SOA 2.0: The Petition
Further to our
first SOA 2.0 post, it happened - enough people got in touch to convince me it was worth a couple of hours' PHP coding, and we've created a
petition to stop the SOA 2.0 madness.
Why did we bother with this? There are two reasons.
Firstly: industry does not, at this point, need more confusion around SOA. SOA has real value, but industry at large is only just coming to terms with what it means and what it can do. Inventing terms like "SOA 2.0" might help some analysts and vendors make money, but overall, in the long run it damages us all.
Secondly: an experiment. Many people have discussed the power of the Web to aggregate and demonstrate the power of individuals: so it would be good to see if, through this simple petition web page, we could pressure the protagonists into backtracking on SOA 2.0.
We want you to sign, and we want to see if we can make something happen. Having an opinion is fine, but
having an effect is much better.
So come on - join us!
Sign up! You have nothing to lose but your chains...
You can see the
list of people who've already signed first, if you want.
Getting to the heart of persistent identity management challenges
I just came across this article over at eWeek -
ID Management Challenges Persist - which cites feedback from attendees at an event sponsored by user provisioning specialist
Courion. The results of the attendee survey are slanted towards provisioning but that's not why I am highlighting it here (not least because that's no great suprise given it's a vendor-sponsored event and thus survey).
What I find far more interesting is how the article points to what really lies at the heart of the identity management challenge. For example:
While many businesses have begun reinvesting in their authentication systems by bringing on-board new identity management and roles-provisioning applications, project management leaders say they face a wide range of issues in helping those efforts succeed.
This highlights the first significant challenge: that identity management technology is still very stovepiped, addressing discrete identity management requirements through discrete applications. What is required is a platform approach to identity management, with identity management capabilities - authentication, authorisation, federation etc - delivered as shared infrastructure services.
Then there's this:
A quick poll of the roughly 150 customers gathered for the meetings, dubbed Courion Converge, found that close to 70 percent were less than 25 percent finished with their ongoing ID management initiatives.
In part a consequence of the first challenge: too many identity management initiatives are treated as independent projects, compounding the stovepipes and leading to fragmented identity deployments which do not interoperate. It's hardly surprising that attendees identified
the data aggregation necessary to bring disparate password systems
as a significant challenge, and one which will persist unless vendors and organisations approach identity management from an architectural perspective.
Also, this quote from the Chief Information Security Officer at Children's Hospital Boston
"As an IT organization, our focus is on letting our doctors and nurses do their jobs, not inhibiting their work over issues of access," Scheib said. "At what point do you want to interrupt people's ability to provide patient care in the name of complying with a business policy? There's definitely a significant challenge in weighing risks and potential benefits."
highlights a couple of other things. First, that identity management initiatives must start with a consideration of business risk. Second, that a consistent policy-based approach to the definition and enforcement of authentication, authorisation and auditing requirements is the only way to grapple with the inherent complexity of distributed, heterogeneous resources, ever-changing business policies and processes and evolving regulatory requirements. These issues are also highlighted in this extract:
Tim Callahan, manager of access control and support services at Atlanta-based SunTrust Banks, said that a full one-third of his company's 33,000 employees either leave or change jobs every year, further complicating ID management efforts. In addition to making sure that departed employees are deleted from the company's systems, the process of allowing workers to maintain appropriate access as they transfer among jobs poses yet another challenge, he said.
The article concludes with some advice from a fellow analyst:
while compliance regulations are driving the convergence of roles policy, password and account auditing, and user provisioning, those processes should be part of any company's security operations. Moving beyond simple password management to more specific user provisioning helps enterprises get closer to a practical enforcement model for compliance, said Roberta Witty, analyst with Stamford, Conn.-based Gartner.
I certainly agree that identity management needs to be considered as part of security. However, I think Ms Witty doesn't go far enough. Effective compliance needs to go way beyond user provisioning: it requires a common audit and reporting platform, delivered as a shared infrastructure service, which permeates all phases of the identity management lifecycle and is governed by policy.
Where I do find myself agreeing with her is when she says:
"Companies need to figure out how important ID management is to their business and how it plays out in the larger picture; they need to figure out how it drives their business and what it means to their future."
