Laird OnDemand

Ranking Cloud Computing Vendors 2009

2009-12-05T01:18:00.001-07:00

With the close of 2009 coming soon, I expect to see a number of “2009 - Cloud Computing in Review” type posts. Let me get a jump on everyone and release mine a few weeks early. Though I am a developer, my Cloud posts have all been analytical in nature and this one is no different. For this post I chose a single data source for stack ranking the Cloud Computing vendors – Google search results. Not terribly scientific, but an approach that produced interesting results.

Google as an Analysis Tool

I have created a number of editions of my Cloud Taxonomy over the last 18 months. The goal of that project was to help newcomers to the market understand what types of solutions are available and who the players are. My hope was that people would find it useful as a launching off point on their journey into the Cloud.

Tonight, on a whim, I decided to see what would happen if a person used Google instead as the start of their exploration of Cloud Computing. It was predictable that a high percentage of results are focused on “intro” or “definition” type pages. A lot of blog posts, tweets, and conference sessions have been devoted to defining what exactly is Cloud Computing. Let’s link to the NIST definition, and speak no more of that here.

What I found interesting was the relative ordering of vendors in the results list – it wasn’t what I expected at all. Given that Google Page Rank arguably orders results according to mind share, I expected certain vendors (e.g. Google, Cisco, GoGrid) to appear high above others. Looking at the results below, that didn’t happen.

To head off the flames, I recognize why this analysis isn’t scientific:

It is based off of a single data source – Google Page Rank
It is based off of a single search phrase – cloud computing
It assumes Page Rank == mind share

But its interesting to me nonetheless, so here we go.

Ranking the Cloud Vendors in 2009 on Mind Share

The table below shows the results. To collect this data, I did the following:

Cleared all browser cookies
Ensured I was logged out of Google (to avoid personalized results)
Navigated to the google.com search page
Typed “cloud computing” in the search box

And, here are the results. I first scrubbed anything that wasn’t a vendor or open source product. Then I noted the first time their domain (xxx.com) appeared, even if that listing was not their primary cloud page (sometimes the blog comes first). Google itself is the exception on this – hits on Google Groups/Blogger/etc did not count.

Result Page	Rank	Vendor	URL
1	1	Rackspace	http://www.rackspacecloud.com/
	2	Sun	http://www.sun.com/solutions/cloudcomputing/index.jsp
	3	Salesforce	http://www.salesforce.com/cloudcomputing/
2	4	Amazon	http://aws.amazon.com/ec2/
	5	VMware	http://www.vmware.com/solutions/cloud-computing/
	6	IBM	http://www.ibm.com/ibm/cloud/
	7	Canonical/ Ubuntu	http://www.ubuntu.com/cloud
3	8	Dell	http://content.dell.com/us/en/enterprise/cloud-computing.aspx
4	9	Oracle	http://www.oracle.com/technology/tech/cloud/index.html
	10	RedHat	http://www.redhat.com/solutions/cloud/
	11	Rightscale	http://blog.rightscale.com/2008/05/26/define-cloud-computing/
	12	Microsoft	http://www.microsoft.com/virtualization/en/us/cloud-computing.aspx
5	13	3tera	http://www.3tera.com/Cloud-computing/
6	14	HP	http://www.hpl.hp.com/research/cloud.html
	15	Yahoo	http://labs.yahoo.com/Cloud_Computing
	16	Objectivity	http://www.objectivity.com/cloud-computing/default.asp
8	17	Cisco	http://blogs.cisco.com/tag/cloud+computing
	18	Enomaly	http://www.enomaly.com/
9	19	CA	http://www.ca.com/US/insights/topic.aspx?cid=8348
10	20	F5	http://www.f5.com/pdf/reports/cloud-computing-survey-results-2009.pdf
11	21	Appirio	http://www.appirio.com/ecosystem/
	22	G.ho.st	http://g.ho.st/
	23	Akamai	http://www.akamai.com/cloud
12	24	Accenture	http://www.accenture.com/Global/Services/Accenture_Technology_Labs/R_and_I/CloudComputing.htm
13	25	GoGrid	http://www.gogrid.com/
16	26	Novell	http://www.novell.com/cloud/
20	27	Citrix	http://www.citrix.com/english/ps2/products/product.asp?contentID=1681633
21	28	Joyent	http://www.joyent.com/
	29	Parallels	http://www.parallels.com/spp/understandingclouds/
22	30	eyeos	http://eyeos.org/
	31	Eucalyptus	http://www.eucalyptus.com/
23	32	Appistry	http://www.appistry.com/
24	33	Infosys	http://wwwinfy.infyweb.akadns.net/cloud-computing/default.asp
25	34	Virtualmin	http://www.virtualmin.com/
	35	Nimbus	http://workspace.globus.org/

Congrats goes to Rackspace, as they topped the list.

These things surprised me:

Google? Where are you?
Amazon was not listed as the top result, and Rackspace was
Canonical/Ubuntu faired extremely well, given how new their enterprise cloud solution is
Cisco listed lower than expected at page 8, given how active they are in the blogging community

CloudFutures 2009 (Dec 7-8, San Jose)

In closing, this is a short plug for the CloudFutures conference coming up on Monday. I will be speaking on “The Real Cloud Players”. See you there!

Cloud Computing Taxonomy at Interop Las Vegas, May 2009

2009-05-19T11:05:00.003-06:00

If you have read my blog in the past, you will know that my schtick in covering the Cloud Computing and SaaS space is taxonomies. I have created a number of them, and have been an invited speaker to talk about them. Here are a couple of examples from the past:

Peter at Enterprise Cloud Summit

Yesterday, I spoke on the topic of taxonomies at Enterprise Cloud Summit, a conference within a conference at Interop Las Vegas. I was impressed by the turnout despite the economy – Alistair Croll did a great job putting together a great speaker list which in turn drove a lot of traffic into the sessions. My session went early on the first day, so it was my job to setup the landscape of the Cloud Computing industry. The taxonomy was perfect for that task.

