Web services as well as native, high performance, transactional service interfaces based on WSIF bindings. Oracle BPEL Process Manager leverage WSIF to connect natively to Oracle Server, Java classes and Oracle JCA Adapators.

Web Services Attachments

Web services are getting more and more complex, and are used to send any types of information between applications. It is now a very current use case to have systems that send binary using Web services, this data could be document, images, multimedia files. Binary content can be sent using a SOAP message simply by encoding the content using Base64, this approach has the advantage of being interoperable but is not efficient document exchanged has a very large size. Industry has defined a standard way to exchange document with SOAP by sending them as attachments.

OracleAS Web Services enables developers to pass Multipurpose Internet Mail Extension (MIME) using SOAP with Attachment (SwA). OracleAS Web Services also support the Web Service-Interoperability (WS-I) Attachment


Profile 1.0. This profile defines a new XML Schema construct swaRef, providing an interoperable way to use Web Services with attachment.

In addition to MIME attachments using SwA and sawRef, Oracle also support Direct Internet Message Encapsulation (DIME). DIME is the encoding format supported by the Microsoft .Net platform. DIME is an important extension to the standard SOAP with attachment since Microsoft .Net does not support SwA and swaRef.

Finally, OracleAS 10g R3 (10.1.3.1) introduces support for Message Transmission and Optimization Mechanism (MTOM) encoding of binary content. MTOM together with XOP (XML Binary Optimized Packaging) defines how an XML binary data such as xs:base64Binary can be optimally transmitted over the wire. Not like SOAP with Attachment and DIME, MTOM does not add any particular extension to the WSDL, allowing optimized binary content transmission without impacting the development model. MTOM is becoming the default standard for attachment, and its has been adopted by the major Web Services platform including JavaEE and Microsoft with .Net 2.0 and Windows Communication Foundation (WCF).

Dealing with large attachments

It is now common to see applications that exchange hundred on megabytes or even gigabytes of information using Web services. One of the limitations of JAX-RPC is the fact that SOAP messages and attachments are treated entirely in memory, which will limit the size of the messages to the memory of your system. OracleAS 10g R3 Web Services allow the content to be streamed over the network. Streaming of attachments improves performance and scalability of Web services since there is no need to load the attachment in memory.

WEB SERVICES INTEROPERABILITY

In a SOA, services can be distributed on various locations and networks, intranet or the Internet. So it is impossible in this configuration to control the technologies used by all the actors of the application. It is true that Web Services Web services provide the infrastructure, based on industry standards, to support distributed services. Web services also define an implementation agnostic way of executing business logic. However many Web services specifications are open to interpretation, which result in services that cannot interoperate. The Web Services Interoperability organization (WS-I) was created to deliver clear and consistent recommendations to ensure interoperability between Web services.

Oracle and WS-I

A significant effort in J2EE 1.4 Web services was ensuring that Web services built with JAX-RPC and SAAJ could easily conform to the WS-I Basic Profile. By conforming to the WS-I Basic profile, a set of best practices defined by Oracle, IBM, Microsoft, Sun and others, developers have a high certainty that


OracleAS Web Services provides support for

MTOM, the new attachment specification;

facilitating interoperability with Microsoft .Net

and WCF platforms.

their Web services will interoperate across heterogeneous Web services implementations. By default, Web services built with Oracle Application Server 10g R3 Web Services conform to the WS-I Basic Profile 1.1. Further, Oracle has also done the same interoperability certification with its WS-Security implementation conforming to the WS-I Basic Security Profile 1.0. WS-I provides also testing tools to help developer to check the compliance of a Web services.

In addition, Oracle has extended interoperability scope by testing with most of the vendors and open source Web services stack available. One example of this effort in ensuring “real-life interoperability” is the support of DIME that has been targeted to have attachments that can interoperate with Microsoft .Net applications. In the same order, Oracle has also improved its Web service stack to facilitate the integration between Java and Microsoft Office 2003. It is now easy to develop Web services that can be consumed by the components of the suite.

