Documente Academic
Documente Profesional
Documente Cultură
and REST
●
Carol McDonald
–JavaArchitect
●Sun Microsystems
1
About the Speaker
• Carol cDonald:
> Java Architect at Sun Microsystems
> Before Sun, worked on software development of:
> Application to manage car Loans for Toyota (>10 million loans)
> Pharmaceutical Intranet apps (Roche Switzerland)
> Telecom Network Mgmt (Digital France)
> X.400 Email Server (IBM Germany)
Agenda
• Metro
> JAX-WS
> WSIT
• REST:
> JAX-RS
Project Metro
• Project Metro = Java.net project for GlassFish Web
Services stack
> http://metro.dev.java.net
> Can also be used outside of Glassfish
• key components of Metro:
> JAX-WS and WSIT
http://metro.dev.java.net
http://glassfish.dev.java.net
JAX-WS
• In addition to Glassfish,
• JAX_WS can be used as WS stack with JBoss,
WebLogic Server 10, Apache Tomcat, Jetty, and
Java SE, TmaxSoft JEUS 6, Spring
Sun’s Web Services Stack
Metro: JAX-WS , WSIT
Metadata
Reliable- Transactions WSDL
WSIT Security
Messaging Policy
JAXB = Java Architecture for XML Binding | JAX-WS = Java APIs for XML Web Services
Agenda
• Metro
> JAX-WS
> WSIT
• REST
JAX-WS
• easy to use Java API for XML Web Services
> Replaces JAX-RPC
• Just Add @ annotation to Plain Old Java Object
(POJO)
> XML Descriptor-free programming
• Layered Architecture
• SOAP 1.2 (document/literal)
• Uses JAXB for data binding
• Part of Java SE 6 and Java EE 5 platforms
JAX-WS Standards
• JSR 224 Expert Group:
> ATG BEA Capgemini Developmentor IBM
Intalio IONA Motorola Nokia Novell NTT
Oracle Pramati Red Hat SAP SeeBeyond
Sonic Software Sun Tmax Trifork
WebMethods
Developing a Web Service
Starting with a Java class
You develop
@WebService
POJO Implementation class
Servlet-based or Stateless Session EJB
Optional handler classes
return theAccount.getBalance();
}
}
Server Side CalculatorWS
Web Service
2
Soap 3 4 Soap @Web
request binding 7 Service
Endpoint 5
Jax-WS
Listener 8
Dispatcher 6 and
Handler JAXB
chain binding
publish
WSDL
1
JAX-WS uses JAXB for data binding
follows
Runtime: Java
unmarshal Objects
XML
Document
marshal
Generates
@WebService
Dynamic Proxy
} <service name="CalculatorWSService">
<port name="CalculatorWSPort"
binding="tns:CalculatorWSPortBinding">
<soap:address location=
"http://CalculatorWSService" /> Proxy
</port> Class
</service>
WSDL to Dynamic Proxy mapping
Factory Class
Proxy Class CalculatorWSService
Service
CalculatorWSPort
1..n
Port
CalculatorWS 1 Business Interface
1
●
Class
PortType Binding
1..n
Operation 1..n
Add Parameters
Method
Message
Example: Java EE Servlet Client
No Java Naming and Directory Interface™ API !
@WebServiceRef(wsdlLocation = "http://.../CalculatorWSService?wsdl")
private CalculatorWSService service;
Factory Class
protected void processRequest(HttpServletRequest req,
Business HttpServletResponse resp){
Interface CalculatorWS proxy = service.getCalculatorWSPort();
int i = 3; j = 4;
int result = proxy.add(i, j); Get Proxy Class
. . .
}
}
demo
Client Side
wsimport: CalculatorWS
wsdl to java
1 Web Service
WSDL
CalculatorWSService
Endpoint URL
extends
javax.xml.ws.Service
getPort 2 4
Soap request
parameters
3 Dynamic Proxy
JAXB Service 5
Invocation
Endpoint Soap response
Handler
return value 6
Interface
JAXB
SOAP Request
http://localhost:8080/CalculatorWSApplication/CalculatorWSService
Application Code
Calls Into
Strongly-Typed Layer:
@ Annotated Classes
Implemented on Top of
Messaging Layer:
Dispatch/Provider
Lower Level
• Lower layer, API-based, more control:
• Client XML API: Dispatch Interface
> one-way and asynch calls available
• Server XML API: Provider Interface:
> Can use JAXB, JAXP, SAAJ to get message
contents
• Message or Payload access
• May be used to create RESTful clients/services
Client-side Messaging API:
Dispatch Interfaceone-way and asynch calls available:
// T is the type of the message
public interface Dispatch<T> {
// synchronous request-response
T invoke(T msg);
// one-way
void invokeOneWay(T msg);
}
Client-side Example:
Dispatch Using PAYLOAD
import javax.xml.transform.Source;
import javax.xml.ws.Dispatch;
}
Server-side Messaging API: Provider
// T is the type of the message
public interface Provider<T> {
Metadata
Reliable- Transactions WSDL
WSIT Security
Messaging Policy
JAXB = Java Architecture for XML Binding | JAX-WS = Java APIs for XML Web Services
Project Tango Features
WSIT (Web Services Interoperability Technology)
Client Endpoint
Application Message
RMSource RMDestination
buffer buffer
Ack Protocol Message
End-to-End Reliability
WS-ReliableMessaging
• Brings reliability to SOAP (protocol) layer
• Transparent to application
• Delivery assurance
> At least once
> At most once
> In order
Configuration with NetBeans
Reliable Transport Alternatives
• SOAP messages are transport agnostic
> Change the transport, change the binding
• Metro Transports (Htttp standard):
> JMS
> SMTP
> SOAP over TCP
> For more information
> https://jax-ws.dev.java.net/transport.html
Metro WSIT
Transactions
Java™ Transaction Service
EJB Resource
Transactional
operation
UserTransactionTransactionManager XAResource
interface Interface interface
Transaction
Transaction Service
context
WSIT Transaction coordination
• WS-AtomicTransaction defines set of transaction
coordination protocols
> Supports two phase commit for web service
operations:
>all operations invoked within an atomic transaction
succeed or are all rolled back.