My Kingdom for a Definition – media coverage of my session. Also, here is a link to my presentation.

May 2009 Cloud Computing Taxonomy

In support of my speaking at Interop, I have updated my Cloud Computing taxonomy. I have restructured the buckets a bit since the last time, and of course I have added some new vendors that have come on the scene. I have also removed a couple of solutions that have since exited (or have appeared to exit) the market – Coghead, Skemma, and Mule OnDemand. Cassatt, while not done yet, is marked with an asterisk to indicate its current status.
A few additional notes about the construction of this map:

There is a size limit, so not every vendor in every bucket can be covered. I include what I think are the major players, and include others as space allows
Some vendors could fit in multiple buckets, but generally I place the vendor in their main area expertise only
There are several categoris – hardware, virtualization, system integrators – that I don’t include at all. I find that they are spaces that deserve entire maps on their own.
News rolls in every day – AT&T just announced a Cloud storage solution. Please add a comment if you see a vendor that is missing that you feel should be included.
Some of these “vendors” are not actually vendors – some are open source solutions.

And a final word before presenting the map – I always recommend a different source for those who want to see a more exhaustive list of vendors in this space. Jeff Kaplan of THINKStrategies has created a SaaS Showplace which is an exhaustive catalog of vendors.

(Click on the image for a larger version)

Descriptions of the Buckets:

To provide some insight into what each bucket means, listed below are descriptions.

Infrastructure

Public Clouds – the poster children of Cloud Computing. These vendors offer computers as a service. If you need 50 computers in 15 minutes, these guys will take care of that. Differentiators include the provisioning model (virtualized instances vs. actual machines) and the host OS versions that are supported.
Private Clouds – these solutions help enterprises build private clouds within the firewall. If privacy and control is a big concern, or you want to increase utilization in an existing data center, a private cloud may be what you want.
Compute and Data Grids – while these solutions are also useful outside of a cloud, they can play an important role for applications that are deployed within a cloud. The key difference with Cloud applications from traditional on-premise applications is in how they must scale. With an on-premise application, you can scale vertically when the load gets too high – by buying a bigger machine. In the cloud, applications must scale horizontally – by adding more machines in a cluster. Compute and Data Grid products can help achieve horizontal scalability.
Virtualization and Appliances – when deploying OS stacks to public and private clouds, you will find it helpful to have a library of virtualized OS images. The vendors in these buckets will help in this area. Also, depending on the cloud being used, any number of Virtualization technologies will be used.

Platform

Business User Platforms – these platforms are cloud based application development environments. The focus of these platforms are on non-programmers as the application developers. To make this happen, these platforms offer rich visual tools to enable the developers to define data models and application logic. The differentiators for these platforms are their features – which is important to investigate during software selection as there is no coding allowed, so developers cannot code around feature outages.
Developer Platforms – these platforms are cloud based application development environments that support custom coding. Developers can build highly customized applications with these platforms, without having to worry about scalability, OS configuration, load balancing, operations, etc as they would with a public cloud offering. The differentiators for these platforms include the supported programming languages (Java, python, custom, etc), and data storage capabilities (RDMBS, key-value stores, etc).

Services

Storage – these vendors offer hosted storage that are API accessible. Meaning, any application can get/set objects into these Cloud storage solutions. The solutions vary in the supported data access models – key-value stores, file stores, etc.
Integration – solutions that provide integration facilities between multiple Cloud applications, or Cloud applications with on-premise applications. Major features offered are: messaging queues, business process modeling (BPM), and application adapters (like NetSuite adapter, SAP adapter).
Metering and Billing – building your own billing and invoicing system is highly discouraged. This is a great operation to outsource to a specialist. These vendors offer expertise in how to structure billing plans, plus all of the back office capabilities behind invoicing and collection. By outsourcing to one of these PCI compliant vendors, you will reduce the level of compliance your Cloud application will need to attain.
Security – The Cloud infrastructure and platform vendors must provide security, and so a base level can be assumed. But for value-add features, like application authorization features, encryption, and Single Sign On capabilities across multiple applications – look to these vendors.
Fabric Management – this is a space that evolves quickly, so you will need to keep up to date on new developments with these vendors. Generally, these vendors help you manage and deploy your application in the Cloud. This varies from features that allow you to design a virtual data center in a cloud, to auto-scaling an application when load increases, to monitoring Cloud servers to restart them if they fail.

Applications

SaaS – these vendors represent the ultimate end-game to all of this – Cloud based applications. There are thousands of them, and are traditionally known as Software as a Service (SaaS) applications. SaaS applications are available over the internet, are quick to provision a new account, are offered in a pay-as-you-go model, and allow some level of customization. NetSuite, Salesforce.com, Taleo, Concur, Workday and many others have established the space as a viable way to deliver software.

Vendor Links

Below are links to each of the vendors and solution depicted above.