QUALITY OF SERVICES AND MANAGEMENT

When companies are implementing applications they have several requirements related to security, reliability of the exchanges between the different systems, but also need to have solution to administer and monitor a running system. Web services application like any other, also need to provide such quality of services and management. Oracle Application Server 10g R3 provides a comprehensive solution to configure security and reliability of Web services. Oracle also implements some advanced capabilities around SOAP messages auditing and logging to facilitate the monitoring of Web services applications.

Figure 3: OracleAS 10g R3 Web Services Management


OracleAS Web Services facilitates the

development of services compliant with the

WS-I Basic Profile 1.1, Basic Security Profile

1.0 and Attachment Profile 1.0

Web Services Management

Oracle Application Server Control is designed to provide comprehensive end-to-end configuration management and real time monitoring with JMX. When deployed in OracleAS 10g R3, JAX-RPC, and metadata Web Services are automatically exposed to the management console.

Figure 4: Oracle Application Server Control

Oracle Web Services Manager (WSM)

In the recent years, most large companies have deployed dozen of Web services implementing a Services Oriented Architectures. These Web services are most of the time running on different platforms various level of security and management. In addition of the support of Web services management and security built in OracleAS 10g R3, Oracle provides with Oracle Web Service Manager a solution to centralized the visibility and control of all the Web services of the enterprise, running on Oracle AS or not. OracleAS Web Services framework is integrated with Oracle WSM facilitating the configuration of security policies, and monitoring of the different services deployed in Oracle Application Server. Oracle WSM allows administrator to easily integrate Web services to the global enterprise access control system such as Oracle Identity Management.

Web Services Security

Oracle Application Server 10g R3 provides a comprehensive WS-Security implementation for authentication, confidentiality with encryption and integrity with digital signatures as described below:

XML Digital Signatures: Message integrity addresses how to use digital signatures to ensure that SOAP messages are not tampered with during transmission. Oracle Application Server uses XML Digital Signatures to


Oracle Application Server Control offers a

comprehensive way to administer and

monitor Web services endpoints

ensure message integrity.

XML Encryption: Message confidentiality addresses how to use encryption to keep portions of a SOAP message confidential. Oracle Application Server uses XML Encryption to ensure message confidentiality.

Security Tokens: Message authentication provides a means for associating an identity with a message. For example, this could be a digital certificate or a username token. Oracle Application Server uses WS-Security SecurityTokens to provide message authentication capabilities.

SAML: Support SAML token profile as an authentication mechanism within WS-Security. This feature enables customers to use standards based authentication and to propagate the identity from one web service to another Web service in a standard interoperable way.

Figure 5: OracleAS WS-Security

Oracle Application Server Control provides a declarative way to configure security after deployment. Administrators can easily choose the different authentication options, but also the integrity and confidentiality of the messages.


Figure 6: Oracle Application Server Control WS-Security Configuration

Oracle Application Server 10g Web Services leverages the Oracle security libraries to sign and encrypt SOAP messages.

Securing Web Services application using HTTP security

In addition to the message level security (MLS) using WS-Security implementation, Web services leverage the HTTP security and authentication of Oracle Application Server 10g allowing administrators and developers to ensure security at the transport level (TLS). The standard solution to encrypt communication between the Web service client and the Web service has been to use Secure Socket Layer (SSL). The authentication is done using Basic, Digest or certificates-based schemes. On the server side, developer will use standard J2EE security model JAAS (Java Architecture for Authentication and Authorization) to validate the credential information and to check the authorization of the client application.

Web Services Reliable Messaging

In Oracle Application Server 10g R3, Oracle provides a complete SOAP reliable messaging infrastructure. This reliable messaging implementation is designed to provide architects with a guaranteed message delivery between a Web service client and server ensuring at least once, at most once and exactly once SOAP message delivery. In the current previews Oracle Application Server 10g R3, provides an implementation of the OASIS standard WS-Reliability however Oracle is committed to delivering an implementation of WS-ReliableExchange, a reliable messaging variant that has drawn consensus from the major Web services infrastructure vendors Oracle, IBM, BEA and Microsoft when it emerges from the OASIS standards body.

