Building Web Services with .NET

1. Building Web Services with .NET Nigel Watson (nigelwat@microsoft.com) Academic Developer Relations Developer and Platform Strategy Group Microsoft PTY, Melbourne

2. Agenda • Building the Programmable Web • Web Services in .NET • Furthering standards: GXA • Summary

3. .NET Vision Ski Lodge Bank Airline Ski Hire Gear

4. Building the Programmable Web So… What is a Web Service? • A remote procedure call technology based on open standards • A way to connect disparate applications on disparate platforms using open standards • A way to automate application to application integration using open standards • A way to expose application functionality using open standards OPEN STANDARDS ARE KEY TO WEB SERVICES

5. HTML HTML HTML Presentation tier BusLogic tier OS/Datatier Web applications today...

6. The Web Services protocol stack Founded on industry standard protocols SOAP used to call methods on other systems using XML over HTTP WSDL used to describe a Web Service’s interface (i.e. methods available, parameters, return values etc.) UDDI is a directory that can be used to programmatically search for a Web Service XML and HTTP SOAP Simple Object Access Protocol WSDL Web Services Description Language UDDI Universal Description, Discovery and Integration

7. Other Services Public Web Services XML XML .NET Services Smarter Clients XML XML Internal Services Standard Browsers XML HTML Presentation tier Presentation tier XML XML Servers Data, Hosts SmarterDevices BusLogic tier BusLogic tier OS/Datatier OS/Datatier Next generation web applications… Applications Become Programmable Web Services Industry Standard Protocols (HTTP, XML, SOAP, WSDL, UDDI) Richer, MoreProductive User Experience Applications LeverageGlobally-AvailableFederated Web Services

8. Standards adherence is crucial Web services will not reach their full potential without vendor interoperability… W3C • Committee overseeing the development and adoption of Internet standards WS-I • Industry initiative to promote vendor Web Services interoperability • Over 150 participants, including Microsoft, IBM, Oracle, SAP, Sun… • See www.ws-i.org for more information OASIS • Involved in WS-Security standardisation process

9. From standards to implementation • .NET provides an implementation of the Web Services technology stack. • Other vendors have similar libraries • IONA – Orbix E2A Web Services • IBM – WSTK for WebSphere (Now the ETTK) • BEA – Integrated into WebLogic 8.1 appserver • Open source/Freeware • AXIS (Apache) • Glue • Etc…

10. Agenda • Building the Programmable Web • .NET and Web Services • Furthering standards: GXA • Summary

11. .NET and Web Services • ASP.NET Architecture • Creating and consuming Web Services • Watching SOAP Messages • Adding meta-data to your Web Service

12. SOAP Requests SOAP Responses ASP.NET Web Services Architecture Client Code ASP.NET Web Service [WebMethod] Public string blah() {…} ISAPI Ext ASP.NET Worker Process Common Language Runtime Platform IIS OS O/S (W2K, XP, WS2K3)

13. ASP.NET – Server Side • To create a web service: • Create a new project in VS.NET • Add a Web Service class • Add methods to the class, decorate with [WebMethod] attribute [WebService] Public Class Foo { [WebMethod] public string Hello( string strName) { … } …}

14. ASP.NET – Client Side • To consume a web service: • Add a web reference to the web service to your project • This adds a Web Service proxy class to your project • Instantiate an instance of the proxy class and begin calling methods on it. … localhost.Foo ws = new localhost.Foo(); string result = ws.Hello(); …

15. Demo – Create and Consume a simple Web Service demo

16. Drilling into SOAP Messages • <s:Envelope xmlns:s=“http://www.w3.org/2001/09/soap-envelope”> • <s:Header> • <c:alertcontrol xmlns:c=“http://example.org/alctl”> • <c:priority>1</c:priority> • <c:expires>2001-10-25T14:00:00</c:expires> • </c:alertcontrol> • </s:Header> • <s:Body> • <m:alert xmlns:m=“http://example.org/alert”> • <m:msg>Pick up Mary at school at 2pm</m:msg> • </m:alert> • </s:Body> • </s:Envelope>

17. Demo – Use proxyTrace to watch SOAP messages demo

18. Adding meta-data to your service • You can add useful information to your Web Service’s browse page with attribute parameters: • This information also appears in the Web Service’s WSDL description [WebService(Description=“Foo Service”, NameSpace=“http…”)] Public Class Foo { [WebMethod(Description=“Hello method”)] public string Hello( string strName) { … } …}

