Moving Blog

To simplify the blogging experience, we have setup a new blog location related to HKM Consulting LLC and our SOA, Cloud and other general technology experiences. You can reach us at: New HKM Blog

Getting soapUI AMF example on MacOS Running

If you are trying to get soapUI 3.6.1 AMF example running with BlazeDS samples, make sure you do the following:

- Place the flexsample.jar file under /Applicatons/eviware/soapUI-Pro-3.6.1.app/Contents/Resources/app/lib
- Restart the application and create a TestSuite, TestCase, AMF Test Step
- Specify the endpoint of: http://localhost:8400/samples/messagebroker/amf
- Specify the AMF Call as: product.getProducts

All is good!

SEVERE: WSSERVLET11: failed to parse runtime descriptor: exception during WSDL parsing

Have been doing development of JAX-WS service in Metro/Tomcat 6 and ran across the following failure when deploying the WAR file. Examination of google results didn't provide the exact answer I needed but resolved it by doing the following:

- Under the WEB-INF a directory called com existed that I had noticed before.
- Examined the contents of it and found the package and java classes was reproduced in this location.
- Deleted the directory, recreated the WAR and redeployed.

All was good!

Musings about Oracle SOA Suite 11G

A little over a year ago I undertook a project to migrate a customer of mine from Cape Clear to a new solution. The solution chosen was Oracle Fusion Middleware and more specifically we settled on the Oracle SOA Suite 11G. With no training, great assistance by Oracle Product Management and lot of trial and error we were able to get SCA composites with BPEL components developed within a 1.5-2 month time frame. Like most SOA Platforms, the secret was not so much in the development but more so in the runtime and tuning. Like most BPEL engines, this one was no different in that the Database and its proper configuration required great effort on the part of Oracle support and my clients DBA and WLS experts. The migration took approximately 10 months. So what did I learn?

- Development with Web Service standards is a significant time saver.
- We struggled with where the rubber meets the road.
-- JMS Adapter configuration within the container to integrate to a non-certified JMS Provider.
-- Oracle RAC Tuning and Configuration for SOA Suite specifically
-- WLS Tuning and Configuration for SOA Suite specifically

So in the end migration if planned properly can be done, but always leave extra time for the tuning and performance testing.

Oracle vs. Open Source

With all the clients we work with, HKM has to be flexible to meet their budgetary needs. Some of our clients will have enterprise agreements and others are just starting. To this end, open source is the defacto starting point for many. Over the next several months I will be diving into the Apache solutions to a take another peak at the most recent Apache CXF, Camel and Ode. I am specifically interested in Ode to see how it has progressed from when I tried it 2 years ago and how close these solutions are to Oracle SOA Suite and other traditional vendors.

Oracle SOA Suite 11G, JmsAdapter and Sonic MQ Topics

Recently we were working with a customer who needed to integrate SOA Suite to Progress Sonic MQ and specifically topics that were hosted. The first step with Oracle is to edit the JmsAdapter.rar configuration (specifically weblogic-ra.xml) to point at Sonic MQ. Sonic

<connection-instance>
<jndi-name>eis/sonic/queue</jndi-name>
<connection-properties>
<properties>
<property>
<name>ConnectionFactoryLocation</name>
<value>MyCF</value>
</property>
<property>
<name>FactoryProperties</name>
<value>java.naming.factory.initial=com.sonicsw.jndi.mfcontext.MFContextFactory;java.naming.provider.url=tcp://sonicmq1:2506;com.sonicsw.jndi.mfcontext.domain=Domain1</value>
</property>
<property>
<name>AcknowledgeMode</name>
<value>AUTO_ACKNOWLEDGE</value>
</property>
<property>
<name>IsTopic</name>
<value>true</value>
</property>
<property>
<name>IsTransacted</name>
<value>false</value>
</property>
<property>
<name>Username</name>
<value></value>
</property>
<property>
<name>Password</name>
<value></value>
</property>
</properties>
</connection-properties>
</connection-instance>


Having integrated to Sonic Queue(s) in the past, we were running into an issue where the SOA Suite cluster was picking up the message for each node within the cluster and was unaware of initially how to solve this. A simple solution was identified and specifically it was within the jDeveloper JmsAdapter Wizard. The following image shows the "Durable Subscriber Id". By simply specifying a value here, the cluster is only allowed to consume one message from the topic.

Oracle 11.1.1.2 XPath issues

Currently I have been migrating BPEL for a client using Oracle SOA Suite and ran into incompatibilities between 11.1.1.1.0 and 11.1.1.2.0. A simple example that worked in 11.1.1.1.0 and not in the latest patched released is a simple evaluation where I am trying to confirm the existence of an element in a message.

