Jim Farmer JA-SIG Collaborative As prepared for the Portal Symposium 4: Electronic Student Services July 19, 2002, Chicago, Illinois Implementing Web Services

JA-SIG Workshop Series Publisher’s note The Portals symposium was rescheduled from July 19, 2002 to October 28-29, 2002 at Northwestern University’s Kellogg School of Management, Chicago, Illinois. instructional media + magic, inc.

Web Services: The Business Opportunity

JA-SIG Workshop Series Web services defined “Web services are a set of standards for how systems connect to each other, and communicate information. It’s an extension of a distributed computing framework, which provides an open standard that most software vendors support.” Chandra Vekatapath Market Manager, Web Services, IBM Corporation, TheBusiness Integrator, Second Quarter 2002, pp. 5-11

JA-SIG Workshop Series Value of Web services “[Web services] provides a facility for an application or a system to collaborate with another application or systems regardless of how the applications are implemented, regardless of where they are implemented, or on which platform they are implemented.” Chandra Vekatapath Market Manager, Web Services, IBM Corporation, TheBusiness Integrator, Second Quarter 2002, pp. 5-11

JA-SIG Workshop Series Value of Web services “Web services enable systems to collaborate with each other regardless of the underlying infrastructure.” “Leverage existing infrastructure” “Easily use business processes of your partners and customers.” Chandra Vekatapath Market Manager, Web Services, IBM Corporation, TheBusiness Integrator, Second Quarter 2002, pp. 5-11

JA-SIG Workshop Series The business case Originally, the exchange of data with others. Now, integration between disparate application, disparate computer systems, disparate operating systems, disparate programming languages—the Enterprise Application Integration EAI bus. ___________________________________________ ”Getting access to stove-piped data is the primary reason for implementing Web services.” Uttam Nasrsu GIGA Information Group At the FSA CIO Update Conference Arlington, Virginia, May 8, 2002

JA-SIG Workshop Series Value of Web services technology Open standards Web service projects are taking one-fourth the time and costing one- fifth comparable projects using traditional technology. Performance is 2 to 10 times better than expected. HFC Bank - IFX credit card application using XML, SOAP and XSLT Deutsche Bank Bauspar - FixML security transaction integration using XML messages and XSL transformations Hypo Vereinsbank - Integration Based on presentations at the XSLT [Invitational] Conference Oxford, University, April 8-9, 2001

JA-SIG Workshop Series “Best of Breed” strategy “With Web services, best of breed becomes more feasible.” “Web services will make best of breed more cost effective.” Rick Bergquist, CTO of PeopleSoft as quoted by Heather Harreld and Mark Jones in “Chasing suite success,” InfoWorld, Nr. 24, June 17, 2002.

JA-SIG Workshop Series EDI and Web services compared Lower maintenance High maintenance Response to change TaggedPositionalData representation Near instantaneous Over night batch Processing cycle Network “cloud” Hub and spoke Network Topology Web ServicesEDI

Web Services: The Technology

JA-SIG Workshop Series Web services “building blocks” XML – Defining data, retrieving data (RDF, XMLQuery), style and presentation (XHTML, XSL, XSLT) SOAP – messaging mechanism WSDL – define and describe Web services for applications UDDI – service registry

JA-SIG Workshop Series Why XML and SOAP? “[XML and SOAP] will become a widely implemented ‘standard’ because they are simple.” Barry Walsh University of Indiana at the FSA CIO Update Conference Arlington, Virginia May 8, 2002

JA-SIG Workshop Series Typical SOAP implementation Access Provider Data Provider HTML over HTTP SOAP over HTTPS CollegeTarget

JA-SIG Workshop Series And now SAML Security Assertion Markup Language The set of specifications describing security assertions that are encoded in XML, profiles for attaching the assertions to various protocols and frameworks, the request/response protocol used to obtain the assertions, and bindings of this protocol to various transfer protocols (for example, SOAP and HTTP). Security Services Technical Committee, Glossary for the OASIS Security Assertion Markup Language (SAML), Draft, January 10, 2002

JA-SIG Workshop Series SAML Authentication Andy Boots, FSA CIO Technology Update,May 8, 2002

JA-SIG Workshop Series Gleason’s “Transitive Trust” SAML Assertions

JA-SIG Workshop Series Authentication and authorization Access Provider Data Provider Login & Password TLS Authentication SAML Assertion CollegeTarget ebXML Security Profile 3 Non-persistent confidentiality and non-persistent authentication

