Does a Web Service Make a Service for SOA?

cloudcomputingexpo.com , 2006

Neither SOAP WebServices nor HTTP REST interfaces constitute services defined in SOA

What could be easier than to take your application, wrap it with a Web Service, announce it or register it in the UDDI and get a SOA Service? Even better – take a data warehouse, cover a SQL executing code with a Web Service and expose it to SOA, isn’t it simple? This article is for those architects and managers who like such “simplicity.” If you believe that a Web Service itself doesn’t convert an application into the SOA Service, you might read the article just out of curiosity.

A Service or Not a Service
Discussions about Service Oriented Architecture (SOA) initiated by people working with legacy applications and data storages like Data Warehouse (DW) have gotten a lot of press attention recently. While it’s good for SOA’s popularity the discussions typically declare a few SOA characteristics and say something like “We have so rich/important/business crucial data and, if we just expose it into a SOA, it will be great opportunity for us.” An intention of exposing DW to a SOA sounds suspiciously like the five-year-old movement of exposing all applications to the Internet. Have we forgotten that mistake already? Have we understood the difference between Web applications and Web-enabled applications? Did anybody count the man-centuries spent in IT to convert and modify existing applications to make them really work in the Internet environment?

When I participate in such discussions, I usually ask one question: “To make some ground for DW working in SOA, please tell me what is a service in DW?” I am given two types of answers: either “none” or “We do a lot of data transformations and/or perform sophisticated data aggregation and produce business intelligence reports out of the DW.” Well, data manipulation procedures performed in the DW might be considered as services, however, I have not found a definition of DW that would describe a service as a part of it. That is, DW wasn’t designed for services.

Anyway, what’s so special about a “service”? Why is wrapping access to a DW or an application with a Web Service not enough to obtain a service? What has to be done, if anything, to make such applications work in a SOA? Here I’ll try to identify a process that could take place when one prepares a legacy application to support a Service for SOA.

Approach to a Definition of a “Service”
In different spheres of human activity, there may be many definitions of a service. My understanding of service behavior with regard to software components is an action/activity performed by the service provider for the service consumer in accordance to a contract between the provider and the consumer. While contracts may vary, the most flexible type unties/decouples/isolates a consumer from a provider. In the business, as we know, the consumer pays for the service and tends to consider a service provider a servant. This leads to two conclusions:

• a consumer looks for a provider with the contract that meets the consumer’s goals.
• a consumer can agree with some of the constraints a contract puts on him if the contract still meets the goals and decouples the consumer from the provider’s internal conditions.

The conclusions point to the difference between using a software component as a traditional application and using it as a service. In the former case, a consumer depends on the application specifics and, if something isn’t suitable, the consumer has to adapt and wait for the application to be refined. In the latter case, a consumer deals with a service application only if the contract meets his needs and the application constraints are reasonable. For example, the constraints can provide some business values such as security, which adds business trust, or remote invocation, which can lead to service scalability and robustness.

Jumping ahead let me say that one SOA service can engage another SOA service doing this transparently to the consumer. If the second service provides the proper data based on an “update schedule”, i.e., the data are obsolete for some period of time, the first service tends either to find a substitute service with the correct data for that period of time or switch to a totally different service, without any “schedule problems.” In any case, the consumer shouldn’t depend on that schedule. Otherwise, all service contracts have to reflect one service specifics, which leads to quite an insufficient architecture and, actually, couples services and consumer together. Described is not a SOA rule, it’s a business rule and due to SOA agility principle, SOA promotes the same behavior.

Thus, the service contract can be used as a requirement when one transforms the application into a service. A well-known expression of a contract is a Service Level Agreement (SLA). There may be a single SLA for all consumers or the provider can maintain individual SLAs with every consumer. If we took a typical SLA used for DW, for instance, and a SLA used in SOA, we’d get the starting and ending points for the process we have to implement when exposing a DW to a SOA.

