Service Oriented ARCHITECTURES

Secure Web Application Development

Dr. Hale

University of Nebraska at Omaha

CYBR 8470 - SOA and Microservices module

Today: Web Services

 

Part 1: Service-oriented Architectures (SOA)

  1. History and SOA introduction
  2. Service actors
  3. Modularization and Service orientedness (to microservices)
  4. types of services

Part 2: Service Oriented Methods and Data formats

  1. WSDL, SOAP, and WS-* standards
  2. REST and JSONAPI standard
  3. Web sockets
  4. Data Formats: XML, JSON

Part1: Service-Oriented Architectures

History and SOA introduction

What Is a Service?

Real world 'service':

  • A piece of work performed by a service provider

  • Takes some input and produces some desired results

    • e.g. a restaurant: pay some money and get some food

    • e.g. a roofing company: pay some money, get a roof repair

  • Has quality characteristics (price, time, goodness of product, etc.)

Software world 'service':

  • Takes some input, performs some work, produces some output
  • Request-response model: client requests, server responses
  • Has quality characteristics (price, execution time, availability, security,  goodness of product, etc.)

Definition

A "web service" is a piece of software that performs processing and uses a web protocol to accept requests and issue responses.


earlier...

web service: a piece of software that serves up data through a web interface. Typically web services are object-oriented, provide access to a database, and encode data in XML or JSON.

Definition

SOA (Service-Oriented-Architecture) is an architectural paradigm that modularizes business functions into services by decoupling and encapsulating different portions of the business logic into different service components.

  • Services in SOA:
    • are autonomous and stateless
    • accept requests and return responses
    • use well-defined, standard interfaces (standard protocols) that define inputs and output structures
    • platform independent
    • discoverable

Autonomous -> Need not be aware of other services

stateless -> need not remember state from request to request

 

  • Improves scalability through horizontal cloning
  • Can store state in a database if it needs to be saved

standard interfaces -> Re-use web stack and define custom application endpoints

credit:

Torsten Braun, Universität Bern

platform independent -> Write a service once, support many platforms

discoverability

Service Actors

Services need consumers. Consumers use a client to make requests to the service's server. They expect to get a desired result or an error message.

 

Service providers host and manage their service offerings - maintaining service quality and security.

 

Service brokers match service consumers and providers - sometimes composing multiple services to fulfill consumer needs.

 

Modularization and Service orientedness

Modularization Through Service-orientedNess

Will come back to this

img credit: http://usblogs.pwc.com/emerging-technology/agile-coding-in-enterprise-it-code-small-and-local/

Service Types

  1. Infrastructure as a service (IaaS)
  2. Platform as a service (PaaS)
  3. Software as a service (SaaS)
  4. Desktop as a service (DaaS)
  5. Service as a service (SaaS2)

 

 

Example

credit: https://m.oursky.com/saas-paas-and-iaas-explained-in-one-graphic-d56c3e6f4606

Part2: Service Oriented Methods/protocols 
and
Data formats

A Tale of Two Eras

Legacy Services:

  • Uses SOAP, WSDL, XML, WS-*, etc

  • Older, more formally specified service types

Modern Services:

  • RESTful API services:
    • Uses HTTP, REST, JSON
    • Most pervasive services circa 2020
  • "Streaming" services:
    • Uses websockets
    • real time applications with "server push"
      usecases
  • New age services:
    • ​graphQL
    • gRPC (google Remote procedure call)
 

SOAP ERA

RESTful ERA

OLD School Services

Elements of a "HEavy" Service

Description in terms of WSDL (Web Service Definition Language):

  • Describes what a web service can do
  • WSDL is an XML based, open standard from W3C
  • Declares available methods (endpoints)
  • Identifies Input and output parameters

Protocol uses SOAP to exchange XML, XSD on top of HTTP

  • SOAP (Simple Object Access Protocol)

  • XML (Extensible Markup Language)

  • XSD (Extensible Schema Definition)

HTTP

Example WSDL

SOAP

Simple Object Access Protocol

  • Encapsulated in an Envelope
  • SOAP Header
  • SOAP Body
  • operates over HTTP or TCP
  • Allows for requests and responses
  • fill in parameters according to WSDL

 

SOAP Request Example

Note: Refers to some function called 'CalcDistance' that has two parameters 'startPoint' and 'endpoint'. Each point has an x and y field in the object.

SOAP ReSponse Example

Modern Services

REST

  • Representational State Transfer
  • Associate every resource with a URI (Universal Resource identifier) - accessible from a URL
  • Allow CRUD operations to retrieve and persist data -> works really well with SOA
  • We've seen REST at work with services like Twitter
  • REST has lots of advantages of most other approaches, but can result in overfetching or underfetching

graphQL

  • Basic idea: Traverse a graph to get only the data you need
  • Solves the problem of underfetching or overfetching
  • Invented by facebook
  • downside:
    • complicates architectural design (harder to use micro services)
    • very difficult to cache, since all requests are unique

WebSockets

  • Works directly on a single TCP connection
  • Provides full duplexing (bi-directional) communication between server and client - remains open during the duration of the connection
  • Great for streaming applications that rely upon a rapidly updating publish/subscribe model - particularly for server pushes 

DATA Formats

XML

  • XML is a markup-language for data representation
  • Used for encoding documents in machine-readable form
  • Text-based format, consists of tags, attributes and content
  • Can be used for data, meta-data, and structural presentation

JSON

  • JavaScript Object Notation
  • Basically a set of key:value pairs that define data according to a dictionary structure. 
  • Typically much less verbose than XML
    • e.g. <somedatatype>somedatavalue</somedatatype> becomes { "somedatatype": somedatavalue}.
    • particularly true for nested structures
  • Used for data structures not page or document structuring
  • Can still include meta-data easily.

RPC/graphs/etc

  • Remote procedure calls have been around for a long time. Depending on the RPC framework used, there are variant semantics. 
  • Graphs are data representations of actual networks of connected objects. Data is often serialized into a JSON format, but may be held in a variety of different formats.

Questions?

© 2014-2020 Matthew L. Hale or as listed

 

Matt Hale, PHD

University of Nebraska at Omaha

Assistant Professor, Cybersecurity

mlhale@unomaha.edu

twitter: @mlhale_

Attribution: Some slides are based on material from:

"Web services, SOA, and REST" course by the SoftUNI Foundation and are used under the CC-BY-NC-SA license