Module 7: Integrating with External Systems Contents Overview Selecting a Transport Time-Bound Operations 13 Security and Authentication 26 Lab 7: Creating and Using Web Services 44 Review 52 Information in this document is subject to change without notice The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted Complying with all applicable copyright laws is the responsibility of the user No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Microsoft Corporation If, however, your only means of access is electronic, permission to print one copy is hereby granted Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property  2001 Microsoft Corporation All rights reserved Microsoft, Active Directory, ActiveX, BizTalk Server, FoxPro, FrontPage, Hotmail, Jscript, Outlook, PowerPoint, Visio, Visual Basic, Visual C#, Visual C++, Visual Studio, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A and/or other countries Other product and company names mentioned herein may be the trademarks of their respective owners Module 7: Integrating with External Systems Instructor Notes Presentation: 60 Minutes Lab: 60 Minutes This module discusses the mechanisms that are available for an e-commerce site developer to enable electronic communication with trading partners in business-to-business (B2B) solutions It covers the available transport options, such as using the Internet, implementing Value Added Networks (VAN), and using Point-to-Point Protocol (PPP) The module then describes various transport protocols, such as Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), Distributed Component Object Model (DCOM) and Microsoft Message Queue Server (MSMQ) Extensible Markup Language Protocol (XMLP), which is the new name for Simple Object Access Protocol (SOAP), is discussed as a mechanism for making object calls over the Internet Web Services are also described in this context of B2B communication The module continues by discussing synchronous and asynchronous communication, including details on using MSMQ, COM+ events, and queued components in asynchronous B2B solutions The module concludes with an architectural overview of security for B2B solutions After completing this module, students will be able to: Describe the transport options available to B2B solutions Decide whether to perform an operation synchronously or asynchronously in B2B solutions Explain the security and authentication issues in B2B solutions and the technologies that address these issues Create and use Web Services in an e-business application Materials and Preparation This section provides the materials and preparation tasks that you need to teach this module Required Materials To teach this module, you need the following materials: Microsoft® PowerPoint® file 2260a_07.ppt Module 7, “Integrating with External Systems” Lab 7, “Creating and Using Web Services” Preparation Tasks To prepare for this module, you should: Read all of the materials for this module Complete the lab Review the information in the following Web sites: http://msdn.microsoft.com/library/periodic/period00/webplatform.htm and http://msdn.microsoft.com/xml/general/soapspec-v1.asp iii iv Module 7: Integrating with External Systems Module Strategy Use the following strategy to present this module: Selecting a Transport In the first section, discuss VANs, the PPP protocol, and the Internet as mechanisms and infrastructure that can be used for carrying out e-business It is important to stress that VANs are expensive to implement and therefore cannot be afforded by small companies, whereas the Internet-based and PPP-based solutions are less expensive and within the reach of all organizations The topics on DCOM and XMLP must be taught such that the emphasis is on the benefits of XMLP You must not be recommending that students implement DCOM for all their solutions because of the problems outlined in the topic The description of DCOM is included for the sake of completeness and must be used as a suitable comparison against which the advantages of XMLP must be explained Time-Bound Operations It is very important that you cover the requirements for synchronous and asynchronous operations thoroughly Students must be able to identify which types of operations must be implemented in a synchronous manner and which types of operations can be implemented by using an asynchronous solution After you are sure that they understand the distinction between the two types of solutions, you can then discuss the queuing details in greater depth You must fully discuss the interaction between MSMQ, queued components, and COM+ Where relevant, stress that queued components offer rapid application development (RAD) advantages over MSMQ solutions Security and Authentication Because B2B solutions are expected to integrate with external organizations, emphasize that this integration feature raises some extra security issues for applications that are for internal use and B2C solutions Your discussion of the topics in this section must be focused on B2B solutions, rather than going into any depth about specific technologies Next, discuss virtual private networks (VPNs) and the protocols used to implement them Ensure that the students understand that VPNs can use the basic backbone