Like for the security, Web services Reliability is exposed in Oracle Application Server Control allowing administrator to easily configure the different policies around reliability of the Web services.

Web Services Monitoring

In Oracle Application Server 10g R3, Oracle provides a way to monitor very finely Web services exchanges. Administrators and developers can easily configure a Web service end point or client to persist entire or part of the SOAP requests, responses and faults. Auditing records message contents for purpose of auditing and/or non-repudiation, and logging extracts contents of messages and store them.


REST WEB SERVICES

In Oracle Application Server 10g R3, ordinary JAX-RPC Web services can be declaratively defined to support both SOAP messages over multiple protocols and additionally what is frequently called a REST style of Web services. REST is an acronym for Representational State Transfer and defines a simplified model for constructing Web services predicated on the basic web infrastructure of HTTP, URI and simplified data formats of plain old XML (POX).

Any JAX-RPC or Web Services Metadata Web service built on Oracle Application Server 10g R3 can be simply exposed both as a SOAP Web service or a REST Web service. In the latter case, there is no SOAP wrappers required on the message exchange, simply the XML message content, however, the resulting plain XML messages are still constrained by the message schemas defined in the WSDL. The end result is a highly productive yet radically simplified model for building Web services integrations and applications.

DEVELOPING WEB SERVICES

Like any distributed technology, Web Services as different actors:

The service provider implements the Web Service end point

The service consumer implement a Web Service client.

OracleAS 10g R3 provides tools and support to develop provider and consumer of Web services. OracleAS Web Services frameworks facilitates the development of the applications with powerful tools and runtime that hide the complexity of Web Services such as Java-XML mapping, generation and consumption of WSDL files.

Implementing the Web Services

Web Services can be developed using two approaches:

Bottom-up development

Top-down development

Bottom-up Web services development starts from the service implementation, for example a Java class. OracleAS Web Services tools, help developers to generates all the necessary Java artifacts, deployment descriptors, and the WSDL without having to deal with manual operations.

Top-down Web services development starts from the WSDL. Using Oracle Web services tools, developers use the WSDL to generate all the necessary Java artifacts and deployment descriptors.

Both development approaches are supported by OracleAS 10g R3 Web Services framework. Bottom-up approach is usually the easiest and quickest way of developing Web Services. But it may have some impact on interoperability. In a general manner the top-down approach is the best way of ensuring


interoperability, since the developer starts to develop his service describing the different message formats, and operation using XML standards, that are platform agnostic.

Consuming Web Services

The other actor of a service-oriented application is the service consumer. OracleAS 10g Web Service framework allows developer to easily create Web services clients simply using the WSDL file.

Using Oracle client side Web services API based on JAX-RPC, SAAJ and WSIF developer can access services running on Oracle Application Server or any other platform. When using the JAX-RPC client, developers can use declarative approach to set the security, reliability or auditing.

OracleAS 10g Web Services and Tooling

Oracle Application Server 10g R3 provides various tools to facilitate the development of Web Services, from a comment line interface, and Apache Ant to a complete integration to Oracle JDeveloper 10g.

Oracle Web Services Assembler (WSA)

Oracle Web Services Assembler (WSA) is the tool exposed by the framework that allows developer to easily create Web services endpoint from various sources, and also create Java client from WSDL files. WSA is accessible to developer using two modes:

Command Line Interface

Apache Ant task

These different more of operations allow the developer and architects to integrate the Oracle Web Services stack to any type of development and any IDE of the market.

Oracle JDeveloper 10g and Web Services

Oracle JDeveloper 10g is an Java IDE that provide end to end support to develop, debug, tune and deploy J2EE applications. In addition to all the necessary wizards, and tools to develop J2EE applications, from any Web component (Servlets, JavaServer Pages and JavaServer Faces), to EJB development (2.x and 3.0), JDeveloper also provides a complete set of tools for Web Services developers.