Public Clouds
- ~ Amazon EC2
- ~ DAAS.com
- ~ Flexiscale
- ~ Joyent Accelerators
- ~ Microsoft Azure
- ~ Rackspace Mosso Cloud
- ~ ServePath GoGrid
- ~ Skytap
- ~ Sun Microsystems Cloud
- ~ Terremark Enterprise Cloud
- Hosting Providers
  - (not covered)
Private Cloud
- ~ Eucalyptus
- ~ Enomaly Enomalism
- ~ Nimbus
- ~ 10gen Babble
- ~ Cassatt *
- Hardware
  - (not covered)
Compute Grids

Data Grids
Virtual Appliances
- ~ CohesiveFT
- ~ rPath
Biz User Platforms
~ Caspio

Dev Platforms
Storage
Integration
Enablers
- Billing
- Security
- Fabric Mgmt
- System Integrators
  - (not covered)
Applications
- ~ Concur
- ~ Google Apps
- ~ Netsuite
- ~ Salesforce.com
- ~ Taleo
- (and thousands of others)

Please Comment

I have found some of the vendors above via comments placed on earlier versions of the map. If you know of a solution that you feel should be included, please post a comment on the blog. I can’t promise I will add it (the map is size limited), but I would like to see other solutions. Thank you!

I’m Back, and OnDemand

2009-05-19T09:25:00.001-06:00

September 15th, 2008. That was the date of my last blog post. What happened?

Where was Peter?

In short, I was off pursuing a different career path. When Oracle acquired BEA in May of 2008, I stopped work on the BEA SaaS platform. I returned to my roots in enterprise portals, and became architect of that product group at Oracle. I fought the good fight through the summer, but by September found I couldn’t maintain a presence in OnDemand. Instead, I focused on the myriad of topics related to Java application frameworks. My big authoring accomplishment of this period was my 152 page JSF whitepaper for WebLogic Portal. I would have blogged here about it, honest, but didn’t think you all would be interested. :)

Cloud Computing + Smart Grids, Peter’s New World

Last week, all of that changed. I left Oracle to join a startup that combines two of the hottest trends in technology – Cloud Computing and Smart Energy Grids. It is a bootstrapped startup (4+ years), is well funded and well connected, and some guys I worked with for years are already over there. All in all, it was an obvious move for me to make.

My new title is Platform Architect of Tendril Networks. Tendril already has a Smart Grid SaaS platform up and running, and I will be helping expand the offering into a Smart Grid PaaS. Will explain more about that in later posts.

But what this means to you, my readers, is that I expect that my return to an engineering role with an OnDemand product will lead to more OnDemand blog posts. No promises (we all have seen the, “I haven’t blogged in a long time, getting back at it…” followed by many months of nothing), but that is my plan anyway.

What’s Next…

I am at the Enterprise Cloud Summit at Interop this week. I spoke yesterday, and will blog next about my presentation.

Comparing Cloud Computing Mindshare Levels Between the U.S., Europe, and Asia

2008-09-15T01:55:00.001-06:00

Would you believe that the U.S. has 4 times more people interested in cloud computing than Europe? How about 5 times more people so interested than Asia? It is impossible to derive irrefutable evidence to validate those statements, but this blog entry offers one concrete data source that indicates those statements are true.

There have been various studies on cloud adoption and mindshare. For a young industry, it is an important metric to understand. Just this week, Chris Marino started a cloud adoption topic thread on the Cloud Google Group. He cited the Pew's report on American adoption of cloud applications.

This blog entry provides more data for that discussion. However, it focuses not on the adoption rate within the U.S., but the relative interest in cloud computing topics across continents. It uses traffic data from my blog as the input into the analysis.

Aggressive Extrapolation

Just to give you fair warning, I am about to draw sizable conclusions from a single source of data. This data source, traffic to my blog, cannot be proven to be a meaningful measurement. But I am writing this blog entry anyway because I think it is an interesting topic and the data might be meaningful. Also, I find there is an absence of information on this topic out on the net, so I hope this is a good starting point for other studies.

Here are a couple of assumptions I am making during this analysis:

Given that blog access is location independent, there is an equal opportunity across regions for any cloud computing enthusiast to read my cloud blog entries
Given equal opportunity, the readership of my cloud blog entries roughly matches interest level in each region for the topic of cloud computing in general

You could certainly argue that my blog does not generate enough traffic to be a significant measure. You could also argue that the level of blog readership in general isn't consistent across the regions.

You could also probably find about ten other reasons why this study is not conclusive. Once again, I hope this is a starting point for others to contribute meaningful data, and so this blog entry will be published despite the possible objections.

The Raw Data: Blog Readership Numbers

I will first introduce the raw visitor numbers of a handful of blog entries, as captured by Google Analytics. Later sections will explain the data and what to look for in these numbers.

Blog Entry	Cat gory	Visits	U.S. %	Europe %	Asia %
Cloud Taxonomy V2	Cloud	1631	67	17	13
Cloud Taxonomy V1	Cloud	1172	63	20	15
SaaS Taxonomy	SaaS	207	54	18	26
SaaS for IBM, ORCL...	SaaS	191	40	32	25
SaaS Contract Analysis	SaaS	196	69	22	8
Control 1	Ctrl	131	51	27	16
Control 2	Ctrl	363	53	24	21

A few words on the data collection gathered from Google Analytics:

These numbers reflect visits between July 1, 2008 and September 14th 2008
Some of the entries were not available during the entire collection period.
They do not include RSS readers, as my feed exposes the entire entry
Some of the older entries started life on a different blog system before being migrated to this blogspot account in May. Some clicks may have gone to the older blog system for those entries and were not captured.
Visits are unique visitors, which each may account for one or more pageviews
The numbers don't add up to 100% due to hits coming from places outside the three regions

Primary Evidence: Cloud Computing Visual Map Entry

The primary piece of evidence, and the one from which I drew the main conclusions, is an entry made on September 8th 2008. It is titled "Cloud Taxonomy V2" in the table above. The blog entry contains the second version of a vendor map I have drawn that visualizes the cloud computing industry. I pick this entry as the primary evidence for the following reasons:

It is very recent, and therefore very "clean" in terms of tracking actual human users reading the entry
It is an entry with general appeal - it covers the industry as a whole. It therefore should represent a broad measurement of interest.
It has enough visitors (1631) to make for a good sample size

The evidence reveals the following distribution:

It is from this data that the main conclusions are drawn:

U.S. interest in the topic of cloud computing is 4 times greater than in Europe
U.S. interest in the topic of cloud computing is 5 times greater than in Asia

Look also at the numbers associated with the blog entry listed as "Cloud Taxonomy V1". That was the first version, released in May of this year. It is comforting to see that the V1 numbers roughly match the V2 numbers.