• WS-Coordination protocols coordinate the actions of
distributed web services
> For Commit: Coordinator asks if each system is ready
to complete
>If all concur, coordinator tells systems to complete
>Otherwise, coordinator tells systems to rollback
WSIT and WCF
Co-ordinated transaction
Java
1: TxnBegin
Client
3: TxnCommit
2a: Invoke
Java MS
Web Svc Web Svc
@TransactionAttribute(REQUIRED)
void wireFunds(...) throws ... {
websrvc1.withdrawFromBankX(...);
websrvc2.depositIntoBankY(...);
}
}
Metro WSIT
Security
Digital Certificate
Identity data signed by a Certification Authority. Provides a Trusted
source of identification.
Digital ID
• Electronic Proof of Identity
X.509 Certificate • Issued and signed by
Version # Certifying Authority
Serial #
Signature Algorithm
• Public, Private keys
Issuer Name • Makes security protocols
Validity Period work
z ed
ori
Subject Name
uth •SSL
A Subject Public Key
CA
Issuer Unique ID
Digital Signature
Subject Unique ID
Extensions
Encryption
Asymmetric keys
e r l Public ted
Re
nd
Private
g i na
cry
p
ina
l ce
Se
i t t
Or m en En m en Or
ig
en
t iv
Do
cu
Do
cu
Doc
u m er
Encryption Decryption
Receiver Receiver
Public Private
Key Key
Private re Re
Sender L n atu
Public
ce
XM Sig XM
L iv
ta ta
er
da da
Encryption Decryption
Sender's Sender's
Private Public
Key Key
to Encrypt data
Server
• Browser and Server use Session KeyB to encrypt all data exchanged over the Internet
●
Before WS-Security
Security ●
Only SSL:
●
SSL/HTTPS
● Security at transport layer
SSL
●
Point-to-point
●
Encrypts session
●
WS-Security
● Security at SOAP (protocol) layer
Fine granularity possible
SS
XW
●
XW
SS
●
Only sign/encrypt credit card #
(e.g., XML subtree)
●
Works on non-TCP/IP transports
●
Integrity, Confidentiality, Auth
● W3C XML Signature/Encryption
WS-Security:
SOAP Message Security
• WS-Security defines:
• Encrypting and signing message parts: SOAP Envelope
msg sender)
• UserName/Password token
SOAP Envelope Body
• X.509 certificates Business Payload
• SAML
• Kerberos tickets
Security Architecture
Message Level Security (signature and
encryption) web services server
web services client
https/ssl request
data
SOAP (optional) SOAP data SOAP
decryption/
client server encryption response service
data
request
data
Security ●
Before WS-Security
●
SSL/HTTPS
● Security at transport layer
● All or nothing granularity
SSL ● Point-to-point
●
WS-Security
●
Security at SOAP message layer
S
XWS
XML Signature/Encryption
XWS
●
S
●
Only sign/encrypt part of msg
●
Works on different transports
●
Work with intermediaries
Trust
• WS-Trust framework for:
> Issue, Validate, Exchange security tokens used by WS-
Security
> Establish and broker trust relationships
Trust
• WS-Trust
> Issue
<S11:Envelope xmlns:S11="..."
xmlns:wsse="...">
<S11:Header>
<wsse:Security>
WS Client .Security Token = WS Service
AuthN+AuthZ+signatures
</wsse:Security>
</S11:Header>
<S11:Body wsu:Id="MsgBody">
.. App data
</S11:Body>
</S11:Envelope> Trust
Relation
2) token returned
Security Token
1) WS-Trust Issue() Service
Identity Store
Trust
• WS-Trust
> Exchange
Trust
• WS-Trust
> Validate
> Establish and broker trust relationships
Java .NET
client service
With Project Tango
Java EE Platform
Microsoft Trust .NET Trust Sun
Managed Authority Authority Managed
Trust
WS-Tru WS
st -T
™
.Net Wholesale Project GlassFish
Retail Quote Service
Service
QOS Security
Interop.
