Vlad Grinman Jacalyn Reisz Boston University University Information Systems

1. Boston University XML Gateway:Integration with External Vended Products and Local Web Applications/Legacy Systems Vlad Grinman Jacalyn Reisz Boston University University Information Systems

2. What We Will Cover • What were the events Leading Up to the Development of the Toolkit • What is the XML Gateway • How Does It Work • How BU Manages Integration Efforts using the XML Gateway Toolkit • Next Steps Boston University

3. Apple Pie and Motherhood at BU • Single sign-on for services in use at BU • Reuse of existing application code • Real time access to data and service • Reduction of the exposure of warehousing data on alien systems Boston University

4. Buy vs. Build • Central IT traditionally built all systems to deliver data and service • Vended packages are now bought everyday • More systems are developed locally in offices to enhance main system delivery of data and service • Integration becomes the challenge Boston University

5. Vendor Speak • “So you don’t want your students setting up yet another id and password, send us your login names and passwords.” • “Send us an image of your student data, your HR data and your chart of accounts.” • “We’ll take good care of them!” Boston University

6. Sample Scenario • Vendor requires proprietary authentication • Vendor requires data dump • Student uses same username and password • Vendor site compromised, username/password and identifying details exposed • University data is compromised Boston University

7. Custom Integration? • Hard Coding leads to increased maintenance • Voided Warrantees • Upgrades have added costs • Each solution works differently • This is very expensive Boston University

8. Back to the Abstract The XML-Gateway was developed as a Toolkit for integrating Boston University's Authentication Service with vended products and user systems. Additionally, it can provide data to these requestors in a secure, dynamic, and controlled process, thus eliminating the proliferation of accounts at vendors' sites and in the university departments. The required data is exchanged real-time, thereby eliminating warehousing and data synchronization issues. Boston University

9. How We Evolved • Technical Proof of Concept • Real Implementation • Several More Hand-Held Implementations • Product Packaging • Integration Procedures • Staged and Managed New Efforts Boston University

10. Soooo…….This is the “Rest of the Story” • Part II - The Product Technical Detail • Part III - How We do Product Management • Part IV – Where we are going Boston University

11. Simple Scenario • BU Procurement Office signs contract with large Vendor to use their web based software to buy chemicals for our bio labs. • To complete any order Vendor must know: • Is the buyer authorized for this purchase • Which account to charge • What is the shipping address • BU wants Vendor to obtain all this information real time and use standard BU authentication for all transactions. Boston University

12. Communication with Vendors • Vendors’ applications communicate with BU sending and receiving XML documents tunneled through HTTP/HTTPS protocol • BU “WebLink” service • Unique URL shortcut for each Vendor for filtering Vendor’s requests • “WebLink” application Boston University

13. Request/Response Simple Diagram BU Web server Client’s Browser Vendor’s Web Server HTTP HTTP(XML) WebLink Service JDBC, HTTP, AJP, CUSSP, ETC… HTTP(HTML) HTTP(XML) HTTPS HTTPS(HTML) BU Services BU WebLogin Service BU Kerberos Service Boston University

14. Sessions Diagram BU Web server Client’s Browser Vendor’s Web Server Vendor’s Client Session Vendor’s BU Session Client’s WebLogin Session BU Services BU WebLogin Service BU Kerberos Service Boston University

15. XML Request Document • Session Key • Input Parameters • Synchronization Parameters Boston University

16. XML Request Sample <?xml version='1.0' encoding='UTF-8'?> <bu_uis_request session="" version="2.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.bu.edu/uis/XmlGateway" xsi:schemaLocation="http://www.bu.edu/uis/XmlGateway http://www.bu.edu/link/system/schemas/Request.xsd"> <parameters> <param name=“productCode" value=“12345"/> <param name=“productCategory" value=“Chlorine"/> </parameters> <sync_parameters url="http://vendor.com/PurchaseServlet "> <param name=“buAuth" value="Yes"/> </sync_parameters> </bu_uis_request> Boston University

17. XML Response Document • Session Key • Response Type (DATA, LOGIN, ERROR) • Alias, Id, Name, Email, Output Parameters (DATA) • HTML, Url (LOGIN) • HTML, Message (ERROR) Boston University

18. XML Response Sample (DATA) <?xml version="1.0" encoding="UTF-8"?> <bu_uis_output version="2.0" session="4a90eb3" xsi:type="DATA" alias="jsmith" id="U123" name="John Smith" email="jsmith@bu.edu" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.bu.edu/uis/XmlGateway" xsi:schemaLocation="http://www.bu.edu/uis/XmlGateway http://www.bu.edu/link/system/schemas/Response.xsd"> <parameters> <param name=“account" value=“02348766754"/> <param name=“address" value="755 Commonwealth Avenue 3-d floor Suite 332"/> </parameters> </bu_uis_output> Boston University