Absolutely. This was my starting point in
Identity management: an architectural approach for business value and which leads to many of the conclusions above.
Microsoft's acquisition of Softricity
I have been going through the backlog of Microsoft announcements from WinHec. There has been ample coverage of the beta releases of the big three: Vista, Longhorn Server and 2007 Microsoft Office System - now where's the logic in that nomenclature structure change! but I wanted to comment on
the acquistion of Softricity (not least because I had been talking to a Microsoft architect evangelist at the end of last week and had suggested to him that Softricity would be a smart acquisition).
Then I came across
Dana Gardner's analysis over at Briefings Direct. Dana's thoughts are very much in line with my own so I won't repeat them here. However, one additional thought springs to mind, prompted by a briefing about Longhorn Server yesterday and more specifically the emphasis that Microsoft is placing on Terminal Services for 'Centralized Application Access'. The company will be introducing a couple of new features with Terminal Services in Longhorn Server. The first is Terminal Services Gateway, which provides for remote access without a VPN (just as RPC over HTTP allows Outlook to connect to an Exchange Server) but it's the second, Terminal Services Remote Programs, which is interesting in the light of the Softricity acquisition. Basically, it allows direct access to a remote application which is accessed on demand without the user being aware of Terminal Services - in much the same way that Softricity does. Seems to me there may have been some wasted R&D effort and that Microsoft is going to have to help customers understand which option makes sense when.
Whilst I am on the subject of application virtualisation I may as well raise another issue/question, although this one's not related directly to the acquisition. In fact, it's something I have raised with
David Greschler (a co-founder of Softricity) in the past. Desktop applications don't exist in isolation and there are typically dependencies with server components. The question is how to ensure that the desktop change management processes - in the case of Softricity these are through integration with System Center Configuration Manager (aka Systems Management Server) - are coordinated with those of the servers on which they depend. As application virtualisation becomes more mainstream, now that Microsoft has entered the fray, potential adopters should be seeking some answers.
SOA 2.0? Stop the madness
I just came across this (unattributed) quote:
Everyone is entitled to be stupid, but some abuse the privilege.
I think it sums up pretty well how I feel about the recent emergence of the term "SOA 2.0".
I'm so angry about it I can't work out where to start! Luckily JBoss standards and development honcho
Mark Little has done a good job of nailing some of the key points from an architecture perspective, which helps (at least I know I'm not the only one thinking "WTF?").
The two main current proponents appear to be
Gartner and Oracle. So here's a question for them both: how do they feel about the attempt to build industry consensus around SOA concepts by the standards body
OASIS? The
SOA Reference Model TC is notable because it contains not only self-serving vendors, but real implementers and users. And interestingly, the TC (and many other people who are doggedly pushing through the steaming piles of hype to deliver successful SOA implementations) defines SOA along the following lines:
A paradigm for organizing and using distributed capabilities that may be under the control of different ownership domains.
A framework for matching needs and capabilities.
A view of architecture focusing on “Services” as a mechanism to allows interactions between those with needs and capabilities.
Note that this says *nothing* about the technical implementation details. This is bang on. As Mark Little says, the idea of SOA 2.0 (among many other sins) fails because it mixes up architecture with implementation detail.
I'll take it that both Gartner and Oracle's marketing department think the SOA RM TC is a complete waste of time and space. I think that tells us all about how committed they are to customer success? And I wonder what Oracle's salespeople will make of it all, when they try and convince customers (who are still getting to grips with SOA) that "SOA 2.0" makes sense?
I had a conversation at the back end of last year with a seasoned IT industry analyst from another UK firm about why analysts do the job they do. I think there are two camps. One (ours) sincerely believes that analysts should be good stewards of the influence they have - educating, clarifying, abstracting, comparing, acting independently, being measured, etc. It's about filtering out hype and trying to provide practical, independent advice and insight. The other is in this business to make money by whatever means possible. Often that means inventing, or perpetuating, ideas which have marginal value but which sound exciting (and thus tease out vendor marketing cash, and enterprise consulting cash).
If ever there was a blatant example of the product of this latter attitude to the IT industry analyst "profession" (I use that term *very* advisedly) SOA 2.0 is it.