The process includes not only a new connectivity interface but changes in behavior dictated by the Service SLA. For immutable applications, the process assumes building a service façade layer to interact with other services and consumers.

Service Interface in SOA
SOA implies certain requirements in the service interface. In short, the interface has to be:
1)    stable
2)    self-describing
3)    independent from provider implementation and its resources
4)    registerable/searchable
5)    accessible programmatically
6)    versioned
7)    accessible under control (security)

As you see, there’s nothing about the Web in the requirements. Indeed, any particular interface implementation is suitable if it meets the requirements. It may be, for example, CORBA IDL. As we know, many elements of Web Services specifications were derived from CORBA. So, why is a Web Service (WS) as an interface so attractive for SOA but still not enough?

Web Services technology defines the abstraction of service behavior via standard WS Description Language (WSDL). It also provides for the abstraction of data via XML and the metadata definition via XML Schema. WS technology offers a WS registry known as UDDI (Universal Description, Discovery, and Integration) and a set of standards to support security ( WS-Security and related standards), transaction (WS-TXM, WS-Coordination, WS-AtomicTransaction, and WS-BusinessActivity), aggregation and management (WS-BPEL and WS-CDL), and interoperability (WS-I Basic Profile).

Agreement between leading technology vendors on XML and most WS standards makes Web Services really the best candidate for a universal interface for SOA. Some specialists include SOAP (Simple Object Access Protocol) in the basis of SOA while others disagree with it and consider SOAP only one of several possible and convenient protocols for WS binding. SOAP alone simply doesn’t provide enough abstraction for a service definition, that’s why we need WSDL and we already know a few WS models that don’t use SOAP binding.

What’s not included in WSDL is the information considered by a consumer when he makes a business decision about the service. That is, you can automatically invoke a WS but you’re not supposed to do so blindly, without estimating the inherited risk. It’s simple: if you want to cook some French fries, you’d not use a pan without checking if it burns oil. The same relates to WS – the service may be accepted if you know its connectivity interface and its quality characteristics like performance, change control rules, error-handling scenarios, and so on. This information is usually described in the SLA. So a SLA can be treated as a container that includes business knowledge and service interface definition – both to meet the consumer’s needs. A lot of legacy systems also work on the basis of SLA, however, those SLA are traditionally provider/application-centric.

Service Level Agreement for SOA Service
Currently, some efforts are made in the industry to define and formalize SLA for WS – these are specifications for Web Service Level Agreements (WSLA) and the Web Service Offerings Language (WSOL). The WSLA provides a structure of definitions of basic SLA elements. While it is a subject for separate article, we note the fact that the WSLA pairs SLA parameters with their metrics. That is, providing for SOA SLA means constant monitoring, analysis, and compliance reporting of actual runtime parameter values that aren’t a part of most legacy application SLAs.

Though a SOA SLA isn’t standardized yet, it’s very important to understand what can be included in it. Table 1 gives an example of a SOA SLA. Some parameters are measurable (as represented in WSLA) and some of them aren’t.

There are no mandatory or optional parameters in the SLA because they are all business- and context-specific. As mentioned already, neither Web Service/WSDL nor any other programming interface can address such SLAs. On the other hand, not all services require such detailed SLAs. Its can be periodically refined and extended when more objective information is gathered about the Service. The SLA demonstrates that participation in SOA requires both – the service interface and service behavior.

The only other thing I’d like to note is that it’s better for maintenance and further enhancements if all services in your system have a unified SLA, especially when the number of Services is expected to grow over the time. Otherwise, managing the Services quickly gets out of hands. That is, the better you define the Service, the fewer problems you have at runtime and the more consumers you attract to use it.

Thinking in SOA
We can find tons of publications describing how to wrap a legacy application with a Web Service. Many serious works recommend the same solution – the most scalable and flexible way of wrapping is to create a thin layer on top of the legacy application. The “preserve-and-extend” approach has gained a reputation as being the most reliable and cost-effective model for dealing with business-critical legacy apps.