infrastructure of the Internet to provide what is effectively a private network similar to a local area network (LAN) Conclude this module with a discussion on how Microsoft Internet Security and Acceleration (ISA) Server 2000 enables you to implement firewalls and VPNs Lab 7: Creating and Using Web Services In the lab, students will create and use Web Services They will create a Web Service (an asmx file) and then test its functionality They will then create a Microsoft Visual Basic® proxy file that will enable them to use the service Finally, students will incorporate the service into a B2B application Module 7: Integrating with External Systems Overview Topic Objective To provide an overview of the module topics and objectives Lead-in In this module, you will learn about selecting a transport mechanism, implementing time-bound operations, and the security issues and solutions that are available for B2B e-commerce applications Selecting a Transport Time-Bound Operations Security and Authentication *****************************ILLEGAL FOR NON-TRAINER USE***************************** Business-to-business (B2B) e-commerce solutions involve electronic communication between trading partners In this module, you will learn about some of the options relating to transport mechanisms and data formats, such as Extensible Markup Language (XML) and Extensible Markup Language Protocol (XMLP) XMLP is the new name for Simple Object Access Protocol (SOAP) When interacting with external systems, it is often useful to queue or batch requests because real-time or synchronous operations may not always be possible or suitable You will learn how asynchronous operations can be used for queuing request You will also learn about the security requirements for cross-organization data exchange After completing this module, you will be able to: Describe the transport options available for B2B solutions Decide whether to perform an operation synchronously or asynchronously in B2B solutions Explain the security and authentication issues in B2B solutions and the technologies that address these issues Create and use Web Services in an e-business application Module 7: Integrating with External Systems Selecting a Transport Topic Objective To introduce the topics in this section Lead-in There are a number of transport options available to allow communication between companies participating in B2B solutions Transport Options Transport Protocols Distributed Object Calls Calling Web Services *****************************ILLEGAL FOR NON-TRAINER USE***************************** There are a number of transport options available to allow communication between companies participating in B2B e-commerce One of the decisions that you will have to make is which transport protocols are to be used in your application Other decisions that you will have to make include how distributed object calls are made by your application This section examines some of the transports options and discusses the features, advantages, and limitations of each option Module 7: Integrating with External Systems Transport Options Topic Objective To explain the transport options available for B2B solutions Lead-in There are several transport options available for B2B solutions Value Added Networks The Internet Point-to-Point Protocol *****************************ILLEGAL FOR NON-TRAINER USE***************************** Before electronically exchanging business data between trading organizations, the basic infrastructure to be used for the transport of the data must be agreed upon by those organizations There are several transport options available for B2B solutions: Value Added Networks (VANs) The Internet Point-to-Point Protocol (PPP) Value Added Networks Thousands of businesses exchange business documents, such as orders and invoices, with their trading partners through a widely used standard communication and content protocol named Electronic Data Interchange (EDI) Most EDI implementations use leased lines or VANs that require significant integration for each trading partner Network design, installation, and administration can be costly in terms of hardware, software, and staff In fact, these costs are the main reason why EDI is most widely deployed in only larger companies The Internet All companies can take advantage of value-chain integration through the low cost of the Internet Open standards for electronic document exchange allows all companies to become Internet trading partners and function as suppliers, consumers, or both This integrated trading tightens relationships between businesses while offering them greater choices in supplier selection Module 7: Integrating with External Systems Point-to-Point Protocol PPP is a set of industry-standard protocols that negotiate configuration parameters for multiple layers of the Open Systems Interconnection (OSI) model Microsoft® Windows NT® and Microsoft Windows® 2000 support PPP Computers running Windows can dial into remote networks through any server that complies with the PPP standard PPP compliance also enables both Windows NT–based servers and Windows 2000–based servers to receive calls from, and provide network access to, other vendors' remote access software PPP has made substantial progress in