First of all it is possible to create services using top-down and bottom-up methodologies, using Java annotations and JAX-RPC code. JDeveloper provides wizard to publish Java classes, EJB, PL/SQL and JMS as Web Services. Also you can point a wizard to any WSDL and create JAX-RPC client. These wizard directly leverage WSA, this ensures a perfect integration with the core Oracle Web Services stack.


Oracle JDeveloper 10 g is a complete Web

Services tools allowing development,

deployment and testing of service endpoints

and clients.

In addition to the creation of the services and clients, JDeveloper provides a unique declarative approach to configure security, reliability and auditing/logging and this for the client and the server.

JDeveloper has other features that help developer to create, maintain and debug Web Services, such as:

WSDL Editor: The WSDL Editor allows developer to edit and view WSDL files in a graphical way.

UDDI Support: Developers can connect to any UDDI repository, such as Oracle Application Services Registry, and easily creation of Service Oriented Application using registered services.

HTTP Analyzer: JDeveloper can interact as a proxy between Web Services clients and servers and capture the SOAP messages. Capturing SOAP messages is one of the first steps of debugging SOAP based applications.

WS-I Tools integration: WS-I tools are integrated in Oracle JDeveloper allowing developers to check if a service is compliant with the WS-I profiles.

XML Editing: JDeveloper provides various tools to manipulate XML related document such as a XML and XSL editor, graphical XML Schema editor that help developer to use Web Services.

Figure 8: Oracle JDeveloper WSDL Editor and HTTP Analyzer

ORACLE FUSION MIDDLEWARE AND WEB SERVICES

Oracle Application Server 10g (10.1.3.1) Web Services framework is the based infrastructure for Web services in Oracle Fusion Middleware. Developers and administrators are able based on Oracle Fusion Middleware build, deploy and administrate services that are easily reusable in the different part of their applications.


Oracle Web Services Manager, BPEL Process Manager, Enterprise Service Bus, and the Services Registry are some of the components of the Oracle Fusion Middleware that leverage directly the Web service infrastructure.

CONCLUSION

Oracle Application Server 10g R3 Web Services framework is a major release regarding core Web Services features. It provides an industry standard based solution running on the top of the Oracle Application Server proven J2EE architecture. In addition to standard such as JAX-RPC, Oracle extended its Web services platform to support enterprise deployment such as WS-Security and WS-Reliability. Oracle also in this release, leverage the simplicity of Java 5 and EJB 3.0 annotation development to ensure rapid development of services oriented applications.

Oracle Application Server 10g R3 is the baseline SOA platform upon which the Oracle Fusion Middleware capabilities such as Oracle Business Rules, Oracle BPEL Process Manager, Oracle Web Services Manager, Oracle Enterprise Service Bus, Oracle Identity Management and Oracle Application Server Service Registry will be delivered, enabling organizations to develop, deploy and manage large scale integrated and interoperable service oriented architectures.



October 2006

Author: Tugdual Grall

Contributing Authors: Mike Lehmann

Oracle Corporation

World Headquarters

500 Oracle Parkway

Redwood Shores, CA 94065

U.S.A.

Worldwide Inquiries:

Phone: +1.650.506.7000

Fax: +1.650.506.7200

oracle.com

Copyright © 2005, Oracle. All rights reserved.

This document is provided for information purposes only and the

contents hereof are subject to change without notice.

This document is not warranted to be error-free, nor subject to any

other warranties or conditions, whether expressed orally or implied

in law, including implied warranties and conditions of merchantability

or fitness for a particular purpose. We specifically disclaim any

liability with respect to this document and no contractual obligations

are formed either directly or indirectly by this document. This document

may not be reproduced or transmitted in any form or by any means,

electronic or mechanical, for any purpose, without our prior written permission.

Oracle, JD Edwards, PeopleSoft, and Retek are registered trademarks of

Oracle Corporation and/or its affiliates. Other names may be trademarks

of their respective owners.

oracle application server 10g release 3 (10.1.3 ... · web services and enterprise java bean (ejb)...

Documents