The Technology Hub: Datapower

Showing posts with label Datapower. Show all posts

Thursday, September 24, 2015

What are the ESB implementation patterns and SOA in Datapower? (115/285 technotes for 2015)

An ESB Must Support the following mentioned below -

Application Awareness in ESB

Service Virtualization
Improved Manageability - all the things below can be managed centrally

style sheets
security
caching
routing

Monitoring and Managing messages as they flow on the bus
Routing messages
Converting Protocols
Transformation
Securing messages
Providing connectivity to application services via open and propriety interfaces

Monitoring & Managing - log information about arrival path, contents of the msg based on filters

ESB general monitoring

track messages as they flow through the Enterprise - determine where time and resources are being spent
remote monitoring of Datapower appliances - using SNMP, WSDM, WS-Management and proprietary SOAP API.
for end to end monitoring for the ESB as well as the services is to - integrate Enterprise Monitoring software through std protocols like SNMP and ARM - like ITCAM for SOA

ESB service level management (SLA) via monitoring - this is one of the most important

throttle (reject) and shape(delay) traffic based on patterns below

Prioritization
Count Monitors
Duration Monitors

protects the backend application resources when.

application latency reaches a threshold
processing latency reaches a threshold

Routing - is required the 2 reasons mentioned below

Quality of Service - able to prioritize some message based on the the SLA
Support of specific functionality or affinity -

some functionality provided in a particular version
session may exist on a particular destination - requiring affinity based routing

Different types of Routing

Content based routing
Context based routing
Aggregation and Disaggregation

Protocol Conversion -

need to move messages from one protocol to another
web based scenario's are asynchronous, but back end systems are transaction oriented and want it to be synchronous. So state management responsibility is also there for the mediator.
if Websphere ESB is used - to convert protocol and transform and route message - it in general degrades performance

Message Transformation -

XML-to-XML Transformations
HTML/SOAP to XML Transformations
Binary Transformations
Content Enrichment and Filtering

Securing Messages -

Though it has a large set of Security services - but a fairly small set of Services should be available for an ESB

Support for standard WS-Security protocols as defined in the WS-I Basic Security Profile
Support for credential mapping across multiple protocols and transports
AAA

Connectivity -

References:

Datapower Architectural Design Patterns - Integrating and Securing Services Across Domains - http://www.redbooks.ibm.com/redbooks/pdfs/sg247620.pdf

What are the three possible placement of Datapower in an ESB scenario? (114/285 technotes for 2015)

Architecturally Datapower can be placed in the three possible places in the Enterprise Infrastructure

Standard ESB - basically used as an ESB
ESB Federated Gateway
DMZ Gateway - at the edge of the ESB

Standard ESB

ESB Federated Gateway

DMZ Gateway

Wednesday, September 23, 2015

What is a DMZ? (113/295 technotes for 2015)

In computer security, a DMZ or demilitarized zone (sometimes referred to as a perimeter network) is a

physical or logical subnetwork that
contains and exposes an organization's external-facing services to a larger and untrusted network, usually the Internet.

References:

Image Src - http://www.ibm.com/developerworks/websphere/techjournal/0907_banerjee/images/image002.gif

How can Datapower be used as an ESB? (112/285 technotes for 2015)

Datapower can be considered as an ESB since -

supports - abstraction using the proxy architecture
highly message oriented - with support for SOAP, raw XML and ther formats
has full Web Services support
Is network aware - residing between application layer and network - with support for

routing, msg filter, transformation etc

Also

has a surprisingly small footprint
built from the ground up to be network aware.

Monday, September 21, 2015

What is a multistep probe? What is a AAA action?(108/285 technotes for 2015)

Multistep Probe :-

To view the contents of any phase, enable the multi-step probe for the firewall or Web Services proxy - employing a document processing policy containing a AAA action

AAA Action :

AAA Action is a Datapower object - that references a specific AAA policy. This is the way to add (bridge) a AAA policy to any of the services mentioned below.