becoming a standard for Integrated Services Digital Network (ISDN) communications ISDN is a system of digital phone connections, which has been available for more than a decade The growth of the Internet and the development of new PPP-related technologies have enhanced the usage of PPP For example, the Point-to-Point Tunneling Protocol (PPTP) uses a PPP link to the Internet to provide a secure link to a remote local area network (LAN) Dialing into a local Internet Service Provider (ISP) will now establish connections that once required an on-site remote access server Because of advances in encryption technology, the link will remain private and remote clients can access the LAN from their home office through an Internet connection Module 7: Integrating with External Systems Transport Protocols Topic Objective To explain the different transport protocols for B2B solutions Hypertext Transfer Protocol Lead-in Used in Internet and intranet communications There are a variety of transport protocols that can be used in B2B solutions File Transfer Protocol Used for transferring files between computers Simple Mail Transfer Protocol Distributed Component Object Model Microsoft Message Queue Server *****************************ILLEGAL FOR NON-TRAINER USE***************************** There are a variety of transport protocols that can be used in B2B solutions: Hypertext Transfer Protocol (HTTP) File Transfer Protocol (FTP) Simple Mail Transfer Protocol (SMTP) Distributed Component Object Model (DCOM) Microsoft Message Queue Server (MSMQ) HTTP HTTP is the standard protocol that is used in Internet and intranet communications It is a lightweight application-level protocol HTTP is based on Transmission Control Protocol (TCP) TCP is a part of Transmission Control Protocol/Internet Protocol (TCP/IP), which deals with connection-based communication Because HTTP uses a single request and single response mechanism, it might seem better suited to a connectionless protocol such as User Datagram Protocol (UDP) The reason TCP, rather than UDP, is used is that the response to an HTTP request often carries a large amount of data, and TCP has the capacity to transfer large amounts of data reliably without complicating HTTP Secure Sockets Layer (SSL) can be used to encrypt data between the transport and the socket layer of the TCP/IP protocol stack All Hypertext Markup Language (HTML) and Active Server Pages (ASPs) on the Web server that receive, display, or process sensitive information must be secured by SSL During the SSL authentication process, a unique encrypted session key is generated by the browser for bulk encryption of information and then transferred to the Web server by using a public key operation so that information can be transferred securely Module 7: Integrating with External Systems FTP FTP defines a protocol for transferring files between computers FTP has a role to play in e-business because it provides an effective option for delivering large amounts of data to trading partners and consumers in an efficient manner For example, a supplier can send product catalogs to interested parties by using FTP Alternatively, an organization can send detailed sales figures and customer profile information to other businesses or regulatory bodies that need this information SMTP SMTP allows information to be sent as an e-mail message by using an SMTPbased server A process at the receiver end that operates in conjunction with a SMTP server (an e-mail server such as Microsoft Exchange Server) must wait for and process messages as they arrive SMTP is an appropriate transport for one-way business transactions, such as purchase orders, order status updates, shipping notifications, and payment reminders DCOM DCOM is an integral part of Microsoft's strategy for distributed objects With DCOM, a client program can invoke the methods of a remote object located on the server DCOM is an appropriate protocol for synchronous communications between tightly coupled applications in which the client knows the location and methods of the remote object For more information about DCOM, see Distributed Object Calls in this module MSMQ In conventional application design, applications usually communicate to other applications directly With message queuing, applications communicate directly with a message queue server, which queues the messages/requests and transmits them to another message queue server for processing MSMQ is a Windows NT and Windows 2000 service that provides guaranteed transactional asynchronous communication of messages between distributed programs MSMQ reduces the coding and administration effort needed to implement asynchronous applications and can shorten the time needed to develop e-business systems that include the need for asynchronous communication 40 Module 7: Integrating with External Systems Implementing Firewalls Using ISA Server Topic Objective To describe how ISA Server can be used to implement a VPN Lead-in The security of an e-business site can be further increased by implementing a firewall A firewall is a controlled point of access for all traffic that enters and leaves the internal network ISA Server provides a multi-layered firewall to control the access to your e-business site Filter the