What About the SaaS Numbers?

You will notice that the SaaS themed blog enties don't carry the same distribution as the cloud entries. This is odd, as SaaS is a subset of cloud computing (see the referenced taxonomy diagram if you want to see why).

Specifically, look at the first two SaaS blog entries, found here and here. See how the U.S. has a lower share of the readership than with the cloud taxonomy entries:

One fabricated explanation - its about early adopters?

The U.S. contains a higher percentage of early adopters (hypothesis)
The overall cloud computing industry is still quite young , and dominated by early adopters. Therefore, the U.S. has a greater share of the readership of the general cloud taxonomy entries.
SaaS is further along in adoption than the overall cloud computing industry. Therefore, you will see more balance in the interest levels.

Now look at the third SaaS entry - the one titled SaaS Contract Analysis. This one actually shows a higher distribution for the U.S. relative to the cloud taxonomy entries. Why?

Once again, a totally fabricated explanation - does this show Adoption as opposed to Mindshare?

The SaaS Contract blog entry contains an analysis of SaaS contract terms, and suggested terms to avoid as a customer.
This is not an entry for future thinkers or those just kicking the tires. This entry is primarily useful for those actually implementing SaaS and who need to review contracts with vendors. Perhaps this may show actual adoption, while the data for other entries show mindshare/interest?

Seeking a Control: My Non-Cloud/SaaS Blog Entries

While in recent times I have focused my external writing on Cloud Computing and SaaS topics, I also have written on topics such as mashups and Java security. To help shed more light on the numbers revealed above, I offer two of those blog entries as a control for this analysis. These may indicate what bias already exists in my blog readership.

Or they may not - most of my readers find my blog via search engines, not because they are regular subscribers. Therefore I would argue that these other blog entries don't offer much insight. But they are included anyway for your review.

Other Data Points on Cloud Mindshare and Adoption

There are other publicly available surveys on various adoption rates and mindshare. I would contend that none of these provide data for the specific discussion above, but they are interesting all the same:

Kevin Jackson uses Google searches to understand what vendors have mindshare in the Cloud space (including me! - thanks Kevin)
Chris Marino of SnapLogic started a thread on American adoption rates recently on the Cloud Google Group. He referenced the Pew report, and a few more links popped up.
John B. Horrigan of Pew offers a survey of cloud application usage in the US.
Duncan Riley also discusses the American adoption of online productivity suites.
McKinsey presents a global comparison of adoption of Web 2.0 technologies. This does not cover cloud, but I see Web 2.0 as a loosely related market.
Gartner recently released a report called Hype Cycle for Emerging Technologies, 2008. I don't have access to this research however, so can't comment on its contents.

Call for Collaboration

This analysis would be helped immensely by having access to more data sources. Cloud bloggers - what are you seeing? Cloud vendors, what can you say about your customers? Please reveal!

Also, the raw spreadsheet data from Google Analytics for my cloud v2 entry is here. If you would like a different export of the data, let me know.

Technorati Tags: cloudcomputing,cloud,saas,market,marketshare,industry,analysis

Visual Map of the Cloud Computing/SaaS/PaaS Markets: September 2008 Update

2008-09-08T12:50:00.000-06:00

NOTE, New Version Available:

This version of the map is now outdated. I have released a new version of this map for Enterprise Cloud Summit at Interop Las Vegas. Follow this link for the latest version.

Interop NYC 2008

Four months ago, Kent Dickson and I created a visual map of the Cloud, SaaS and PaaS industry. It proved to be a popular item - we got a lot of comments and continue to see traffic to my blog page. I was long overdue to create a second version - comments needed to be integrated, and the industry has changed enough to warrant a round of updates. This blog entry contains an updated version of the map.
The timing is no accident. I will be speaking at the Interop NYC 2008 conference on September 15-19. I will be presenting on the topic of Cloud Taxonomy. My slide deck was submitted last month, but I want to have a fresh version of this taxonomy to present. Thus, the tyranny of the deadline has forced my hand.

Defining the Markets

In the first version of the map, the players were divided into four major buckets (from the bottom up):

Cloud Computing
Platform as a Service (PaaS)
Software as a Service (SaaS)
Core Cloud Services

In the intervening months, a number of others have attempted to dissect the industry into a taxonomy. Robert Anderson came closest to our original breakdown by identifying three major buckets in his blog:
I like the labels on the bottom two buckets, especially getting away from the PaaS label in favor of Platform. However, I don't agree on the top, as Software is too generic of a word. I prefer Applications for that bucket. Also, I believe a fourth bucket is necessary, to include a number of standalone components that are built on the platforms but are not applications. We called these Core Cloud Services in the first version, and I have labeled the bucket just Services this time around.
The updated stack that I will use in the taxonomy is as follows (starting at the bottom):

Infrastructure: the core computing resources and network fabric for the cloud deployment
Platform: the software infrastructure that allows sys admins and developers to deploy an app to the cloud
Services: additional services that can be woven into the cloud app, such as billing, storage, integration
Applications: the ultimate cloud product - the actual cloud based application that the user touches. These number in the thousands.

You will note that the map is annotated with these buckets, with "1" denoting Infrastructure, and so on.

