arul @ flux

Security in remote engines and agents

arul — Thu, 14 Aug 2008 16:03:45 GMT

Message level security focuses on securing the end to end communication within a single security context. It could be implemented using a combination of techniques such as message integrity, security tokens to verify messages, and message confidentiality.

Using this approach guarantees users that the communication between the client applications and the Flux engine and agent are secured and messages can never be tampered during transmission. This also ensures only a Flux client can handshake with the Flux engine or agent.

Flux implements message level security in 8.0 release for all communication between the remote engine and clients, including agents. In traditional Flux application level security, the operations on an engine is typically secured using JAAS modules (login/logout needs to be performed on every invocation on the engine), supported in both local and remote Flux engines.

Flux uses UsernameToken profile as defined in the OASIS WS-Security specification "Username Token Profile 1.1"
for engine-agent and engine-client communications. This specification addresses how a web service consumer can supply a UsernameToken as a means of identifying the requestor by "username", and using a password to authenticate that identity to the web service producer.

With this enhancement, agents can now securely communicate with remote engines and engines can securely communicate with agents. Flux clients communicating with the remote engines will be secured too. This opens up multiple options for users needing to secure remote engines either using application level security or message level security or both.

In essence, message-level security prevents clients from accessing remote engine or agent operations anonymously without providing a valid UsernameToken.

REST Action in Flux 8.0

arul — Thu, 19 Jun 2008 21:34:36 GMT

REST is an architectural style in which software components are modeled as resources accessed over the web which are identified by unique URIs. These resources are traditionally accessed using HTTP. For example, the typical CRUD operations involve read (HTTP GET), create (HTTP POST), update (HTTP PUT), delete (HTTP DELETE). All these operations can be modeled using REST interface. There are some popular web search APIs which are modeled as REST interfaces. One such example is Yahoo Search API (http://developer.yahoo.com/search/rest.html).

Flux 8.0 will ship with a built-in REST Action. The REST Action will allow you to invoke REST services from flow charts and use the result, or response, from the REST service throughout subsequence actions in the flow chart.

The REST service URL is followed by the actual query parameters, which take the form argument=value. Multiple parameters are separated by an ampersand (&). Here is how the REST Action can be used with in a flow chart in Flux 8.0.

Engine engine = new Engine();

FlowChart job = new FlowChart("REST Action Example");

// Create the Rest Action
RestAction restAction = job.makeRestAction("REST GET Action");

// Specify the URL the rest action is to use.
restAction.setUrl("http://search.yahooapis.com/WebSearchService/V1/webSearch");

// Specify the action type.
restAction.setActionType("get");

// Specify the arguments to pass to the method.
Properties inputParams = new Properties();
inputParams.put("appid", "YahooDemo");
inputParams.put("query", "rest");
inputParams.put("results", "2");

restAction.setInputParams(inputParams);

// Create a Console Action to display the result from the Web service
ConsoleAction consoleAction = job.makeConsoleAction("Display REST Action Result");

// Variable susbtitution is used to access the RESULT flow context variable
consoleAction.setMessage("The result from the REST service is: ${result}\n");

// Make the REST Action flow into the Console Action
restAction.addFlow(consoleAction);

// Schedule the job for immediate execution.
String jobId = engine.put(job);

// Start the engine.
engine.start();

// Give the engine a chance to run the job, up to 5 seconds.
engine.join(jobId, "+5s");

// Clean up the resources.
engine.dispose();

This program invokes the Yahoo Search API and the response is printed to the console.

If you have requirements to integrate a Flux application with a RESTful service, REST Action comes handy in providing this simple integration.

Flux 8.0 remoting made simpler

arul — Tue, 06 May 2008 23:22:02 GMT

Flux remoting has always been a performance challenge due to the inherent nature of RMI technology. Accessing a flux engine across the firewall requires network ports to be opened and monitored. There are many pain points using RMI as it is generally resource intensive due to network object serialization. Furthermore, the RMI registry can be difficult to administer at times. Scalability and performance of RMI servers across networks has been a concern in a high-performance distributed computing.

We are capitalizing on the Web and its continued success in various forms. Providing HTTP transport for accessing remote engines across firewalls is a compelling solution for us. This approach provides more freedom to developers as well as network admins.

Beginning with the forthcoming Flux 8.0, we have replaced Flux's use of RMI by an HTTP transport. Developers are no longer required to code against remote exceptions. Flux engine methods previously threw flux.EngineException and java.rmi.RemoteException in their method signatures. Now these same methods just throw flux.EngineException. That's one less exception to handle.

By updating Flux remoting from RMI to an HTTP transport, Flux code is easier to write, understand, and maintain. Furthermore, network administration is simplified.