traffic to a site by configuring the ISA filters IP packet filters Application filters Intrusion detection filters *****************************ILLEGAL FOR NON-TRAINER USE***************************** The security of an e-business site can be further increased by implementing a firewall A firewall is essentially a software-based or hardware-based gateway between one network and another Need for Firewalls Communication between the Internet and internal network, and communication across private networks with trading partners, can be controlled with a firewall Firewalls serve two main purposes: It is a controlled point of access for all traffic that enters the internal network It is a controlled point of access for all traffic that leaves the internal network Firewalls can be used in an e-business solution to control the access to content through filtering Microsoft Internet Security and Acceleration (ISA) Server 2000 provides a multi-layered firewall to control the access to your e-business site Module 7: Integrating with External Systems 41 Filtering Traffic with ISA Server By using ISA Server, you can configure the following filters to specify the type of traffic that you wish to allow through the network to a target server: IP packet filters By using ISA Server, you can set the rules for allowing or denying network packets based on characteristics of an IP packet, including: • Source node or destination address • Network protocol, such as Internet Control Message Protocol • Source port or destination port Application filters ISA Server includes application filters that examine more than one IP packet, such as an entire e-mail message ISA Server includes several application filters that can examine the contents of multiple packets before choosing whether to accept or reject access ISA Server can even allow an application filter to identify viruses in the packets it is checking Intrusion detection filters Intrusions filters analyze all incoming traffic for specific intrusions, such as domain name system (DNS) attack and Post Office Protocol (POP) buffer overflow attack 42 Module 7: Integrating with External Systems Implementing VPNs Using ISA Server Topic Objective To describe how ISA Server can be used to implement a VPN Lead-in ISA Server can simplify the creation of a VPN ISA Server offers a simple wizard-based configuration interface that: Simplifies the creation of a VPN Allows for the implementation of security by choosing the relevant security options in the wizard Security options L2TP over IPsec PPTP *****************************ILLEGAL FOR NON-TRAINER USE***************************** Apart from firewall implementation, ISA Server simplifies the configuration of VPNs VPNs can be used to allow remote users access to sensitive corporate data across the Internet VPNs also allow geographically separated offices to access resources in the remote location as if the two offices were directly connected, even though the traffic is actually routed across the Internet In both scenarios, data is tunneled securely across the VPN connection VPNs also have a part to play in the integration of e-business trading partners If a VPN is created between partners, potentially sensitive information can be routed across the Internet and access can be gained as if the two LANs are connected This can simplify the development process significantly because you are no longer limited to HTTP traffic, and therefore, you have a varied range of transport protocols and programming techniques available for your use Using ISA Server The main concerns for users of VPNs are security and manageability ISA Server offers a wizard-based configuration interface that: Simplifies the creation of a VPN Allows for the implementation of security by choosing the relevant security options in the wizard By building this functionality on top of Windows 2000, you have a robust VPN solution that is easy to implement ISA Server needs to be installed at both the local and remote location to create a VPN A local VPN wizard is run on one computer and the remote VPN wizard is run on the other Module 7: Integrating with External Systems 43 Security Options To enable secure communication across a VPN, you can set the security on the tunnel that the VPN creates to any of the following options: L2TP over IPSec PPTP Note ISA Server 2000 is covered in depth in Course 2159A, Deploying and Managing Microsoft Internet Security and Acceleration Server 2000 44 Module 7: Integrating with External Systems Lab 7: Creating and Using Web Services Topic Objective To introduce the lab Lead-in In this lab, you will create a Web Service and use it in a B2B application *****************************ILLEGAL FOR NON-TRAINER USE***************************** Objectives After completing this lab, you will be able to: Create Web Services Incorporate Web Services into an ASP.NET application Scenario You have decided to build a Web Service that provides a specific functionality to the LitWare Books B2B application Specifically, you want to encapsulate the programming logic for calculating discounts based on certain criteria The business analysts at LitWare have decided to enforce the following discount rules in the B2B application: If fewer than 100 units