One last point: I'm very tempted to create an online petition to "Stop the SOA 2.0 madness" - a webpage that anyone interested in preserving our collective sanity can sign. If you think this would be an interesting thing to do, add a comment here. If I get a few comments, I'll create something and we'll see if we can get some pressure building!
New podcast episode: interview with prominent enterprise architect James McGovern
Neil Macehiter hosts this slightly elongated (35'41") MWD podcast episode, in which we interview prominent enterprise architect blogger
James McGovern. The interview covers the role of open source in enterprise architecture and IT investment and the challenges associated with introducing OSS technology; thoughts on the architectural challenges associated with identity management; and a discussion on the differences between enterprise architecture practice in the US vs. in Europe.
Perhaps surprisingly, James thinks European businesses are likely to have more of the characteristic "markers" for good enterprise architecture practice than US businesses...
There's some great insights here. One not to miss. The audio is
here, as usual. You can subscribe to the podcast
here.
Hopefully we'll have the chance to talk more to James later in the year.
One caution: the recording of James' voice could be of better quality. Apologies if any of it is a little unclear. If we get to talk to him again, we'll do better next time!
Yowzah - open source management in the enterprise
It's a Monday so its time to invent a new acronym - or is it an abbreviation. Today it's YAOSA - "yet another open source application." Perhaps it won't reach the level of
TANSTAAFL and
NIMBY, but it may have legs.
The reason for the new acronym? A week or so ago, a bunch of admittedly smaller management software companies
announced their intention to form the Open Management Consortium (OMC - that'll be last week's abbreviation then, or is it an acronym?) . No doubt the initial impulse is pure - to federate and integrate, provide a common platform, etc, etc. But as
Michael Cote remarks, the bigger players (IBM, HP, BMC, CA) should be in no doubt that they are being challenged. The organisations involved each offer one piece of the framework - there is no pressure to take the whole kaboodle, apparently, but users will benefit from a common interface between the tools.
I don't know much about the politics, but from the enterprise perspective my take is that any move towards integration and/or standardisation has to be a good thing. There are several initiatives at the moment and I would see this as one of them, there are others such as the planned convergence between WSDM and WS-Management being led by the
management gorillas and Microsoft, or the
CMDB interoperability efforts of the four-plus-Fujitsu. Such initiatives may be making waves in the vendor community, but apart from a few people in end-user companies that possibly should get out more, there is little interest in the waypoints on the road to standards utopia. Quite rightly, they believe standardisation is a vendor issue, and wouldn't it be nice when its finished.
From the enterprise perspective, the main areas that integration and standardisation can help today are:
- the lowest level of the IT management technology stack - event management, configuration management, performance management of individual resources - so that management of the basics becomes the norm rather than the exception. The open source approach may help to lower the barriers to entry, in terms of both price and feasibility, bringing more assets into the sphere of integrated management
- across the IT management technology stack - standards can help in providing the glue between management capabilities. Integration is the biggest issue facing management, and (as mentioned) we wait with baited breath for vendors to settle on, and agree a single, comprehensive communications framework for all management tools.
I can see open source benefiting the former, but the latter needs to be led by a consortium of the main players: there's no point in the open source world running off and developing its own set of standards. There are too many reasons to list why the gorillas are not going to be knocked off their perches any day soon (a mixed metaphor, but it conjures and image, doesn't it?), not least because enterprise management is so mind-bogglingly complex to do, it'll take more than a bunch of wannabe companies sitting around a table to cut the gordian knot. Enterprise management vendors may have been resting on their laurels in the past but they are highly cognisant of the law of diminishing returns - the higher you go up the management stack, the harder it gets to deliver anything useful.
To date, much of the general open source debate has been about the fact that the business case for open source needs to include more than just licensing costs. I'd be very happy to see major erosion in pricing of enterprise management software but history tells us that enterprise management is about far more than this - the services piece of management implementation should not be under-estimated. If I were an enterprise customer I'd be looking to work with one of the big companies - vendors or their systems integrator partners - to help me deliver enterprise IT management, but at the same time, I'd be happy if they proposed a combination of their own products and open source products if it offered the best solution.