JA-SIG Workshop Series ED/FSA “Transitive Trust” Andy Boots, FSA CIO Technology Update, May 8, 2002

JA-SIG Workshop Series ED/FSA “Transitive Trust” 7 FSA Systems/ Datastores FSA SECURITY BOUNDARY Internet School or Other Official School/CREN/State Certificate Authority School or Other Official Shared Secret (Username/Password) Over SSL Student, Parent Or Borrower Personal data + PIN Over SSL Authentication Gateway (multi-protocol) Single Sign-On School or Other Official School Network/Portal Transitive Trust–Technical Vision Andy Boots, FSA CIO Technology Update, May 8, 2002 Digital Certificate SAML Assertions Certificate validation

JA-SIG Workshop Series Industry content standards IndustryStandards Financial Services Financial Reporting ebXML compliant IFX XBRL Student loans Financial aid CommonLine XML Common Record Human ResourcesHR-XML Academic RecordsPESC and California Community Colleges Library(In discussion)

JA-SIG Workshop Series Process content standards SAML XACML Security Assertions Security Access Control WSUIPresentation WSRPRemote Portlet WSFL and WfMLWork flow StandardFunction

Implementations

JA-SIG Workshop Series Web services in higher education Digital library search and retrieval (Columbia, Cornell) Transcripts (California Community Colleges, Florida, Texas, Arizona, Ohio) Student Aid (NCHELP, U.S. Department of Education) Security (Internet 2 Shibboleth) Portals (JA-SIG)

JA-SIG Workshop Series Meteor prototype (January 2001) Web Services HTML Meteor XML Student Access Provider Data Provider Student Access Provider Data Provider

JA-SIG Workshop Series Meteor Channel in the uPortal

The End Jim Farmer instructional media + magic, inc.

JA-SIG Workshop Series Web services acronyms XML – eXtensible Markup Language SOAP XMLP – “Simple Object Access Protocol,” now simply “SOAP” WSDL – Web Services Description Language UDDI – Universal Description, Discovery, and Integration

JA-SIG Workshop Series The standards DataXML ValidationSchema TransportSOAP (real-time) SMTP (batch) SecuritySAML DescriptionWSDL DirectoryUDDI TransformationXSLT Note: Message content is not defined by any of these standards.

JA-SIG Workshop Series XML “family” XHTML XLink, XPath, XPointer XForms XSL, XSLT XML Signature, XML Encryption, XML Key Management XML Query XML Schema RDF Metadata

JA-SIG Workshop Series The facets of security Confidentiality – communicated in secret Integrity – unaltered, genuine Anonymity – having a name or identity that is unknown or concealed. Non-repudiation – validity of identification of the parties and the date and time of the message, and integrity of the contents

JA-SIG Workshop Series Convergence: Authentication December 2000June 2001March 2001 SFA [NCS Proprietary] SAML [Oasis] S2ML [Netegrity] AuthML [Securant] XTASS [VeriSign] Internet 2 [Shibboleth]

JA-SIG Workshop Series SOAP template … [SAML Assertions here] … [Application XML document here] … [Status and Error messages here]

JA-SIG Workshop Series SAML Assertion AE0221 URN:dns-date: T12:34:00Z T13:34:00Z K College.edu/SIS/

JA-SIG Workshop Series Federal “Level of Assurance” Level of Assurance Identification Requirement Rudimentary Basic Medium High Test No identification requirement; address sufficient In person proofing or comparison with trusted information in a data base. Trusted agent has seen the person. Federally issued picture ID or two non-federal government ID, one shall be a photo ID. In person appearance. Information checked to ensure legitimacy. Federally issued picture ID or two non-federal government ID, one shall be a photo ID. Only used for testing interoperability. X.509 Certificate Policy for the Federal Bridge Certification Authority (FBCA) Federal Public Key Infrastructure Authority, February 11, 2002

JA-SIG Workshop Series Certificate Validation: XKMS The X-KISS specification defines a protocol for a Trust service that resolves public key information contained in XML-SIG elements. … The underlying PKI may be based upon … X.509/PKIX, SPKI or PGP. The X-KRSS specification defines a protocol for a web service that accepts registration of public key information. Both protocols are defined in terms of XML Schema Language (SOAP) v1.1 Web Services Definition Language v1.0 [WSDL]. XML Key Management Specification (XKMS 2.0), W3C Working Draft, March 18, 2002.

JA-SIG Workshop Series XKMS Key Validation Tier2 Protocol Provides Key Validation Service XML Key Management Specification (XKMS 2.0), W3C Working Draft, March 18, 2002