of any particular product are ordered, no discount is applied If the number of units ordered for any particular product is between 100 and 499 (inclusive), a percent discount must be applied If the number of units ordered for any particular product is between 500 and 999 (inclusive), a 10 percent discount must be applied If the number of units ordered for any particular product is between 1,000 and 1,999 (inclusive), a 15 percent discount must be applied If the number of units ordered for any particular product is greater than 2,000, a 20 percent discount must be applied You will implement the above functionality as a Web Service so that you can re-use it on any platform and by any calling application Module 7: Integrating with External Systems Starter and Solution Files There are starter and solution files associated with this lab The starter files are in the folder \Labs\Lab07\Starter The solution files are in the folder \Labs\Lab07\Solution Estimated time to complete this lab: 60 minutes 45 46 Module 7: Integrating with External Systems Exercise Preparing the DiscountServer and the DiscountClient Web Sites To create the folders for the Web sites Open Windows Explorer Navigate to the \InetPub\WWWRoot folder Create a new subfolder, and then name it DiscountServer Create another subfolder directly under the folder \InetPub\WWWRoot, and then name it DiscountClient To configure the Web sites On the Start menu, point to Programs, point to Administrative Tools, and then click Internet Services Manager In the Internet Information Services console, expand your computer Click Default Web Site On the Action menu, point to New, and then click Virtual Directory The Virtual Directory Creation Wizard appears Click Next In the Alias text box, type DiscountServer Click Next Click Browse In the Select a directory tree, browse to \InetPub\WWWRoot\DiscountServer 10 Click OK 11 Click Next 12 On the Access Permission page, accept all default settings, and then click Next 13 Click Finish 14 Repeat steps through 13 to create a virtual directory named DiscountClient for the \InetPub\WWWRoot\DiscountClient folder Leave the Internet Information Services console open to use it in the following exercise Module 7: Integrating with External Systems 47 Exercise Creating the Discounter Web Service To copy the starter files Open Windows Explorer Navigate to the \Labs\Lab07\Starter folder Copy the file CalcDiscount.asmx to the \InetPub\WWWRoot\DiscountServer folder Copy the files Orders.aspx and Results.aspx to the \InetPub\WWWRoot\DiscountClient folder To create the Discounter Web Service Open Windows Explorer Navigate to the \InetPub\WWWRoot\DiscountServer folder In Notepad, open CalcDiscount.asmx Review the contents of the file Locate the following comment: 'TODO: Write NettPrice Logic Below this comment, type the following Visual Basic code: NettPrice = (Quantity*UnitPrice)*GetRate(Quantity) Locate the following comment: 'TODO: Write Saving Logic Below this comment, type the following Visual Basic code: Saving = (Quantity*UnitPrice)-NettPrice(Quantity,UnitPrice) Save the file, and then close Notepad 48 Module 7: Integrating with External Systems To test the Discounter Web Service In the Internet Information Services console, navigate to the DiscountServer virtual directory Select CalcDiscount.asmx On the Action menu, click Browse ASP.NET produces a page on which you can test the Web Service and inspect the semantics of using the service In the NettPrice Web Method section, type 150 in the Quantity box, and then type 20 in the UnitPrice box Click Invoke Your Web Service is run by ASP.NET You should see a new browser window with an XML structure containing your result The result should be 2850 Switch back to the Web Service test page In the Saving Web Method section, type 150 in the Quantity box, and then type 20 in the UnitPrice box Click Invoke Your Web Service is run by ASP.NET You should see a new browser window with an XML structure containing your result The result should be 150 You have now created and tested the Discounter Web Service Module 7: Integrating with External Systems 49 Exercise Creating a Proxy Class In the previous exercise, you saw how to create and test a Web Service However, to be able to use this Web Service in one of your Web pages, you must create and compile a proxy class that allows your application to make use of the functionality provided by this Web Service In this exercise, you will use the WebServiceUtil.exe command-line application to create the proxy class You will then use the Microsoft Visual Basic 7.0 command-line utility to compile the proxy class into a dynamic link library (DLL) To create the proxy class by using the WebServiceUtil Command-Line application On the Start menu, click Run In the Open text box, type cmd and then click OK A command-prompt window appears At the command prompt, type CD Inetpub\wwwroot\DiscountServer and then press ENTER At the command prompt, type: webserviceutil /c:proxy /pa:http://localhost/DiscountServer/CalcDiscount.asmx?SDL /l:VB /n:Discounter Tip The preceding command must be typed together at the command prompt as a single line of code The continuation arrows ( ) have been used to improve the readability of the code The /pa switch