<bpws:getVariableData("message","part","/element/element")> = true()

The same statement also works in Cape Clear ESB and its BPEL implementation.

One workaround that I used was to count the nodes using the Oracle XPath Advanced Functions:

ora:countNodes("message","part","/element/element") > 0

I am working with Oracle support services to see how this can be resolved in the code base.

Open Cloud Manifesto and Standardization

The Open Cloud Manifesto provides a solid definition of the state of cloud computing. Just like other industry movements in distributed computing, enterprise integration or other, cloud computing is evolving in many different directions but the core patterns and architecture of outsourced infrastructure, platforms and software supporting elasticity, multi-tenancy, metering etc.

The hope of the manifesto and other cloud computing standards/organization, standardization in the areas of deployment, execution and management are desirable. When standards exist, it allows us to focus on generating business logic and the value it provides versus the technical wiring and potential workarounds necessary. Just like Web Services and the standards they developed over the past 10 years, I envision cloud computing will take a similar period of time to clarify and flush out the details that can be standardized.

The one area that has traction is support for REST/SOAP based APIs. In fact as companies develop private clouds and potentially expose them as to the public, other architectures such as SOA become important in providing concise and clear interfaces to business logic.

Wiseclouds: Eating the Dog Food

As part of our development of WiseClouds, it is important that we demonstrate our agnostic nature in evolving the company and its technologies. The site itself is a Google Apps Engine based with integrations into Salesforce.com and Amazon EC2. We will also include Azure in the future along with WordPress for blogging services. This simple example allows us to demonstrate the use of PaaS, IaaS and Saas.

Wiseclouds is out

As part of my own transformation to work with customers in new and interesting ways, I am collaborating with a team at WiseClouds to bring cloud computing training and consulting to a wider audience. Similar and yet different then SOA, Cloud means many things but is already proving its value in a few customers I work with and is on many a tongue in IT.

Anyway, check out what we are working towards which is generating very useful training content along with a group of experienced practitioners in Service and Cloud Computing technologies.

Cloud Computing begins but beware of the bill!

Per Gartner and other research organizations, customers have gotten familiar to the Adoption curve slide as part of state of the union for a technology segment. Cloud Computing in its various flavors (SaaS, IaaS and PaaS) has hit main street or in Gartner parlance is with the Early Adopters. Organizations that adopted SaaS (i.e. Salesforce.com, Workday) realized the financial benefits of the pay per subscriber model. Now as the space has rolled out Infrastructure and Platform services, customers are dipping their toe in the water or jumping right in. Some teams are placing functions in the cloud to take advantage of the elasticity features due to the processing volume necessary. Others are rapidly developing applications to fill voids in their technology stack sometimes by the Sales organization or other non-traditional technology. This wild-west period eventually settles down when the rest of the marketplace catches up and Cloud becomes the standard technology medium.

The piece that is daunting right now is the cost that can creep up on you if you are not careful. With billing being an aggregation of the data stored, data shuttled, number of instances, number of connections or other metrics, it gets easy to forget the costs especially if elasticity is enabled in the environment. Similar to mobile data plans, triple play packages, the end of the month bill can be staggering. For now, make sure you not only architect a solution but also the cost models associated with that solution. A good rule of thumb is when developing and testing within the cloud, the costs are quite reasonable. If developing a large scale application that will be running 24x7, be clear on the aggregate costs and talk with the vendor about pricing flexibility.


The following examples provide details from two popular vendors on pricing:

Microsoft Azure Pricing

Amazon Web Services Pricing

Cloud to Cloud Integration

After having hosted a Cloud Computing event in November and hearing how companies are dipping their feet in the cloud, the next logical step we discussed was inter cloud communication. As a small company I may buy into Salesforce.com for CRM, Workday for HR/Financials and Google AppEngine for custom apps. How do I tie these solutions together for data synchronization? What if the data to be exchanged is extremely large? What solutions can I use to do the heavy lifting?

Service Bus solutions either deployed locally or in the cloud provide a composition medium to support such interactions. Cloud platforms expose public APIs via REST or SOAP for near-real time communication.

Large data sets and exchange of this for processing is being investigated by a interesting consortium called Open Cloud Consortium.

Another interesting area may be the creation of middleware in the cloud. Grand Central tried to support this in the early 2000 timeframe. It was a little ahead of its time but now we are seeing Amazon SQS, Microsoft Azure w/Biztalk and other similar platforms.

QCon, Security and Musings

I was fortunate to speak at QCon San Francisco, CA on November 20 discussing Service Security and my own journey on understanding security but more importantly how services can be hacked. It was interesting when examining the audience to see a mixture of participants but the lack of questions was a little disconcerning. I could take three things from that:

1) Everyone in the audience was familiar with service hacking / security.
2) People are not very familiar and were afraid to ask questions or didn't understand the content.
3) People were not interested.