19. XML Response Sample (LOGIN) <bu_uis_output version="2.0" session="216b53" xsi:type="LOGIN" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.bu.edu/uis/XmlGateway" <?xml version="1.0" encoding="UTF-8"?> xsi:schemaLocation="http://www.bu.edu/uis/XmlGateway http://www.bu.edu/link/system/schemas/Response.xsd"> <html url="http://www.bu.edu/link/bin/uiscgi_demo_uiscgi_xml_devl.pl/PreLogin?session=216b53&amp;AuthServCd=it_kerb&amp;LoginPromptInd=ON&amp;SidPromptInd=&amp;reason=Initial%2520request%2520for%2520authentication&amp;app=Demo&amp;contact=%253Ca%2520href%253D%2522mailto%253ATheLink%2540bu.edu%2522%253ETheLink%253C%252Fa%253E"> <![CDATA[ <html> <head> <title>PreLogin Re-direction Page</title> <script language="JavaScript"> window.document.location = "http://www.bu.edu/link/bin/uiscgi_demo_uiscgi_xml_devl.pl/PreLogin?session=216b53&AuthServCd=it_kerb&LoginPromptInd=ON&SidPromptInd=&reason=Initial%2520request%2520for%2520authentication&app=Demo&contact=%253Ca%2520href%253D%2522mailto%253ATheLink%2540bu.edu%2522%253ETheLink%253C%252Fa%253E" </script> </head> Boston University

20. Security • Filtering • Scope (available functions) • IP • Authentication/Authorization • SecurId • PreLogin and PostLogin Services • SSL Boston University

21. Toolkit • Client-side libraries • Live Demo Web-site • Source code for all Demo Scenarios • Specification • Diagrams • Schemas • Java Docs • Developers Web-site Boston University

22. Client-side libraries • Generate XML Request Document • Send/Receive HTTP(S) message • Parse XML Response Document • Currently supported languages • Java • Perl • VBScript • PHP Boston University

23. Live Demo Web-sitehttp://uis-eta.bu.edu/demo/xml_gateway • Scenario 1 Get public data from BU: no authentication is required, but access is restricted by IP. • Scenario 2 Get BU authenticationinformation: alias, id, name, email. • Scenario 3 Get protected data from BU (including authentication information). Boston University

24. package edu.bu.uis.XmlGateway.connector_demo; import java.net.URL; import javax.servlet.http.*; import java.io.*; import edu.bu.uis.XmlGateway.connector.*; public class Scenario_3_Servlet extends HttpServlet { public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException { response.setContentType("text/html"); PrintWriter out = response.getWriter(); String modulename = request.getParameter("ModuleName"); String session = ""; Cookie[] cookies = request.getCookies(); for (int ii=0; ii < cookies.length; ++ii) { if (cookies[ii].getName().equals(SERVLET_COOKIE_NAME)) { session = cookies[ii].getValue(); } } ServletVendorRequest svr = new JservServletVendorRequest(); BuResponse br = null; try { svr.setSession(session); svr.setUrl(new URL("http://www.bu.edu/link/bin/uiscgi_demo_uiscgi_xml_devl.pl")); svr.addParameter("ModuleName", modulename); svr.setSyncUrl(request); br = svr.getResponse(); } catch (Exception e) { out.println("System Error: " + e.toString()); } Source Code for Scenario 3 (Java). Boston University

25. Cookie cookie = new Cookie(SERVLET_COOKIE_NAME, br.getSession()); cookie.setPath("/"); cookie.setDomain(".bu.edu"); response.addCookie(cookie); if (br.getType().equals("ERROR")) { out.print(br.getHtml()); } else if (br.getType().equals("LOGIN")) { out.print(br.getHtml()); } else if (br.getType().equals("DATA")) { String emailAddress = br.getParameter("EmailAddress"); String uid = br.getId(); String studentSalutation = br.getParameter("StudentSalutation"); String studentSalutation = br.getParameter("StudentSalutation"); …………………… String normalHtml = "<html>\n" + " <head>\n" + ………………………. " </body>\n" + "</html>\n“; out.print(normalHtml); } else { out.println("XmlGateway Error: Unsupported data type" + br.getType()); } } // endof doGet() private final String SERVLET_COOKIE_NAME = "bu_session"; } Boston University

26. Developers Web-sitehttp://uis-eta.bu.edu/xmlgateway • Demo • Specification • Schemas • Diagrams • JavaDocs • Sources (protected) • Projects (protected) Boston University

27. Getting the right tools………. to the right people……………. at the right time. It Takes More Than Technology to Solve This One! Boston University

28. Understanding the XML Gateway • Reviewing the spec • Visiting the Demo site • Playing with the sample code Boston University

29. How do you want to use the XML Gateway? • Choose a scenario • Identify your development language • Complete the contract • Data exchange? • Authentication? • Input/Output Parms? • …….. Boston University

30. Security Issues • Access Control • Custom vs. Common • IP Locking • Authentication • Who • What • Authorization Boston University

31. IKON E-Alumni WBUR Pinnacle Maximus BNW FSAtlas COD SBI (Degree Audit) EOS Thin Client Enviromental Health and Safety Engineering - ECE Med Campus IT Sargent College Alumni Directory Modern Foreign Language School of Dental Medicine The Box Score Boston University

32. Realized Gains • Reduction of stale or inaccurate data • Increased knowledge of who has data and where • Increased review of/advice about securing locally held data Boston University

33. Next Steps: SOAP? • Pros: • Standard message format instead of proprietary XML • Standard, rich, and self explanatory interface: WSDL • Standard SOAP client library instead of proprietary libraries • Standard error handling • No language limitations: almost any language supports SOAP now Boston University

34. Next Steps: SOAP? • Cons: • Increased code on the Vendor side • Higher qualification for Vendor programmers • SOAP server production environment at BU not fully implemented yet Boston University

35. Next Steps: SOAP? • Balanced solution: • Re-write client libraries to format request and response XML documents as a SOAP messages • Replace client libraries for existing XML Gateway users • Continue to offer new client libraries for Vendors not familiar with SOAP Boston University