Project GlassFish
STS Wholesale
WCF Java Quote Service
Client Client
WS-SecureConversation
Optimized Security
Use generated
symmetric session key
WS-Policy
<wsdl…>
<policy…>
<security-policy>
…
</security-policy>
<transaction-policy>
<wsdl…> …
<policy…> </transaction-policy>
… <reliability-policy>
</policy> …
… </reliability-policy>
</wsdl> …
</policy>
…
</wsdl>
Metro:
Bootstrapping
WS-Metadata Exchange
Bootstrapping Communication <mex >
WS-MetadataExchange …
</mex>
WS-Transfer/MEX
WSDL
<wsdl…>
<policy…> ●
…
● WS-MetadataExchange supports:
● discovery of WSDL documents
</policy>
● WS-Policy settings
…
</wsdl>
Bootstrapping Communication
WS-MetadataExchange
WS-Transfer/MEX
WSDL
Creates ●
●
WS-MetadataExchange protocol supports:
●
discovery of WSDL documents
Client Proxy ● metadata exchange is handled by wsimport utility of
WSIT and is transparent to developers
Bootstrapping Communication
Proxy Generation <policy…>
<wsdl…>
<security-policy>
…
Client Proxy </security-policy>
<transaction-policy>
Security …
</transaction-policy>
<reliability-policy>
Transactions
…
</reliability-policy>
Reliable Messaging …
</policy>
…
</wsdl>
End-to-End Messaging
Proxy Service
Security Security
Transactions Transactions
Transport
WSIT (Project Tango)
Programming Model
• No runtime APIs for WSIT
• Use JAX-WS and EJB APIs
• Developer/deployer supplies config file to
enable/control Project Tango components
• Config file written by hand or produced by
Project Tango NetBeans software module
WSIT Server-Side Programming
Model
• No runtime APIs for WSIT
• Use JAX-WS and EJB APIs
• Config file written by hand or produced by
NetBeans enable/control WSIT
WSIT NetBeans
Module 109 Deployment
META-INF/wsit-*.xml
WSIT
By Hand Config File
wsit-*.xml Service Servlet
Deployment
Other IDEs WEB-INF/wsit-*.xml
WSIT Client Programming Model
109
WSIT NetBean
Service
Module MEX/ GET
WSIT Client MEX/
By Hand Config File WDSL GET
wsit-*.xml Artifacts
Other IDEs
Wsimport
Agenda
• Metro
• JAX-WS Standards
• WSIT
• REST with JAX-RS
API: JAX-RS
• Standardized in the JSR 311
> Will be included in Java EE 6
• EG members
> Alcatel-Lucent, BEA, Day Software, Fujitsu, innoQ,
Nortel, Red Hat
> Experts in Atom, AtomPub, WebDAV, HTTP, REST,
Restlet
• Group started in April 2007
REpresentational State Transfer
<?xml version="1.0"?>
<customers xmlns="…">
Representation
<customer>…</customer>
…
</customers>
CRUD to HTTP method mapping
CRUD methods 4 main HTTP methods
Verb Noun
Create POST Collection URI
Read GET Collection URI
Read GET Entry URI
Update PUT Entry URI
Delete DELETE Entry URI
Example
• Customers
● /customers/
● /customers/{id}/
:)
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String accept = request.getHeader("accept").toLowerCase();
String acceptableTypes[] = accept.split(",");
SupportedOutputFormat outputType = null;
for (String acceptableType: acceptableTypes) {
if (acceptableType.contains("*/*") || acceptableType.contains("application/*") ||
acceptableType.contains("application/xml")) {
outputType=SupportedOutputFormat.XML;
break;
} else if (acceptableType.contains("application/json")) {
outputType=SupportedOutputFormat.JSON;
break;
}
}
if (outputType==null)
response.sendError(415);
String path = request.getPathInfo();
String pathSegments[] = path.split("/");
String artist = pathSegments[1];
if (pathSegments.length < 2 && pathSegments.length > 3)
response.sendError(404);
else if (pathSegments.length == 3 && pathSegments[2].equals("recordings")) {
if (outputType == SupportedOutputFormat.XML)
writeRecordingsForArtistAsXml(response, artist);
else
writeRecordingsForArtistAsJson(response, artist);
} else {
if (outputType == SupportedOutputFormat.XML)
writeArtistAsXml(response, artist);
else
writeArtistAsJson(response, artist);
}
}
private void writeRecordingsForArtistAsXml(HttpServletResponse response, String artist) { ... }
@ProduceMime("application/xml")
@GET responds to HTTP GET
Customers get() {
// return list of artists
}
URI http://host/customers/id
@Path("{id}/")
@GET
public Customer getCustomer(@PathParam("id")
Integer id) {
// return artist
}
Customer Service Overview
98