Some vendors propose developing connectors and gateways where the former run in a mainframe and latter outside the mainframe (screen-scraping). Both models act as proxies shielding actual applications and helping to provide SLA. Merrill Lynch, in particular, has created an integration platform using plug-ins with parsers, metadata assemblies, and drivers that runs on the mainframe and exposes legacy apps through Web Services via HTTP and MOM protocols. This platform is even called a Service Oriented Legacy Architecture. However, many experts suggest that transitioning a legacy application to a Service for a SOA isn’t that straightforward: simple wrapping just “preserves” the application but doesn’t make it a “first-class SOA citizen” without an “extension.”

Let me give you two examples. The first one is about a traditional application in the financial industry; it may be considered a base line for the second example. Assume that the task is to calculate the credit risk of swap transactions (a special type of financial transactions). The transactions comprise the transaction data themselves, related financial streams, and cash flow data. These are dynamic elements that usually persist in an operational data store. Other related data about supply feeds and financial clients are static and usually persist in a reference data store.

The traditional application-centric approach of building a credit risk calculation component addresses the access interface(s)-access protocol(s) and defines data location, the data access mechanism (direct SQL, Stored Procedures, Views, security controls, etc.) and the data availability schedule. The team developing the application has to deal with its consumers (dictating application constraints) and constantly negotiate data status and updates with the database maintenance team. It leads to per-application specialized code that has to transform data to meet particular application needs. Any change in the data affects the application and all its consumers (via production re-deployment, at least). Such complex daily management task may be sufficiently executed if the team has enough resources and deals with only a few applications but this is a dream nowadays. A more realistic consequence is a shortage of resources and degraded quality, as well we know. And, there’s no room left to support business growth.

A service-oriented approach defines the credit risk calculation engine and the metadata that the engine can work with. That is, the engine knows about different calculation formulas and intermediary data storages, if needed; it also knows how to deal with data if it meets metadata requirements. That’s it. The consumer of the calculation service specifies what calculation to perform – for intra-day or end-of-day transactions. The input data is provided by another service, e.g., the Data Access Service (DAS), which also knows where to place calculated results. The calculation engine hasn’t a clue where to get data from, what transactions to process, when to do the job; it only cares whether the DAS provides a SLA and acts appropriately if the SLA is violated. Now every development and support team can concentrate on its own business and provide related SLAs.

Certainly we have to balance complexity and flexibility: how granular should a Service be to avoid unnecessary communications and function compositions? Is it always reasonable to extract data access from the business service and put it into separate specialized services? Answering these and similar questions, one caution has to be observed – never consider a solution in isolation from the environment. For instance, application developers believe that calling a database directly via JDBC/ODBC guarantees maximum performances. It’s true, but if the deployment environment requires a security authorization control for a particular database column or raw, your application is responsible for implementing and supporting such a control. Would you prefer coding this yourself or using an existing Security Service? That is, are you sure the performance you can provide would be better than a professionally developed Security Service? If you choose the latter, you can easily find that a Data Service is already integrated with the Security Service and, probably, is the way to go. What will happen to overall performance when you use the Data Service? May be nothing bad if you consider the Services and optimize your application design upfront.

Now is the time to ask: can our legacy application act as a service (an aggregation of services)? The answer may be “yes” if we transform the application with a service-oriented model. It’s a real opportunity if we can build or rebuild the application from scratch. Usually, the application is crucial for the business and/or not easily modifiable. Even in that case it’s not a lost investment but it will be if the application can’t keep up with the architecture evolution. For demonstration purposes, we’ll describe a gradual transformation of a data store into a SOA Service.

