Unit-4 (Part 2)
SOA Governance, Security and
Implementation
1
Topics to be discussed
SOA governance
SOA security
Approach for enterprise wide SOA implementation
2
Introduction
To successfully implement SOA in an enterprise:
Define rules
Processes
Metrics
Control of SOA implementation
Governance and security addressed by the
infrastructure layer for the Strawman architecture
3
Business Process Layer
Business Process Process Orchestration
workflows Engine
Business Process Services
Data
Sources Data
Services Client
layer
layer
RAT ION LAY
ER
Services Enterprise
INTEG Layer Presentation
Layer
Infrastructure
Relational
M Layer
Databases a
p Data Client
pi Servic Service Web
e
n Governance Security Delivery
g
&
Spread
Sheets Tr
a Data
Servic Client
n e
sf Service
o Mobile
r Delivery
m Activity Activity Activity
Ware
houses a Service Service Service
Data
ti Servic
o e Activity Services Layer Client
n Service
External
Data
Sources Business Business Business
Application Application Application
Business Application Layer 4
SOA Governance
SOA Governance is a model of establishing
Policies
Controls
Enforcement mechanisms
It involves process that defines policies,
technology that establishes controls
people that enforce mechanisms.
5
SOA Governance
SOA implementation involves
Formulation of strategic architecture
Development of services
Governance of Service Design
Governance of Service Execution
Governance of Service Modification
6
SOA Governance
The drivers for SOA Governance:
1. implementation of best practices;
2. business and IT alignment;
3. real-time service visibility;
4. reduce risk;
5. measurable ROI;
6. realize service reuse;
7. track and communicate progress of SOA
implementation.
7
SOA Governance- Strategic Architecture
the principles of enterprise architecture may be
applied in arriving at a SOA-based strategic
architecture
Principles of enterprise architecture governance can
also be applicable to SOA governance
Process
Technologies
People 8
Strategic Architecture - Process
Governance for SOA strategic architecture includes:
1. Architecture principles that the strategic architecture would need
to comply with. (framework such as TOGAF customized for SOA)
2. Definition of processes that lead to the formulation of business,
application, information and infrastructure architecture.
3. Architectural considerations for SOA infrastructure layer including
service security and service governance (design-time and run-
time).
4. Decision-making criteria for selection of vendor products and
tools.
5. Roadmap for implementation of the strategic architecture.
6. Specification of QoS parameters for services.
7. Recommendation of Service Level Agreement (SLA) requirements
9
(that service providers need to fulfil).
Strategic Architecture - Technologies
Establishment of standards for technologies used
for development and deployment.
Tools (such as IBM Rational System Architect to
specify strategic architecture).
Identification of PoCs to validate the strategic
architecture.
10
Strategic Architecture - People
Governance team with architects and key
stakeholders from across the enterprise with
representation from senior management is
constituted to ensure that the processes and approval
cycles are appropriately followed for changes and
deviations.
A suitable mix of enterprise, solution and
infrastructure architects in the governance team to
develop standards, policies, rules and guidelines to
implement the strategic architecture and approve
changes and deviations. 11
SOA Governance- Development of Services
Services are created, consumed, changed and removed
during their lifecycle.
The governance of services involves definition of
policies and rules for
service design (creation),
service execution (consumption) and
service modification (change and removal).
Governance of Service Design
The Process, technologies and people involved in the
governance 12
Service Design - Process
As design of services with the right level of granularity for
reuse is critical to success of services and SOA
Policies may be defined to validate service definitions and
ensure that they conform to relevant industry standards
(WS-Policy and WS-Interoperability).
The four types of services (activity services, business
process services, client services and data service) and
reference models for those types services based on best
practices.
`Procedures for review and approval of services. 13
Service Design -People
Governance during service design is mainly the
concern of business analysts, architects and
developers who build services.
The governance team involved for approval of
policies and for exceptions/deviations.
16
Service level agreements
1. throughput (calls/min.)
2. response time(s); 7. service reuse index (ratio of reusable services
across business processes to the number of
services exposed);
3. availability (%); 8. service reuse frequency (average number of
times a particular service is reused);
4. number of slow calls (>2s); 9. service variants index (number of
variants/versions for a given service);
5. maximum number of 10. service failure index (percentage of failed
messages/day; service invocation per unit time);
6. service throttling (max concurrent calls) 11. service recovery index (percentage of
service recovered over services failed)
19
Technologies for SOA Governance
Several vendors have comprehensive solutions
that provide the required governance capabilities.
Organizations can use an appropriate solution that
enables design-time governance through a service
registry and repository
leverages them for service monitoring and
management for run-time governance. .
27
SOA Governance Tools
28
SOA Governance Tools
29
SOA Security
Security in the context of SOA has three factors.
securing the interactions between service providers and service
consumers.
securing the deployment environment of applications that expose and
consume the services. (security solutions for IT infrastructure).
management of policies for security and their associated infrastructure.
We will only address the first factor (securing interactions between
service providers and service consumers) here.
30
SOA Security
The key capabilities for securing interactions
between service providers and service consumers
include :
Authentication;
Authorization;
Audit;
Identity;
Confidentiality and integrity.
• '
31
SOA Security
Authentication involves validation of credentials of the requester
unilateral one-pass (validate service consumer)
mutual two party (both service provider and service consumer are validated)
Successful validation results in a security token.
The service consumer then calls the method of the service using the security
token.
Authorization provides access to a service based on a set of policies
(privileges)
the authorization information can be centralized or federated
When the service consumer is authenticated, access is permitted based on the
policy information specified.
32
SOA Security
Audit
collects data of service invocations, stores
and reports it to provide a record of
interactions between service providers and
service consumers
Identity provides a framework to manage,
share, federate and access identity information
from identity sources of user and groups.
33
SOA Security
Confidentiality and Integrity protects sensitive
information from being disclosed and detects
unauthorized modification of data.
The above capabilities need to implemented in the
infrastructure layer of the enterprise Strawman
architecture to address the concern of securing
services.
34
Technologies for SOA Security
35
Summary
SOA governance
Process, Technology, People
Architecture, Development (Design, runtime, change)
SOA security
Authentication, Authorization, Audit, identity, confidentiality, integrity)
approach for enterprise wide SOA
implementation
Strategy (Due Diligence, AS-IS, TO-BE)
SOA Development
(transition planning; validation; business process model creation; service
development; service deployment and monitoring.)
63