Since the audience stayed for the entire presentation and questions were basic, I think the majority of the audience was in category 2.

With the increasing discussion on Cloud Computing (QCON was loaded with Cloud presentations as was SOA / Cloud Symposium 2.0/1.0) security had very little presence. In understanding security, my own education was due to a client requirement. With just a couple months of effort, I was able to better understand the security technology. The harder part has been in understanding the hacking culture, finding helpful material and approaches and how that impacts services I create. Here is the link to the QCon presentation.

ECAUG 1.0: Architecture User Group

Wednesday this week I hosted a user group in Waltham, MA focusing on Cloud Computing experiences. I was fortunate to have Steve Robbins of Modus21 and Matson Wade representing HKM at the event. In their discussions, they broke down their experiences with Amazon Web Services specifically EC2, S3, SQS and a few other features. If you are interested in participating in the future, let us know. We can extend an invite to the Ning forum that we have setup and you can check out the presentations. A couple of criteria at the moment are you are based in the US and you are willing to proactively participate. No vendors are allowed which in turn provides a more frank and interesting discussion.

SMB not fit for SOA?

During a training class I was leading today, a very interesting question came up which is "All this SOA stuff we have been talking about today is great for a large company but seems to be overkill for the SMB (Small / Medium Business). Since SMB makes up a much larger percentage of the business world then traditional business, why should we care?".

Well one way to look at the problem is that services are permeating the cloud computing space, in fact last week's SOA Symposium co-hosted a Cloud Computer Conference. Cloud computing is becoming a game-changer for SMB in providing a variety of tooling from productivity (documents, email, etc.) to CRM (i.e. Saleforce.com) to HR (i.e. Workday) to Infrastructure (i.e. Amazon/Azure). The one common aspect in these is the ability to interact using service APIs and thus the need for SMB to be adept at service consumption and composition.

Versioning Podcasts

As part of my work with SOA Systems / SOABooks.com, I was asked to support Podcasts on versioning based on my participating with David Orchard (formerly BEA). Check the two podcasts out and fire over some questions if you have any.

Flexible Contracts?

After having delivered SOA Training to various clients this summer and fall many have asked how to deal with change. The contract is the center piece of services and with an effective versioning strategy it can be difficult to alter due to coupling that occurs with service consumers. David Orchard, James Pasley and others have been documenting versioning strategies. From my work with David on the SOA Patterns book(Erl 2008) and my consulting with organizations employing Agile Methodology, contract refactoring/change is a mandatory requirement.

Identifying a versioning strategy such as Strict, Flexible or Loose along with Versioning Identification and Compatibility design patterns provides a foundation for indicating change and providing consistency in managing the consumer impact.

For further details check out a presentation related to mixing Agile along with SOA Design Patterns and Meet in the Middle Strategy.

SOA Symposium 2.0: Rotterdam, Netherlands

It is amazing another year has passed and SOA Symposium 2.0 is around the corner. As part of the presentation work, two areas that I have focused on in blog postings and customer work is in Agile Methodology and Service Hacking. Check out the presentations and feel free to post any questions.

East Coast Architecture Group: Cloud Computing Seminar

The past couple years has seen an increase in the discussion and interest in Cloud Computing. In my own experience it started with Salesforce.com in 2003/4 and then Workday which acquired Cape Clear in 2008. More recently I have been tracking the use of Amazon EC2/S3 etc. and the impacts that IaaS is doing to the IT community. To help customers and architects that I have interacted with in the past 10 years, my company is hosting / starting an Architecture User Group. The first topic to be discussed is Cloud Computing and people that have experiences with this medium. The following URL provides specifics on the topic and dates:

East Coast User Group: November 4th, 2009, Waltham, MA

Justification for constraining your XML Types

As part of work for a client and some training I need to perform in the future, I have been spending time on hacking of web services. A simple mechanism that is often unchecked is the use of types that have no restrictions within XML Schema and WSDL. An example is simple schema below where the Social Security Number is not restricted in length and type:

<xsd:element name="SSN" type="xsd:string"/>

If this element is used as a part of a SQL Query in a Web Services, there is the potential for SQL Injection attacks. SQL Injection is where hackers look for elements that are not constrained and thus can take advantage of the un-restricted size to insert additional sql. A simple mechanism to reduce this is to restrict the element via simpleType.

<xsd:element name="SSN" type="SSNType"/>

<simpleType name="SSNType">
<restriction base="string">
<minLength value="9"/>>
<maxLength value="11"/>
</restriction>
</simpleType>

This then reduces the overall buffer available for the hacker between 9 and 11 characters.