From the Data Store to the Data Service
We’ll start with a real-life example happened in a financial company providing support for a 401(k) plan over the Internet. Its customers complained that they couldn’t see some of their investments. The errors occasionally appeared and were reported by the end users. It took several days for the issue to work its way up the management line and for developers to locate the related data store. The data store provider worked on the basis of a regular service agreement that said that certain data had to be sent via a Web Service to the Web site component on-demand. The data was always sent, but sometimes one piece of data filed contained a NULL. For the data store, it wasn’t a mandatory field and it could be a NULL. The service agreement didn’t say anything about the quality of the data when the Web site was developed on the supposition that the data field was available and had a “non-null” value (as represented by the data store in the example).

The request to the data store to change the field constraint to avoid NULL was denied based on the fact that a lot of other customers considered the field optional. The behavior of the data store team was very typical – “We’re glad to support SOA and we give you all that we have.” Oops, there’s the problem: the end users and the Web site weren’t interested in what the data store could or couldn’t do but in the correct portfolios. It’s simple – if you want to wash you favorite Hawaiian shirt and the laundry only has bleach, will you use that service or go to another one?

Let’s look at the situation from the data store’s side and assume it’s serious about providing a SOA Data Service. Figure 1 and Figure 2 demonstrate possible actions the data store’s management can take to transit the data store into a data resource for the Service. The transition takes two phases – analysis and execution.

The analysis phase can be organized in two ways depending on the demand for the Service: a) the Service is really required and its customers can be identified; b) the Service is just a proposal intended to facilitate customer demand. Activities involved in the analysis phase are applicable in both cases with light modifications. In our example, the data field’s requirements are already identified. Further activities can be:

• Identify all dependent data and estimate the impact if the metadata has to be modified
• Identify the sources of the data and related SLA, if applicable, i.e., the quality of the available data
• If the Data Service has to engage other Services, review the relationship with the providers of the potential helper Services and related SLAs
• Define a basic SLA for the Data Service to meet the requirements; there may be multiple SLAs for different customers but they can’t be contradictory
• Identify the customer community and its dynamics
• Identify policy-based constraints on the Data Service (security, accessibility, internationalization, etc.)
• Identify the available or needed software and hardware.

Based on the results of the analysis, we can determine if a data transformation is needed for a particular SLA. This may mean modifying the data field metadata, particularly the database constraint that restricts the value from being equal to NULL. It’s also very important to recognize all the risks – operational and programming – associated with the data and the Data Service for adequate Risk Management and compliance with corporate and industry regulations. The findings will drive the Execution Phase.

The execution phase aims at what and in which order things have to be done, when intermediary decisions have to be made, and what the controls have to be implemented and preserved in the transition process. This phase ends in actually implementing the plan. The common rule is – when implementing a SOA Service or orchestrating a Service execution scenario, it’s not always necessary to exclude human intervention. First, it may be too costly to automate everything and second, because orchestration standards, e.g., BPEL, let long-living transactions integrate human actions into the service process.

Well, we assume that the metadata for a selected data field can’t be modified right away. It requires a grace period to take care of all customers of the data. So, a temporary Transition Data Service may be a solution here.

We can also create an intermediary data field that meets the Data Service requirements identified in the analysis phase. The mechanism of refreshing an intermediary data field is also defined (it may be based on a schedule or on a value-change event initiated by a manual operation). The Transition Data Service binds the intermediary data field as its data source.

The Transition Data Service has one specific: it provides the data with an indicator of “freshness” because the intermediary data field isn’t updated with new data if the data doesn’t meet the Service SLA. For example, if the Transition Data Service provides a Mutual Fund price and the latter has been set to NULL for today (e.g., the real price wasn’t calculated on time, by the deadline), the Transition Data Service will show the Fund price as a “yesterday” price but not as NULL.

Then we have to migrate existing customers of the selected data to the intermediary data field even if they don’t use a Data Service. It’s an operational process and it can take some time. This “delay” may even be good for the Data Service because it gets time to demonstrate its advantages. Simultaneously with the migration effort, we have to find either another data source that always has current data or work out this issue with the existing data provider.