To conclude, I'd say to the open source guys - beware IBM, as they know how to leverage your capabilities far better than you do. Just as they have done with LAMP and WebSphere/DB2, IBM will jump on this as an on-ramp to Tivoli, and dress it up with services. HP is adopting an inclusive stance, and looks like it could turn out to be a friend to OMC, should it choose to.
Meanwhile, pure software players BMC and CA would do well to muck in and perhaps even donate a code line or two. CA's already stepped up to the plate with Splunk; let's see what they make of OMC.
"Software development is dead": can you smell something?
I think it's the smell of an overcooked prediction...
I just saw
this over at the ever-fun
ZDNet blogverse. "Software development will cease to exist"...? Riiiiiight.
I have a lot of respect for Daryl Plummer generally, and he wouldn't have got where he is today without being smart. But what's happened here? Has his brain been tampered with by an evil underground cabal of SaaS vendors?
A great friend of mine spent a long time in the 1990s working at Oracle in the Consulting group. We spoke sometimes about his work and he told me on a couple of occasions: "this stuff we're doing with Oracle CASE...it's amazing. Soon people won't need to do software development any more: we'll use CASE tools to generate code from models."
You know what? The Oracle CASE tool was pretty good: it really could go a long way towards generating workaday database applications with no coding. And where Oracle left off, companies like Forte, NatSystems, Dynasty, USoft and other (most now deceased of course) "second-generation model-based development" vendors did some amazing things. But even then, development was still involved. And then what happened? CASE and
4GL were elbowed out of the way by... Java. A retrograde step in the world of enterprise software engineering, if ever I saw one. We just get to the point where we can use advanced tools / high-level languages to enable us to quickly build and change cross-platform applications: and boom! We're back to hand-cranking
3GL code. (At least, thank heavens, Java allowed us to stop thinking about pointers.)
The idea that "development is dead" wasn't true in the days of CASE, and it still isn't true. And it will not be true for a very long time indeed. Even when, in a significant proportion of scenarios, enterprises procure SaaS solutions, there will still be other scenarios that people want to address with software development. And even in scenarios where SaaS solutions are heavily used, development will not go away. They'll need to be integrated with each other and with other things. And these days, one thing I think you *can* say pretty sweepingly is that all integration is development, and all development is integration.
Mainstream enterprise app software development is getting easier all the time, but it won't go away. I predict that with a probability of 1.
Web 2.0, "Web as place" and the value of networks
I'm normally not one of the people who finds themselves agreeing with Dion Hinchcliffe (ZDNet
blogger and CTO of
Sphere of Influence). To me a lot of his posts have a bit too much evangelism and not quite enough practicality in them. Maybe it's just me.
But I think he's really hit the nail on the head with a recent post "
A round of Web 2.0 reductionism". Basically he rounds up a number of the points of view out there on what Web 2.0 really represents, and then goes on to provide a kind of synthesis, explaining that although the elements of Web 2.0 aren't new, there has definitely been some kind of shift:
However, up until recently, most uses of the read-write Web were for publishers, online shopping, or other one-to-many and solitary, point-to-point uses. And while that may still be the case today, the trends are now telling us a dramatically different story: the read-write Web is being used in a participatory way in a widespread fashion. It was the widespread adoption of blogs, wikis, and other read-write techniques that ushered in a common I-write-and-everyone-reads-it usage pattern. This is the harnessing part that a pure conception of a read-write Web does not focus on and the public at large is just starting to understand.
This is what I call "Web as place" - the third wave of development of the Web. In the report on this that I'm writing at the moment (when time permits ;-) I've just finished drafting some text that reads:
The Web is becoming less a set of online resources, and more a sprawling marketplace where people stay – to talk, to listen, to explore, to learn, to play and to shop – for long periods of time. This is the third wave of development of the Worldwide Web – "Web as place". What is commonly referred to as "Web 2.0" is primarily a mixture of enablers for, and consequences of, this evolution of the Web.
...