The Visual Industry Map

Below is the visual map as promised. You will find a larger version hosted here. An explanation of each category and a full clickable URL list of the solutions is offered below the map.
Please post comments with your feedback - they are very much appreciated. As before, there is no hope for this map to be comprehensive. I have selected a good group of vendors, but of course there are others that could have been placed on the map. My research notes are here, and they may explain why a particular vendor was left off.
What worked well before was for commenters to log the omissions, which I can evaluate and remedy in a later version. Also, Jeff Kaplan at THINKStrategies has created a SaaS Showplace database that is far more comprehensive.
Now, to the point, the map as promised:

Reference Vendor List

The following is the clickable list of each vendor displayed above.

Public Cloud
Private Cloud
Open Cloud Platforms
Custom Cloud Platforms
Cloud Platform Tools
- Fabric Mgmt
- Data Grids
- Virtual Appliances
  - ~ rPath
  - ~ CohesiveFT
- ~ Hyperic CloudStatus
- ~ Hadoop
Storage
Integration
Value-Add
- Billing
- Security
  - ~ Ping Identity
  - ~ OpenID/OAuth
- ~ Strikeiron
Applications

Technorati Tags: Cloud,SaaS,PaaS,taxonomy

Building a RESTful Enterprise Integration with Oracle and SnapLogic

2008-08-26T23:46:00.001-06:00

In the enterprise space, integration problems abound. IT must connect numerous legacy systems in new applications to adjust to the changing needs of the business. Technologies to achieve such integrations include SOAP based Web Services (WS-*) and binary protocols such as CORBA and RMI. This blog entry discusses a different approach - integration using lightweight REST APIs.

To illustrate the concept, a demo has been created showing how to combine data from Oracle's WebLogic Portal product with data from Oracle Database. This demo is accomplished using RESTful APIs as the data transport mechanism, and is orchestrated by a third party data integration product called SnapLogic. This demo was showcased at a REST Symposium I organized for Oracle employees in July, which featured speakers from Oracle, SnapLogic and Yahoo! (see below for details).

What is REST?

REST is an acronym for REpresentational State Transfer, and was coined by Roy Fielding in his PhD thesis published in 2000. It is not a technology, a standard, or a product. REST is an architectural pattern that describes the underlying architecture of the World Wide Web and how it came to be such a massively scalable computer application. The WWW is known to have the following qualities:

Highly scalable - millions of websites
Fault tolerant - at any given time, many websites are offline, but the web continues to work
Performance- HTTP allows for intermediaries to help improve performance via caching
Interoperable - nearly every computing platform has a browser, and websites are written in a myriad of languages
Distributed - websites and clients span the globe
Self describing - there is no user manual required for users to navigate the WWW

Aren't the above qualities desired for any enterprise systems as well? The power of REST lies in the idea that the same fundamentals that work so well for the WWW can also work with great success within the enterprise.

There are plenty of resources on the web that explain the principles of REST, and so I have no intention of duplicating that material. In essence REST describes an architecture in which:

Application resources (objects, in the OO world) are exposed as URIs
HTTP requests are used to retrieve and update data on the server
The HTTP requests utilize the standard HTTP verbs (GET, POST, PUT, DELETE) to define the API operations, helping client developers by providing a consistent interaction model

An example is the following:

A client issues a request to the following URI: http://wlp.bea.com/dvt/api/content/autos.jsp
The server response contains a list of automobiles, described in a format such as XML
The client consumes the XML document and outputs the entries that match the user's criteria

This pattern is seen most often with Rich Internet Applications (RIA), where the client is a browser and the API is being invoked via Ajax (more precisely, the JavaScript XmlHttpRequest facility). While this is a very powerful use of RESTful APIs and is alone enough to justify the creation of RESTful APIs, this use case is not the focus of this blog entry. I would encourage you to research Ajax application development for more background.

Instead, we will look more closely at how RESTful APIs can also make data integration easy.

RESTful Integration in Concept

RESTful APIs expose data in a way that is easily consumed. Invoking the API is as easy as issuing an HTTP request, which is possible to do from almost any programming language/platform. While enterprise data integration can be implemented using a wide variety of technologies, the purpose of this blog entry is to show how it can be done with RESTful APIs.

As stated in the preamble, there are non-RESTful approaches to solving this problem. A SOAP based solution could be implemented and for some cases is the preferred approach. If your use case requires the support of the WS-* family of standards, then WS-* is the way to go. What this example shows is that REST offers an alternative and is appealing in its simplicity.

Instead of discussing the theory, it is more useful to look at a working example.

Example: Oracle WebLogic Portal + Oracle Database + SnapLogic + REST

Consider the following example:

An insurance company is using the Content Management capabilities of Oracle WebLogic Portal to store auto claims. Each claim contains a photo of the damaged vehicle, and some data about that vehicle such as make, model, year and a description of the damage.
The insurance company also has a Oracle Database that is populated with industry data regarding the fair market value of the cars, and the salvage value. These values are specific to the make, model and year.
The insurance company wishes to put the repair of the damaged vehicles out to bid to a community of auto repair shops. The intent is to allow shops to bid on the vehicles they are willing to repair using the industry data and the information from the claim.

