What, Why and How: SOA With Microsoft

Reduced IT Costs

• It is common to see separate systems doing the same tasks while running in the same organization.
• The bottom line is that such duality has a great cost.
• Once a system can be exposed as a service, all the clients in the organization can use the same system.
• Services are autonomous. This isolation can be used to tear the service out and send it for outsourcing.
• Usually, most of the IT tasks are generic. Only a small minority are tasks specific to the business. In such scenarios, generic tasks can be consumed from generic worldwide services, instead of developing and running local on-premises implementations.
• Once a capability is developed, a business can consider exposing it as a global service and create another source of income.
• There are numerous examples of companies who have bought some expensive piece of infrastructure for their internal use and after integrating and using it locally, decided to expose it as a service. Other companies can save the cost of the infrastructure because they can consume the service while the first company receives income from an unexpected source (win-win).

Many Communication Technologies

• Services might expose different edges using different technologies and policies. For example Transmission Control Protocol (TCP) for local clients; HTTP for remote clients.
• Multiple messaging patterns can be used. For example Request-response for VIP users (immediate response) and fire-and-forget for normal users.
• Different security policies and technologies can be used. For example Kerberos for internal users, username and password for remote users.
• Later in the course, students will be shown how to create multiple endpoints can be created for a single WCF service.
• It is common to have several instances, each exposing a number of endpoints (edge). Traffic can be load-balanced between the endpoints.
• Load balancing can be based on traffic (usually done by hardware infrastructure) or based on the content of the message.
• The technology for implementing a WCF service endpoint (edge) is expressed using WCF bindings and behaviors.

High Scalability

• Services can be multiplied. Because services are independent and isolated, they can be multiplied.
  • Real-life example: Add more tellers in the bank during peak hours.
• Different messaging patterns and topologies scale differently.
• Request-response is a simple pattern, yet it does not scale very well. The service must have the resources to respond immediately. The client is blocked until a response arrives.
  • Real-life example: website.
• Fire and forget (one-way messaging) is more complicated, but it scales better. The client sends a request and does not block.
  The service queues (persists) the message and handles it when resources are available. The service should have a channel to send the response back to the client (not trivial). When the load comes in bursts, queuing can dramatically improve scalability.
  • Real-life example: Mail.
• A façade can improve scalability. All requests are sent to the façade first.
  • Requests are validated.
  • Simple requests can be handled by the façade only.
  • Complicated requests are forwarded to the actual service.
    • Real-life example: Call center.

Interoperability among Systems

• Services deal with data. Data can be created and consumed by any technology. This is the core of interoperability.
• If data is encoded or compressed using a proprietary algorithm, interoperability breaks (but might provide better performance).
• To be fully interoperable, data is written in text format using standard encodings (for example, UTF-8).
• Services must not know what technology is used on the other side of the line. As long as the correct information is provided, the service is happy to respond.
• Sometimes simple message transformations are required to handle versioning issues.
  • Different versions of the standard used to transmit messages
  • Different versions of the service contract
• Message transformations might be required to bridge endpoints based on different technologies and standards. Example: SAP to WCF.
• Integration layers (for example, BizTalk can implement message transformations).
• WS Standards ensure that all implementation technologies speak the same language.
  • Example: A Java client would understand a security header created by a WCF service.

Service Reliability

• Customers expect systems to be as reliable as possible. In other words, 100 percent availability and resilience to connectivity and performance issues.
• It is not realistic to have a 100% reliable system, but there are actions that can improve reliability.
  • Backup lists: The client/router keeps a list of services to use when the original service fails. Such lists can mask unavailability issues from the final consumer of the service.
  • Retry policy: If the service fails, keep trying until a certain limit is reached. Retries can be uniformly spread, or follow a custom pattern.
  • Message persistence: You do not want to lose an important transaction because a message was lost.
  • Messages are saved in a database or a queue until the business transaction is confirmed.
  • The copy of the message enables future retries or other error handling.
• Distributed systems must be constantly monitored to ensure correct behavior. Runtime governance infrastructures are used to monitor the system, diagnose the situation, and help to solve problems.

Built-in Security

• Data can be extremely valuable.
• Distributed systems exchange data.
• In real life, no one would consider exchanging money, Gold, or Diamonds, without proper security measures. The same policy should apply when exchanging data.
• Web application security deals with the action required to maximize the security of distributed applications.
• Data must be protected in the infrastructure layer as well as in the application layer.
• Identity and integrity are handled by adding standardized information to the message (for example, tokens).
• Organizations like the Open Web Application Security Project (OWASP) or the Microsoft Patterns and Practices position, publish security best practices.
• Web application security deals with.
  • Input validation
  • Authentication
  • Authorization
  • Configuration management
  • Sensitive data
  • Session management
  • Cryptography
  • Parameter manipulation
  • Exception management
  • Auditing and logging

How to Implement SOA using Microsoft Technology Stack?

WCF is a prime member of Microsoft's SOA technology stack to implement the SOA Architecture.

• WCF was introduced in .NET framework 3.0 in late 2007. It is the framework for building Service-Oriented Applications.
• WCF is a unified framework meaning that it supports all communication protocols and messaging patterns. WCF interoperates with older technologies like Microsoft ASP.NET Web Services. Yet it is not recommended to build new services using these old technologies. WCF is the framework to use.
• Many of Microsoft's distributed technologies are based on WCF. For example, Windows Azure, AppFabric, which deals with connectivity in the cloud, actually provides WCF bindings.