XML Firewall
MPGW
Web Service proxy
XSL proxy

References:

Datapower Architectural Design Patterns -Integrating and Securing Services Across Domains - http://www.redbooks.ibm.com/abstracts/sg247620.html?Open

What is AAA? (107/285 technotes for 2015)

AAA - stands for

Authentication
Authorization
Auditing

Datapower makes clear separation of processing of all three in a loosely coupled way.

The steps for AAA are:

Extract identity (EI) claim - such as username /password from HTTP basic authentication.
Extract resource (ER) - such as Web services URL being accessed.
Authenticates (AU) the extracted identity - with either an on-board / off-board identity server - LDAP
Map Credentials (MC)- using rewrite rules
Map Resource (MR) - mapped using rewrite rules
Authorize (AU)- submit to a policy server for authorization.
Post Processing (PP) - audit

References:

Datapower Architectural Design Patterns -Integrating and Securing Services Across Domains - http://www.redbooks.ibm.com/abstracts/sg247620.html?Open

What is Credential Transformation in Datapower? (106/285 technotes for 2015)

Since WebService requests have to travel multiple security domains, the credentials used in the inbound to a boundary server, often require transformation, before reaching the recipient.

Types of Transformation:

Technology -

changing a credential from one type to another
eg: sender might use Digital Signatures, while the receiver might use Username token.

Naming -

the name that represents a user might change, similar to Relationship in Process Server.
eg: your identity to IBM can be your serial number, but to bank it can be bank account number.

To Resolve this -

Custom developed ad-hoc code -

Datapower can perform complex transformations - using built in functions as well as custom transformations.

Leverage a product like TFIM (Tivoli Federated Identity Manager)

Datapower can also connect to products like TFIM.

Rule of THUMB:

Use Datapower - for simple credential transformation
User TFIM -

for complex credential transformation
when transformation occurs in multiple places like Datapower and WAS.

How does Datapower provides Acceleration and Flexibility? (105/285 technotes for 2015)

Acceleration -

Datapower consumes messages in the network speed, and can remove the WS-Security overhead and pass the clear message to back-end server and vice versa.

Felxibility -

Datapower supports more of WS-Security than of any Application Server - maybe Websphere will catchup the near future, but as of now they have a complete coverage.
Datapower fundamentally includes XSL processing engine - which helps in easy Transformation of messages.
By offloading the WS-Security processing to Datapower, we eliminate the need to configure and re-configure the back end server.

Example of Datapower usecase:

Client who want to use WS-Security but find that their Application Server, does not fully support this, should evaluate Datapower.
Clients expecting to frequently change WS-Security settings,
Clients with problematic messages.

Sunday, September 20, 2015

What is WS Trust & Secure Conversation? (104/285 tech notes for 2015)

Why WS Trust and Secure Conversation?

WS-Security adds enterprise-level security features to SOAP message exchanges, but with a substantial performance cost.

WS-Trust builds on WS-Security to provide a way of exchanging security tokens,
WS-SecureConversation builds on WS-Security and WS-Trust to improve performance for ongoing message exchanges

What is the performance issue with WS Security?
WS Security uses asymmetric keys - that is public and private key pair, which require larger keys and complex processing while decrypting messages vs single secret keys known to the both parties.

WS Conversation uses WS Trust (+ WS Security) to use only a single key pair to communicate between client and server.

What is WS-Trust?
WS Trust is a WS based standard for Requesting / Receiving the tokens

Function 1 - Implement the STS to

issuing
renew
cancel
validate Security Tokens

Function 2 - Support brokering Trust relationship

What is STS (Security Token Service)?

An STS is a web service that implements a simple interface defined by the WS-Trust specification. The operations supported are issue, renew, cancel and validation of Tokens.

WS Conversation - is a standard which allows symmetric encryption to be used ongoing exchange of messages between client and the server.

-----------------------

How WS Trust is established?

Consumer Requests a Security Token (RST) to the STS
STS returns a signed token to the Consumer - Request Security Token Response (RSTR)
Once the token is received - the requester can present it to multiple services.