The insurance company decides to use a quick and lightweight approach to build a data mashup with a web UI. The implementation is achieved using RESTful APIs, and orchestrated using a product called SnapLogic. SnapLogic is an open source server that provides:

Many pre-built connectors to expose native data sources as RESTful APIs (e.g. database, spreadsheet, XML)
Sophisticated data manipulation capabilities, such as joins, filtering, sorting, and computations
A variety of output formats for the completed RESTful feed

The data integration demo was implemented as follows:

A RESTful API is configured for the WebLogic Portal (WLP) Content Management system. In this example, the RESTful API was custom built as a JSP, but this capability will come pre-built in a future version of WLP.
The Oracle Database schema is exposed as a RESTful data API using an out of the box Database Reader component of the SnapLogic server.
The two data sources are joined using a SnapLogic pipeline. The pipeline reads the claims from WLP CM and the industry data from the database using the RESTful APIs.
The joined data is converted into an ATOM syndication feed via the SnapLogic server (using an Xml Writer component)
The ATOM feed is displayed in a ATOM reader, in this case the Google Mashup Editor UI

All of this is achieved via configuration, not code. The architecture is depicted in this diagram:

The resulting web application appears like this:

For more detailed information on the implementation of this mashup, consult the companion entry on SnapLogic's blog:

SnapLogic CTO Mike Pittaro's blog entry on the Oracle mashup

Oracle and REST

This is a simple demonstration that shows the ease of implementing integrations using RESTful techniques, especially when combined with a REST integration enabler such as SnapLogic. It is a stated goal of some of the Oracle product groups to provide RESTful APIs for access to product data. Check with the roadmap for each product to understand when these APIs will be available.

Attendees to Oracle Open World 2008 will have several sessions related to Oracle product groups and REST:

Oracle Internal REST Symposium

For Oracle employees, more information is available on the company intranet. I organized an internal symposium on REST amongst the product groups on July 28th, 2008. The event included speakers from Yahoo! and SnapLogic.

The agenda covered a number of RESTful topics, including:

Explaining REST (Subbu Allamaraju of Yahoo!)
Industry product landscape - SnapLogic (Mike Pittaro, CTO SnapLogic), and other products
Enabling technologies - RESTlet, JSR 311, WADL, JSON marshalling
Oracle Product efforts - presentations by various products groups on their REST efforts

Access to the recordings and slide decks can be found on the intranet here.

Resources

You may find the following links helpful:

The hosted WLP CM REST feed of crashed automobiles
The WLP CM REST API implementation (offered as a JSP for easy distribution, but could be a servlet)
The hosted demo on Google Mashup Editor
SnapLogic website.
SnapLogic CTO Mike Pittaro's blog entry explaining the implementation
SnapLogic CEO Chris Marino's blog entry discussing his thoughts on the REST Symposium
REST wikipedia entry

Technorati Tags: REST,Oracle,SnapLogic,WebLogic,WebLogicPortal,integration,HTTP,GoogleMashupEditor

Best Practices for the Suspension or Termination of a SaaS Customer Account

2008-06-17T00:22:00.001-06:00

No one wants to predict the failure of the relationship between a SaaS provider and customer. But much like a pre-nuptial agreement helps to quickly and fairly resolve the end of a marriage, a good up front contract helps ensure that both parties are fairly treated when a SaaS contract terminates. For this to work, the contract must have a well defined and fair set of terms for unwinding the relationship that works for both parties and minimizes business disruption. This blog entry proposes a set of rights for both customer and provider to use when establishing the contract terms.

This blog entry is a result of my analysis of a number of SaaS contracts. I covered the analysis in my previous blog entry. Note that I am not a lawyer, just an amateur contract sleuth so please engage a professional when working on your contracts.

SaaS Customer Bill of Rights

Other authors have created full blown Bill of Rights for SaaS customers. For example:

Dion Hinchcliffe: Information portability, trust, and an Online Software ‘Bill of Rights’
Wesabe: Data Bill of Rights
Ray Wang: An Enterprise Software Licensee's Bill Of Rights (for fee content, I haven't read it)
Kevin's Bill of Rights

This blog entry is more focused. I am proposing rights that apply to both customer and provider when an account is on its way to being terminated.

Termination Rights for the Customer

I propose the following rights for customers whose account is being terminated:

Right to Business Continuity - customers rely on their SaaS products to conduct their business. Therefore, the provider must not have the ability to just terminate the customer's account without warning. A process must be in place to give ample warning before an account is terminated.
Right of Data Ownership - the customer must be able to extract their data upon termination, regardless of cause. The format of the extracted data should be as lossless as possible.
Right to Walk Away - the customer has the right to discontinue use of the service at the end of their contract. By exercising this right, they don't relinquish their other rights.

Termination Rights for the SaaS Provider

I propose the following rights for the provider that is terminating the account:

Right to be Paid - if you read about the SaaS business model, you will discover that cash flow is a major issue for the provider. Providers must carefully manage incoming cash and outgoing expenses. Anything that disrupts the predictability of the business will create major problems. Therefore, the SaaS provider has the right to expect timely payment, perhaps months in advance. If the customer fails to honor this right, the provider can quickly move the account into a suspended state.
Right to Protect the Service - if a customer account engages in malicious behavior or violates terms in the contract, the provider has the right to protect their service. In cases where the account is causing ongoing harm to the service (Denial of Service attacks), the provider must be able to immediately suspend the account. For less urgent issues, the provider should provide an appropriate warning before suspending the account.
Right to Fire a Customer - businesses need to adapt to changing markets, and sometimes this means adapting or discontinuing products that aren't successful. For customers that no longer fit the profile of the business, the providers need to be able to discontinue their relationship with these customers. However, this process must honor the customer's right to business continuity.

Further Discussion

Hopefully each of these rights are obvious in their benefit. A couple demand more discussion.

Data Deletion - Where is the Mechanic's Lien?

Most Terms of Service assert that the customer owns their data. I am no lawyer, but ownership appears to be full legal ownership, like you would own a car or a house. See Netsuite's ToS as an example, but a clause like this is seen in almost every contract:

"Customer Data shall at all times be considered the property of the Customer."

