Web Services Standards; One More Time

An amazing amount of standards activity continues.  Some would claim that this is all about vendors attempting to use their political power in the standards community to enhance their market share and revenue growth.  Or, that vendors use standards activities as a way to cultivate relationships with favored vendors. 

Others claim that this rush to standards is required because customers are waiting to implement systems (or to move from pilots and small scale experiments to large scale production systems) for broadly accepted standards.  Vendors who are having difficulty with software sales in a tough economic market are eager to do anything that might encourage customers to make decisions.

Liberty Alliance Surfaces

Partly in answer to Microsoft’s Passport authentication and authorization schema, Sun and a group of more than 60 technology and consumer organizations formed Liberty Alliance to develop and deploy open, federated network identification specifications. Founding members of the Alliance are:  American Express, AOL Time Warner, Bell Canada, Citigroup, France Telecom, General Motors, Hewlett-Packard Company, MasterCard International, Nokia, NTT DoCoMo, Openwave Systems, RSA Security, Sony Corporation, Sun Microsystems, United Airlines and Vodafone.

The Liberty Alliance has now announced version 1.0 of its specifications for an identification infrastructure that can link both similar and disparate systems.  Users of systems implementing with the Liberty specification could go from website to website without the need to re-authenticate.  Users could choose which accounts or services to link and could log out from all linked services with a single log-off.

Customer information is not shared between Liberty users (except with the customer’s permission).

The Liberty Alliance specifications leverage industry-standard security and data transfer protocols, including the Security Assertion Markup Language (SAML), developed by the Organization for the Advancement of Structured Information Standards (OASIS). SAML is quickly becoming the de-facto means for exchanging user credentials between trusted environments.

A number of vendors, including Sun, are offering demonstrations of products they will be shipping under the Liberty specification.

The Liberty Alliance's specifications are open, publicly available technical specifications with relevant guidelines for implementation. Any commercial or non-commercial organization can download the specifications free of charge via the Liberty Alliance website at www.projectliberty.org. 

The Status Of ebXML

Last week we wrote about Sun, standards, and ebXML and commented that we weren’t sure of where IBM stood (Sun was afraid they were losing interest), but we were checking into it.  Dr. Bob Sutor, IBM’s representative to the Web Services standards community, was involved in the efforts to find a web-based solution to EDI using XML.  A multi-organization effort, including the UN, started in September, 1999, with lots of resistance (not surprisingly) from the established EDI community.  Commerce One, IBM, and Sun and a number of XML companies led the effort, with a focus on supporting global commerce.

The work was split into two groups –

1. Infrastructure (a messaging specification for EDI, a Registry, and support for Partner Collaboration).  This became ebXML.
    

2. Modeling Business Processes – this became UBL, an ongoing OASIS project.  Sutor called this “a laudable goal.”

The entire ebXML conversation precedes Web Services and Sutor believes a lot of the Web Services modules will replace functions in ebXML.  (e.g., SOAP headers replace some ebXML information and there’s no need for a separate ebXML registry.)

While IBM is no longer involved in some ebXML activities such as the ebXML registry group, it still monitors the messaging group and still works with the Collaborative Partner Trading Group.

IBM believes that many of the outstanding issues will be resolved as Web Services evolves.  For example, ebXML needs security and the WS-Security specification just started through the standards process with endorsement by both IBM and Sun could be useful here. 

Sutor stated that “Within 6-9 months there will be nothing you couldn’t do with the WS stack that you could do with ebXML infrastructure and you will be able to do a whole lot more.”  He clearly believes that what was done in ebXML was the first generation of moving the EDI world to XML and the Internet.  It’s not the end-game.  There is a tremendous number of good ideas that came from this work.  Sutor also thinks that, in the long run, there may be a positive psychological effect on the EDI industry in starting to use new technologies like XML to produce new solutions.  Also, ebXML had many user groups involved.   They may be distrustful of vendors and may see Web Services as vendor-led; in that case, a standards-based convergence of ebXML into Web Services standards might be useful.

Then we tried one more conversation with Sun (sometimes we get the feeling that this is a never-ending circle!)  If Sun was concerned that IBM was losing its commitment to ebXML (and they are to some extent), we were wondering if Sun’s new interest in WSCI meant that Sun had a conflict of interest with ebXML.  That is, we sensed overlaps.

Sun’s Karssten Riemer says WSCI and ebXML are for separate things and don’t compete:

	WSCI focuses on defining the interface component of one service behind a firewall where WSDL isn’t enough (that is, it doesn’t provide enough information.
	ebXML focuses on data interchange in a B2B environment.  It focuses on the collaboration between the parties and on the commerce aspects of the transaction.

Riemer says ebXML is peer-to-peer, while Web Services is more client/server (I’ve never thought about that before – perhaps one of our more architecturally-minded readers will choose to comment?)

Just to stir up things a bit I couldn’t resist asking Sun if they thought WSCI competed with the WS-I (which, you will recall, Sun is not a part of).  Sun said, no they’re different.  WSCI is a specification for a standard; WS-I is guidance for implementing standards.  Perhaps, Riemer said,  WS-I may need to look at WSCI and decide whether they should create a profile for it.

(back to top)