19. Demo – Adding meta-data to your Web Service demo

20. Agenda • Building the Programmable Web • Web Services in .NET • Furthering standards: GXA • Summary

21. There are still some gaps to fill… End-to-end security including authentication, authorization, message integrity and encryption Ability to dynamically configure message routing paths for scalability and fault tolerance End-to-end guarantee of message delivery with semantics (at-least-once, at-most-once, exactly-once) Ability to transact across companies and provide compensation semantics Security Routing Reliable Messaging Transactions

22. Transactions Reliable Messaging … Directory Referral Security Inspection Routing License … Description Global XML Web Services Architecture - GXA

23. GXA Design Principles • General-purpose • Agnostic to application domain • Standards-based • Multi-vendor interoperation critical • Federated • No central point of administration, control or failure • Modular • Factored to stand alone or work together

24. Universal communications Across machine Across process Flexible communications Extensible headers Extensible body Extensible communication topology Transport protocol neutral Application category neutral Enterprise application integration Business-to-business Business-to-consumer Peer-to-peer Platform neutral Devices Desktops Clusters Datacenters General-Purpose

25. Standards-Based • We are committed to… • Publishing GXA specifications • Working with partners to refine specifications • Working with partners, customers, and standards bodies for broad adoption • WS-Security submitted to OASIS • WS-I likely to profile security and other functionality

26. Federated • Fully distributed • Builds upon DNS and IP • Strong affinity towards hierarchical URI • Crosses organization and trust domains • Can be inspected by firewalls • Can interoperate with Kerberos and PKI • Does not require centralized servers or administration

27. Modular • GXA framework layered on SOAP/WSDL extensibility hooks • GXA surfaced as composable headers for SOAP messages • GXA specifications are highly factored • Often coalesced as they evolve • GXA specifications are combined to provide end-to-end capabilities • GXA protocols augment problem domain-specific protocols (e.g., banking)

28. SOAP Message Modular: Example <?xml version="1.0" encoding="utf-8"?> <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <S:Header> <m:path xmlns:m="http://schemas.xmlsoap.org/rp"> <m:action>http://tickers-r-us.org/getQuote</m:action> <m:to>soap://tickers-r-us.org/stocks</m:to> <m:from>mailto:johnsmith@isps-r-us.com</m:from> <m:id>uuid:84b9f5d0-33fb-4a81-b02b-5b760641c1d6</m:id> </m:path> <wssec:Security xmlns:wssec="http://schemas.xmlsoap.org/ws/2002/04/secext"> <wssec:BinarySecurityToken ValueType="wssec:X509v3" EncodingType=“wssec:Base64Binary">      dWJzY3JpYmVyLVBlc…..eFw0wMTEwMTAwMD </wssec:BinarySecurityToken> </wssec:Security> </S:Header> <S:Body> <app:TrafficStatus xmlns:app="http://highwaymon.org/payloads"> <road>520W</road><speed>3MPH</speed> </app:TrafficStatus> </S:Body> </S:Envelope> Routing Security

29. WS-Security 1.0 • A specification for proposed SOAP extensions to be used when building secure Web services. • Supercedes the following specifications • SOAP-SEC • Microsoft’s WS-Security, WS-License • IBM’s security token and encryption • Dependent upon XML DIGSIG, XML Encryption, XML Schema, SOAP… • Defined schema

30. WS-Security 1.0 • Protection • Integrity = XML Signature + Security Tokens • Confidentiality = XML Encryption + Security Tokens

31. Non-Goals of WS-Security • Establishing a security context that requires multiple exchanges • Key exchange and derived keys • How trust is established • Policy Enforcement • Provisioning of certificates • XKMS

32. WS-Security 1.0 • We have some more work to do… WS-Secure Conversation WS-Federation WS-Authorization WS-Policy WS-Trust WS-Privacy WS-Security Today SOAP Refer to Security Roadmap – http://msdn.microsoft.com/webservices

33. Summary • Reviewed Web Services protocol stack • Looked at how you can leverage Web Services from .Net • Looked briefly at how web services will evolve over time

34. Further information • http://msdn.microsoft.com • http://gotdotnet.com • Developmentor mailing list • MSDN Updates (monthly) • http://msdn.microsoft.com/flash • Melbourne .NET User’s Group (http://www.mdnug.org) • Australian Developers.NETwork (http://www.ausdev.net)

35. © 2001 Microsoft Corporation. All rights reserved.