indicates the path to the Web Service The /l switch specifies the language to be used, in this case, Visual Basic The /n switch provides the name of the proxy class that will be created Press ENTER WebServiceUtil.exe creates a file named Discount.vb in the Web folder DiscountServer 50 Module 7: Integrating with External Systems To compile the proxy class by using the vbc Command-Line Compiler In Windows Explorer, move the file Discount.vb from the \InetPub\WWWRoot\DiscountServer folder to the \InetPub\WWWRoot\DiscountClient folder Switch to the command-prompt window At the command prompt, type CD \DiscountClient and then press ENTER At the command prompt, type: vbc /t:library /r:system.web.services.dll /r:system.dll /r:system.xml.serialization.dll /out:Discount.dll Discount.vb Tip The preceding command must be typed together at the command prompt as a single line of code The continuation arrows ( ) have been used to improve the readability of the code The /t switch indicates that a DLL is to be created The /r switches indicate which resources the Discount.vb file uses The /out switch indicates the name for the dll that is to be created Press ENTER To close the command-prompt window, type Exit and then press ENTER In Windows Explorer, create a subfolder named bin under the \InetPub\WWWRoot\DiscountClient folder Move the file discount.dll from the \InetPub\WWWRoot\DiscountClient folder into the folder bin You have now created and compiled the proxy class to access the Discounter Web Service that you created in the previous exercise Module 7: Integrating with External Systems 51 Exercise Using the Discounter WebService from the Client Web site To write the calling procedure In Windows Explorer, navigate to the \InetPub\WWWRoot\DiscountClient folder In Notepad, open Results.aspx Locate the following comment: 'TODO: Write Web Service Calling Procedure Below this comment, type the following code: Dim objDisc as New Discounter.Discount Dim sPrice as Single Dim sSaving as Single Dim iQuantity as Integer Dim sngUnitPrice as Single iQuantity=CInt(Request.Form("Quantity")) sngUnitPrice=CSng(Request.Form("UnitPrice")) sPrice=objDisc.NettPrice(iQuantity,sngUnitPrice) sSaving=objDisc.Saving(iQuantity,sngUnitPrice) Response.Write("Net Price is: ") Response.Write(CStr(sPrice)) Response.Write("") Response.Write("Saving is: ") Response.Write(CStr(sSaving)) Response.Write("") Save the file, and then close Notepad In Microsoft Internet Explorer, navigate to http://localhost/DiscountClient/Orders.aspx You will see the Discount Center Web page In the Quantity box, type 150 In the Unit Price box, type 20 Click Calculate You have submitted the data in the text boxes to Results.aspx The sub-procedure that you wrote in this exercise calls the Web Service that you created in Exercise and displays the results in your Web browser 52 Module 7: Integrating with External Systems Review Topic Objective To reinforce module objectives by reviewing key points Selecting a Transport Lead-in Time-Layered Operations The review questions cover some of the key concepts taught in the module Security and Authentication *****************************ILLEGAL FOR NON-TRAINER USE***************************** What is the major barrier in implementing leased-line solutions for your B2B solutions? Cost is the major barrier The required hardware and software, and the intensity of administration of such solutions, can all add up to a cost that is prohibitive for small to mid-size companies What are the advantages of using XMLP rather than DCOM as a means of invoking distributed method calls? • XMLP uses the Internet standard HTTP application-level protocol for its communication The HTTP communication used by XMLP is unlikely to be disabled by Web site administrators • XMLP is platform independent • XMLP is based on XML, and therefore, it is extensible and open Which Windows 2000 service enables sending and receiving of asynchronous messages between applications on different computers? MSMQ What metaphor is used to describe the interaction between components participating in the COM+ event service? Publisher/Subscriber Module 7: Integrating with External Systems 53 Describe some advantages of using certificates as part of your B2B solution Answers may vary, but must include: • High level of security • Single logon for users who will not be prompted to supply names and passwords over and over again Which protocol is responsible for encrypting data in a VPN? Point-to-Point Protocol Which protocol deals with routing the encrypted data in a VPN? Answers may include either of the following: • PPTP • L2TP THIS PAGE INTENTIONALLY LEFT BLANK ... http://msdn.microsoft.com/xml/general/soapspec-v1.asp iii iv Module 7: Integrating with External Systems Module Strategy Use the following strategy to present this module: Selecting a Transport In the first section,... into a B2B application Module 7: Integrating with External Systems Overview Topic Objective To provide an overview of the module topics and objectives Lead-in In this module, you will learn about... applications, new functionality can be added with much less overhead than in traditional distributed systems 18 Module 7: Integrating with External Systems Queuing Topic Objective To describe