However, some ToS documents allow the provider to destroy that data without providing the customer a copy in cases where the account is terminated for breach of the terms or failure to pay. This does not appear to be fair to the customer (as the SaaS provider is the prosecutor, judge and jury in this decision), and is inconsistent with physical property law in the U.S. (intl folks bear with me, I am focused solely on U.S. law here).

For example, if you don't pay a carpenter that performed work on your house, that carpenter does not have the right to burn your house to the ground. Instead, there is a process called the Mechanics Lien that requires the tradesman to pursue the money through a legal process, and he cannot harm the property in question. You could argue that data does not carry the same legal rights as physical property, but at least in some jurisdictions the law appears to treat data the same:

Catherine Rivard: Is Computer Data "Tangible Property" - traces the history of the issue, and implies that data is tangible property based on the Ingram Micro case
Texas law makes inflicting "harm" on data a crime
Wisconsin has a law against willful destruction of computer data

It seems that if a provider destroys their customer's data they open themselves to some legal liability. On the other hand, perhaps expressly reserving the right to destroy the data in the ToS alleviates the liability for the provider? Is it worth the risk of finding out?

Regardless, destroying a customer's property is not a good business practice. Providers should treat the data like any of the customer's physical property. It should be returned undamaged because it legally belongs to the customer.

Business Continuity

Some Terms of Service allow for immediate termination of a customer's account with or without cause. In others, short periods of time like 30 days is all the notice necessary before the customer can be turned out. For mission critical applications, this is troublesome.

I feel there are a couple of key principles here to consider.

For no-cause terminations, the provider must provide as much advanced notice as it will take a typical customer to migrate to a new service. For services with high switching costs, this will be a period of many months.
For cases where the customer is in violation of the contract, the account should move into a suspended state before termination. This allows the customer to remedy the violation before the account is terminated. Suspensions are reversible, terminations are not.

These two principles are not widely implemented, but are critical in order to provide the customer with fair treatment.

Negotiate your Customer Contract

These listed rights are all well and good, but they won't likely appear in your contract by default. The contracts I have seen are largely skewed in the providers' favor because they were written by the providers. As a customer, I feel it is worth your time working towards more favorable terms. As shown in this blog entry, don't forget to negotiate the exit terms in the contract to ensure a viable migration when the time comes to end the project.

Technorati Tags: saas,contract,suspend,terminate

The Good, Bad, and the Ugly of SaaS Terms of Service, Licenses, and Contracts

2008-06-12T03:18:00.002-06:00

Did you read your contract carefully before signing on with your SaaS provider? This blog entry shows you why it is important. Mixed in with some good stuff are some bad terms, and even down right ugly terms of use. Some vendors assert full rights to use and sublicense your private data! That's right, for the privilege of using their SaaS application, you throw in the rights for the use of your private data. Caveat Emptor!

The Analysis

This blog entry is a roll-up of an analysis I did of the Terms of Use for 8 different SaaS products. The products varied widely - some for the enterprise, others for the consumer. What the analysis showed is that there is little consistency across the legal documents governing the use of these services. It also showed some alarming terms that some of the sites demand.

I have picked out just the highlights to present here. The full analysis is available for download at the end of this post, but I warn you, it is quite boring.

Notice: I am an employee of Oracle, but this blog does not represent the views of my employer.

The Good

The following are the bright spots in the collection of ToS:

Netsuite: there are reports that this company has onerous licensing practices, but I see no evidence that. Of the 8 contracts I reviewed, Netsuite's is by far the best written and the most consumer friendly. They have the best data retention policies and termination procedures.
Boomi, Netsuite, Taleo: offer warranties for the various aspects of their systems, and not just "as-is". (see Boomi item 6.1, Netsuite section 3, Taleo item 11)
All but Concur: all of these services affirm that you own the data that you upload. This is key. However, there are a couple of vendors that reserve too many rights to use your data, see below.
Boomi, Coghead, Netsuite, Salesforce, Taleo: these companies indemnify the customer in cases where the application is found to infringe on a 3rd party's IP, and the customer is sued. Taleo is the only vendor of the 8 that does not demand to be indemnified in return from someone suing them for your use of the system.

The Bad

The following are terms that you should be wary of when entering into a service contract. Try to negotiate better terms:

Box.net, Coghead, Concur, Salesforce, Taleo, Zoho: these companies have contracts that can change at any time without any notice. In a way, this could be the ugliest line item of them all because the company could write in whatever nasty thing they want. But I will leave it at "bad" until one of the companies does something evil with it. (see Box.net item A, Coghead item 6.2, Concur item 8, SFDC item 21, Zoho item Mod ToS)
Salesforce, Taleo: have a line item that allows the company to advertise your name as a customer, merely by signing up for a paid account. Customer references should be earned, not mandated. (SFDC item 1, Taleo 7.1)
Salesforce: prohibits direct competitors from using the Service. But at the rate SFDC is expanding offerings, will you become a competitor tomorrow? For example, anyone that offers software development tools became a competitor when they launched force.com. (see SFDC item 2)

The Ugly

The following is the list of contract terms that are unacceptable. I would not recommend using the following services unless you negotiate better contract terms. [Update:to be clear, I don't think these companies are out to do evil, I am merely sounding the alarm to their contract terms]

Box.net: [Update: Box.net has fixed this issue in their contract, by narrowing dramatically the scope of their rights to your content] by uploading content that you own to this service you are giving Box.net an irrevocable license to use, copy, create derivative works of, sublicense, etc etc of your content. Think about that. The only redeeming argument is that this contract is for personal, not business use. But they put this item in there for a reason - why? Imagine uploading your personal pictures and then seeing one in the next promotional campaign for Taco Bell. This could happen because Box.net has the right to sublicense as they wish. (see section D)
Coghead: if Coghead terminates your account, you have just 2 days to send written notice to request your data. Otherwise they can permanently delete all of your data. What's the rush? (item 7.3)
Concur: (caveat: this is the Trial license, which can only be assumed to match closely the production license) has the most worrisome contract as it relates to your data. It is the only one that has no explicit line to indicate that you still own your data (filed business expenses, in this case). But it does have a line saying that Concur has an irrevocable right to use that data - this includes your personal data and financial info! Why is this in the contract? This seems quite broad for data that is of utmost sensitivity. (see item 5)

