A new world for integration: SAML and Identity

SAML was initially a standard for cross-domain SSO. A user who is logged on to the domain *.i8c.be could transparently point his browser to a web application in another domain *.cronos.be without having to authenticate again. His identity (and other attributes) are passed on transparently, behind the scenes. Many mechanisms were defined to exchange the information contained in SAML token (signed XML structures) between an Identity Provider and a Relying Party, including SOAP very early on (the SAML SOAP Binding).

But SAML was taken further. WS-Security SAML Token Profile allows the use of SAML tokens in SOAP messages secured with WS-Security. And WS-Trust and its Secure Token Service standardized the mechanism to obtain or exchange SAML (or other) tokens.

The STS is a standard (web) service to obtain such a SAML token: 1) through standard authentication mechanisms or 2) by exchanging one token for another (SAML to SAML, non-SAML to SAML or SAML to non-SAML).

But transferring SAML tokens between domains means the exchange of information between heterogeneous organizations. The SAML standard does not define how attributes within the SAML tokens should be named nor what their content should exactly look like. Every organziation is free to specify how information is structured in a SAML token:

• what information or attributes is contained in the SAML token: name, cost center, department, ...
  
• how the atrributes should are named, e.g. LastName or lname?
• how the information in the attributes is represented

Imagine a vendors of office materials (Staples) that wants to offer a SSO experience to the employees of its majore customers. If every customer (large enterprises themselves) use a different SAML token structure, the office material vendor will have a great time translating the information from these different SAML tokens to its own attributes. And what if information is missing in the SAML token, e.g. what is the maximum value that employee may purchase?

Another integration challenge!

Note: Microsoft prefers the use of the term claim

Scary: backdoor in FTP server software

While reading security.nl, I picked up the news that hackers had put a backdoor in the popular FTP server ProFTPD. A version of the software containing a backdoor was put on the distribution server by some hackers.

How often does one install software from the Internet without any verification. Yes, there are the fingerprints, but who checks them? Even more scary if you were the one installing that software on a customers's server.

And if some hacker ever finds its way into the Windows Update software distribution mechanism, the world will come to a halt (don't smile you Apple users).

Java on Microsoft Azure

Triggered by my colleague Koen Van Oost and the upcoming Microsoft session at Devoxx, I looked into Java on the Microsoft Azure platform. Watched the talk "Open in the cloud: Windows Azure and Java" of PDC10. I wasn't aware that one could run Tomcat on Azure! Well, seems to be the case already since 2009. But the Eclipse tooling and JDBC connection to the SQL Azure Database are brand new. During the talk, it was also shown how the Fujitsu Interstage application server can run on Azure. Having WebLogic or WebSphere Application Server running on Azure would be very big news! For now, let's see how the ESB and integration capabilities of Azure are usable from Java.

Devoxx 2010

Next week is Devoxx! Three talks and three speakers that I can really recommend:

• Designing Java Systems to Operate at a Cloud Scale by George Reese
  

• Does dev/ops matter for me? by Michael Coté and John Willis

• Pragmatic Cloud Computing, or, Dealing with Morlocks, or, Agile Infrastructure by Michael Coté

In particular as I invited the speakers myself for these talks! Just too bad that I can't be there myself, damned.

But many more interesting things: Activiti in Action by Tom Baeyens, Scalable Java Applications on Azure by Microsoft, Comparing JVM Web Frameworks by Matt Raible, Encryption Bootcamp on the JVM, loads of NoSQL stuff, and so many more great talks.

Looking forward to meet you next week @ Devoxx on Monday, Tuesday or Wednesday.

Dell acquires Boomi

Boomi is a very interesting Integration-As-A-Service player. Integration in the cloud is a new trend that looks very promising. But what is not yet clear is the reason why Dell acquired Boomi. A big cloud player such as Google or Amazon or a big software players such as Microsoft, IBM or SAP have probably more chances. Curious to see what direction Dell will take with Boomi.

XML schema's for verticals

With XML as the alphabet, many languages are defined through XML schema's. But typical is the way each vertical defines its own language. Latest example that I was pointed at: XML schema's for the oil industry at energistics.org.

But there are very little initiatives to define a common foundation, to define the words (nouncs, verbs) from which each vertical could define variations or specific XML languages. Many XML languages lead to many translations or transformations. Fine for us the integration experts, but overall not very efficient. ebXML Core Components gave the structure to define re-usable XML building blocks that could be used in different contexts and adapted based on region, industry, business process etc. But ebXML CC is used in some of the verticals, but not one a broad scale as is the case with good old EDIFACT.

And as the XML standards in the oil industry proof, the trend of the last 10 years continues, many domain specific XML languages, specific for each vertical.

Cloud Computing Economies of Scale

Great recorded talk about the hardware and data centre side of cloud computing. This great presentation explains why it (also) makes sense to leverage cloud computing simply to have cost efficient hardware. Got pointed to it while listening to the Cloud Computing Show #31.

Also interesting (via the same podcast): CloudHarmony. The blog in particular contains different benchmark results (memory, IO, network) of a large number of Infrastructure-As-A-Service providers.