When all the customers start using the intermediary data field and we get a proper data source, we promote the intermediary data field to a Master Data store and retire the initially selected data field. The Transition Data Service now becomes a fully scaled Data Service. Unfortunately, it’s not always possible to get rid of the initial data field because some immutable legacy applications couldn’t migrate. But it’s not a hopeless situation: those legacy applications can be temporarily buffered with a SQL substitution component (assuming that there are only a few such applications left). Technology evolution dictates that data source providers improve their services and eventually the inappropriate data will go away. This will enforce the legacy applications either take the new data or retire themselves.

Conclusion
The notion of a Service in a Service Oriented Architecture goes far beyond the definition of a new interface even if it’s a Web Service interface. Though the service interface is very important, the service provider has to provide the service, not the access to an application whose architecture and functionality may be inadequate for the service’s behavior.

We reviewed a few service characteristics and identified Service Level Agreements as an instrument for effective service interoperability and as a driver for service-oriented transformation in a service provider architecture. The obvious conclusion that a Web Service isn’t enough to constitute a service in a SOA was demonstrated by a real-life case of transition of a regular data store into a Data Service provider for SOA.

Webopedia – SOA definition: Abbreviated SOA, an application architecture in which all functions, or services, are defined using a description language and have invokable interfaces that are called to perform business processes. Each interaction is independent of each and every other interaction and the interconnect protocols of the communicating devices (i.e., the infrastructure components that determine the communication system do not affect the interfaces). Because interfaces are platform-independent, a client from any device using any operating system in any language can use the service.

Though built on similar principles, SOA is not the same as Web services, which indicates a collection of technologies, such as SOAP and XML. SOA is more than a set of technologies and runs independent of any specific technologies.

Webopedia – Data Warehouse definition: Abbreviated DW, a collection of data designed to support management decision making. Data warehouses contain a wide variety of data that present a coherent picture of business conditions at a single point in time.

Development of a data warehouse includes development of systems to extract data from operating systems plus installation of a warehouse database system that provides managers flexible access to the data.

The term data warehousing generally refers to the combination of many different databases across an entire enterprise. Contrast with data mart.

References

1. Sutor, Bob. “Something Old, Something New: Integrating Legacy Systems” www.ebizq.net/topics/legacy_integration/features/5229.html?&pp=1
2. Web Service Level Agreements. www.research.ibm.com/wsla/WSLASpecV1-20030128.pdf
3. Schmelzer, Ronald. “What Belongs in a Service Contract?”http://searchwebservices.techtarget.com/tip/1,289483,sid26_gci1120180,00.html
4. Meehan, Michael. “HP looks To Give Legacy an SOA Upgrade”http://searchwebservices.techtarget.com/originalContent/0,289142,sid26_gci1144084,00.html
5. Teubner, Russ. Integrating CICS Applications as Web Services. SWSJ, http://webservices.sys-con.com/read/39850.htm
6. Integrate existing assets and create new functionality.www.softwareag.com/Corporate/products/cv/leg_int/default.asp
7. Application Modernization & Legacy-to-SOA. www.interactive-objects.com/solutions/application-modernization/legacy_modernization_eng.pdf
8. Poulin, Michael. “Entitlement to Data” JDJ, Vol.10, issue 12, 2005 http://java.sys-con.com/author/poulin.htm
9. Service Oriented Legacy Architecture – SOA CICS.www.soa.com/index.php/section/products/sola/
10. Business Process Execution Language for Web Services. www-128.ibm.com/developerworks/library/specification/ws-bpel/
11. Web Services-Interoperability Basic Profile. http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp? topic=/com.ibm.websphere.base.doc/info/aes/ae/cwbs_wsiprofile.html
12. Web Services Security (WS-Security). www-128.ibm.com/developerworks/library/ws-secure/