What's really enabling the third wave of Web development is a critical mass of services, resources and users which are together making participation an expected feature of more and more online experiences. Of course Web-as-place has been a long time coming: bulletin boards and newsgroups have provided distinct "places" for people to meet and exchange ideas online for many years. But Amazon, eBay and others changed all that, by creating storefronts that were wrapped in community services and building large-scale, international communities of shoppers and enthusiasts with shared interests.
...
"Web as place" is notable for the way in which links are returning to their roots: as resource integration hooks which are universal in terms of what, and where, they can point to. The huge popularity of blogs, and the emergence of wikis and other "social software" have vastly increased the number of links between Web-based resources – making the Web a more coherent entity [...than it was when all the focus was on building storefronts - where links were primarily used as application navigation mechanisms.] As a result the boundaries between resources under ownership of different people are blurring rapidly.
So there you are: "Web as place". That's what's happening now. And fundamentally, all the interesting aspects of this phenomenon can be abstracted into one simple (and slightly flippant) observation:
The value of a network is in ... the network. All telecom operators know this. It's no accident that despite mobile network operators' massive investments in third-generation (3G) networks, content and services, the lion's share (by far) of data revenue that these companies see still comes from text messaging. If you can build services that take advantage of the fact that your users are networked together, your value proposition is multiplied: you aren't just originating content for others to consume; you're acting as an enabler and facilitator for others to participate in conversations.
Of course I'm not the first person to point this out. Doc Searls did a good job
here.
More to come on this as I finish the report!
Novell and identity management: from a long-tailed mouse to a masked dog
Earlier this week, Martin LaMonica at CNET
reported that Novell will be taking the covers off its latest foray into open source identity management: the
Bandit project (a somewhat surprising choice of name given the focus on security, privacy and so forth but that's by the by - there is some justification for the name provided
here).
Novell is sponsoring the project and contributing the engineering effort. Whilst it is actively seeking external input, Novell
in consultation with the Bandit community, sets the project engineering goals and retains ultimate responsibility for the project.The objectives of the project are to: enable application access to identity stores; support multiple and pluggable authentication methods and user-managed authentication credentials; provide a simple API for role-based access control; and simplify auditing and reporting for compliance based on
open standards and specifications.
To do so, Bandit has identified a number of components (described in more detail
here):
- Common Authentication Services Adapter (CASA) - for the storage of credentials and other authentication data by users and applications
- Common Identity - a framework for abstracting different identity data stores based on the Java Naming and Directory Interface (JNDI), which provides identity data mapping and transformation, caching, a policy engine and a variety of connectors for different identity data stores, including LDAP, SQL, XML
- Compliance Records Architecture - provides an API for auditing based on name/value pairs and a taxonomy for the hierarchical classification of audit records
- Role Engine Architecture - for role-based access control and management of roles, relationships, membership and dynamic separation of duties.
The objectives of the project are certainly ambitious, addressing as they do some of the more challenging, higher-level aspects of identity management such as role-based access control and compliance. Novell certainly has significant identity management expertise to contribute and it will be interesting to see how much of the intellectual property in its identity management solutions will migrate to the Bandit deliverables.
When I first heard about Bandit and began to navigate the project's site, my first thought was "there seems to be some overlap here with the
Higgins project (which Novell
joined at the end of February), particularly this Common Identity thingy". A little more digging revealed that to be the case. Although there is no integration between the two yet - well it has only been a couple of months - the Bandit team
envisages the creation of a Higgins context provider based on the Common Identity component. A context provider is the means by which the Higgins Framework plugs into different identity repositories, protocols etc to provide application developers, via the Eclipse framework, with a common API to build on different identity management solutions.
As
Eric over at Digital ID World points out this is not the first open source identity management initiative and I completely agree with him that the involvement of Novell means that it is still a significant event. I think the fact that the project is focussing on higher-level (value?) identity management issues gives it added significance. It will be particular interesting to see which other domain names
pop up in members' email addresses.
SOA Software continues its acquisition spree
SOA Software (which
until March 2005 was known as Digital Evolution)
today announced its fourth acquisition in the last 20 months. Blue Titan, which like its new parent is based in Los Angeles, is the latest and follows the earlier acquisitions of:
Flamenco Networks, whose technology is the basis of SOA Software's XML VPN product
Thought Digital, for its event-based reliable messaging technology
Merill Lynch's X4ML mainframe web services platform, which is now sold as the Service Oriented Legacy Architecture (SOLA) product.
