XML Web-Services

1
XML Web-Services

• Sergey Baidachni
• MCT, MCSD, MCDBA

2
Overview

• Introduction
• How it work?
• What about Java?
• Performance
• Security
• Global Architecture

3
Introduction

• Road ?80
• Unix, Windows or
• Formats war
• XML Web Services

4
Road ?80

• Where in the wall can I make a hole?

5
Unix, Windows or

• Conveniences for the clients
• Conveniences for the administrators
• Who will think about programmers?

6
Formats War

• DVD or VHS?

7
XML Web Services

• What is this?
• URL-addressable set of functionality exposed over
  a network
• Advantage
• HTTP Stateless and text
• XML Standard format
• Any platform and language

8
How does it work?

• Overview to XML Web Services
• Simple Web Services
• SOAP a protocol or another document XML?
• WSDL a method of service application
• XSD How do I look like?
• DISCO, UDDI How am I found?
• Proxy Class

9
Overview to XML Web Services
10
Simple Web Services

• What can be even simpler?
• public class MyService System.Web.Services.WebS
  ervice
• WebMethod
• public string Hello(string Name)
• return "Hello "Name
• Testing in browser
• Create simple .NET Client

11
SOAP Is it a protocol or another documents XML?

• SOAP Universal means of communication
• lt?xml version"1.0" encoding"utf-8"?gt
• ltsoapEnvelope xmlnsxsi"http//www.w3.org/2001/X
  MLSchema-instance" xmlnsxsd"http//www.w3.org/20
  01/XMLSchema" xmlnssoap"http//schemas.xmlsoap.o
  rg/soap/envelope/"gt
• ltsoapBodygt
• ltHello xmlns"http//tempuri.org/"gt
• ltNamegtstringlt/Namegt
• lt/Hellogt
• lt/soapBodygt
• lt/soapEnvelopegt

12
SOAP Where?
13
WSDL A method of service usage

• Whats the content of the service?
• What parameters are to be transmitted?
• WSDL Elements
• types
• message
• portType
• binding
• service
• Demonstration

14
XSD What do I look like?

• Schema Definition Language description of
  complex types
• Demonstration
• ltxsdcomplexType name"MyType"gt
• ltxsdsequencegt
• ltxsdelement minOccurs"0" maxOccurs"1"
  name"Name" type"sstring" /gt
• lt/xsdsequencegt
• lt/xsdcomplexTypegt

15
DISCO, UDDI How am I found?

• Static discovery
• Dynamic discovery
• Locating disco.exe options url
• Programmatic discovery
• System.Web.Services.Discovery
• DiscoveryDocument
• DiscoveryReferenceCollection
• DiscoveryClientProtocol
• DiscoveryClientResult

16
DISCO, UDDI How am I found?

• What is UDDI?
• Benefits
• Information provided by UDDI
• Programming UDDI (Microsoft.UDDI.dll)
• Problem with UDDI
• uddi.microsoft.com

17
Proxy Class

• Proxies and WSDL
• Generating Proxies Using Wsdl.exe
• Add Web Reference
• Explicit call
• Configuring Proxies

18
What about Java?

• How to install IIS on Unix?
• Sun Java SDK, Tomcat, AXIS
• Java ? .NET impossible?
• It works for real!

19
Performance Testing

• What is Application Center Test?
• Record simple scenario
• Custom scenario
• CreateConnection
• CreateRequest
• Send
• How generate SOAP in ACT?

20
Security

• Threats definition model STRIDE
• Selection of techniques
• Selection of technologies
• Best Practices

21
STRIDE Threats modulation

• Spoofing identity
• Tampering with data
• Repudiation
• Information disclosure
• Denial of services
• Elevation of privilege

22
Best Practices

• Do not use an administrators accounting record
• Store secret data in a safe place
• Do not use lines concatenation when making
  queries

23
Global Architecture

• It is always lacking, or maybe there are problems
  of Web services?
• WS- Specifications

WS-Routing WS-Referral WS-Inspection WS-Security WS-Attachments WS-Coordination WS-Transaction WS-Policy WS-Trust WS-SecureConversation WS-SecurePolicy