This is a smart move by SOA Software, as part of the company's strategy to position itself as a leading pure-play service infrastructure vendor (see
here for our analysis of service infrastructure requirements and vendor assessments). Blue Titan, with its Network Director product, provides transport-independent messaging and mediation capabilities which complement SOA Software's service management, security and governance offerings (Service Manager and Registry).
This acqusition is about more than technology though. Blue Titan also brings some major blue-chip customers with significant SOA initiatives, including British American Tobacco, citigroup and Pfizer where SOA Software will undoubtedly be looking to upsell (the two companies had not worked together in joint accounts). It also brings a number of important partnerships, particularly IBM's WebSphere group (SOA Software already had relationships with Global Services and Tivoli) and SAP.
During my discussions with SOA Software's Executive VP, Roberto Medrano, and VP of Product Marketing, Ian Goldsmith, about the acquisition they explained that the company will continue to sell Network Director separately with a merged product probably at least a year away. This doesn't come as much of a surprise, given the lack of any pre-existing partnership or joint customer deployments, and the need to focus their efforts on winning business. Whilst I believe it is possible for the company to explain the benefits of its portfolio of offerings, the lack of a merged product will lead to some concerns from prospects, particularly the lack of a common management console and (as I discussed
here) a unified policy management framework.
The acquisition of Blue Titan sees SOA Software squaring up to Progress Software, which through the
acquisitions of Actional for web services management and
NEON Systems for legacy integration offers a comparable set of capabilities based around Sonic's ESB. Both companies are positioning their offerings as alternatives to the service infrastructure offerings of the infrastructure heavyweights - BEA, IBM, Microsoft and Oracle - on the basis that they help customers avoid platform lock-in.
SOA Software will undoubtedly use the transport independence of Blue Titan's Network Director to attempt to differentiate itself from Progress with a similar premise - avoidance of ESB lock-in - as the vision the company outlined in my discussions indicates:
create the leading platform-independent SOA infrastructure solutions company
With the aforementioned heavyweights investing heavily in their service infrastructure offerings, the SOA pure-plays have a tough fight on their hands - Systinet (acquired by Mercury Interactive) and Infravio, for example, have divested themselves of components of a broader service infrastructure offering to focus on their registry/repository technologies and SOA governance. With this acquisition, SOA Software has certainly strengthed its armoury.
As enterprises embark on their SOA initiatives, they would do well to include a pure-play or two on their list, if nothing else to keep the big players honest, and SOA Software has just increased its chances of inclusion.
Capgemini CTO on service infrastructure
I've referenced Steve Jones, Capgemini's snappily-titled CTO of Application Development Transformation, a couple of times in this blog. And now I'm going to do it again, because he's starting to behave rather like an analyst... and a good one at that. If he wasn't paid probably 5 times more than us at MWD, I'd ask him if he wanted a job....
Steve's started providing very quick, high-level assessments of service infrastructure offerings,
here and
here. He's started with the big software vendors (IBM, BEA, SAP, Oracle, Microsoft, Sun).
We're in the middle of a similar exercise - we've written
in-depth reports on IBM, BEA, SAP, Microsoft and webMethods. We're working on adding TIBCO, Oracle and Sun too.
But Steve is providing an interesting perspective using probably 0.1% of the words that we're using. So if you're interested in how a senior practitioner out there in the field rates the big boys when it comes to supporting SOA - check it out.
New podcast - MMS episode: on DSI and virtualisation
Jon Collins went to the Microsoft Management Summit (MMS) last week, and came back full of ideas about where Microsoft is going with its systems and service management strategy for enterprise customers. In
this podcast episode Jon and Neil Macehiter chat about Microsoft's credibility in terms of its Dynamic Systems Initiative (DSI), and also in server virtualisation. Neil Ward-Dutton gets a word in edgeways to draw some parallels between DSI and the new Service Component Architecture (SCA) industry initiative...
Get it while it's hot!
Running time: 24'03".