Links to the Terms of Service

The following is a list of links for you to inspect the contracts for yourself:

Box.net http://box.net/static/html/terms.html

Boomi: http://www.boomi.com/application/Boomi+Master+Subscription+Agreement-Online.pdf

Coghead: https://www.coghead.com/user/register?plan=Pro

Concur (Trial license): http://www.concur.com/register/Concur-Expense-Trial.php

Netsuite: http://www.netsuite.com/portal/pdf/tos.pdf

Salesforce: http://www.salesforce.com/company/msa.jsp

Taleo: http://www.taleo.com/solutions/licensing-terms.php

Zoho: http://www.zoho.com/terms.html

Raw Analysis

The following link provides you with the spreadsheet I built while analyzing the licenses. The spreadsheet contains the list of common license clauses with pointers into the documents on where to find those clauses.

What it shows most of all is the lack of commonality across all of the licenses. Each document has a lot of variance.

Download: SaaS "Terms of Service" Analysis Spreadsheet

Account Suspension/Termination and the Deletion of Data

I found that the process by which accounts are suspended (reversible) or terminated (irreversible) wildly inconsistent and mostly incorrect in my opinion. Because termination is also coupled with data deletion, this process needs to be well understood and incredibly fair to the consumer. My next blog entry will focus on this part of the contract, and establishing a reference workflow.

Technorati Tags: saas,license,contract,boomi,box.net,concur,coghead,netsuite,salesforce,taleo,zoho

How Oracle, IBM, SAP, Microsoft, and Intuit are Responding to the SaaS Revolution

2008-06-05T02:00:00.001-06:00

In my previous blog entry, I discussed the possibility of a software giant failing to adapt to the SaaS revolution. I used the history of DEC as an example of how a highly successful company could miss a major shift in the market and capsize. This blog entry is a reference guide to what each of the major software vendors are doing in the SaaS space. I won't be sensational and predict the demise of any of these vendors. I think it's far too early to tell how the future will pan out.

I can say subjectively that I am impressed with Larry Ellison's pioneering efforts in the space. I can also say that SAP is currently the media whipping boy in the space, with delays in their Business ByDesign program costing them credibility. But this revolution is far from done, so let's not waste time trying to speculate the distant future.

Note: I am now an employee of Oracle, via the BEA acquisition

Oracle

Strategy

Larry Ellison, Oracle's CEO, has be talking about on demand software for a long time (10 years I believe), so it is clearly on his radar. In fact, he was an investor in both Salesforce and Netsuite, showing his belief in the business. Charles Phillips, Oracle President, has also spoken to the topic.

Larry and Charles Phillips have articulated a strategy on how Oracle can deliver SaaS and retain its focus on its core market (large enterprise). Larry does not intend to make a major push into the lower end of the SMB market.

Larry Dignan interviews Larry Ellison: he discusses why SAP's move downmarket is a big mistake, explains Oracle's strategy
Larry Dignan: Does Larry Ellison have the best SaaS strategy?
Dan Farber: Charles Phillips talks about Oracle's On Demand business

Current SaaS Initiatives:

Oracle supports the following SaaS initiatives:

On Demand Managed Applications
- A SaaS offering, with Oracle hosting its applications on behalf of customers
- It is a successful program, on track to gross $700 million this year, growing quickly
Oracle SaaS Program
- Technology and business support for SaaS ISVs
- Partner program with many ISVs already signed up
Oracle SaaS Platform
- A product offering to help ISVs build and host their own SaaS applications

Weaknesses

Critics have primarily focused on the lack of end-to-end multitenancy in the On Demand business. The argument is that Oracle will not be able to provide a cost efficient solution unless the entire stack is multi-tenant.

Phil Wainewright: Oracle’s misconceived SaaS strategy

Further reading:

InfoWeek: Oracle Plans Utah Data Center To Support SaaS Business
Oracle's SaaS Blog
Aberdeen Group positions Oracle as the leading software giant in the SaaS space
Phil Wainewright is excited about Oracle CRM On Demand
Oracle CRM On Demand summary

Microsoft

Strategy

At an architectural level, Microsoft is promoting an S+S model, instead of a pure SaaS model. S+S stands for Software+Services. The idea with this is that Software as a Service is most useful when pared with local software (like Office). Microsoft obviously has a major incentive to make sure desktop software is not left behind in the SaaS world, so this makes for good strategy. Whether consumers will buy into it is another matter. See the weaknesses section below for more on this topic.

Mary Hayes Weier: Steve Ballmer explains the S+S strategy
Springboard Research: Microsoft updates its SaaS strategy

Current SaaS Initiatives

The following is a selection of the SaaS offerings from MSFT:

SaaS On-Ramp Program - aids ISVs in building out SaaS solutions
Microsoft Online Services - its businesss applications ondemand offering
- Hosted versions of Exchange, Sharepoint, and LiveMeeting
- Dynamics CRM Live - hosted version of the Dynamics CRM offering
Windows Live - a family of hosted offerings for the small business/consumer
- Live Mesh - touted as a SaaS solution, it currently is just a file synchronization service
- Messenger (IM), Windows Live ID, Virtual Earth, Search, Spaces (blogs), and Gadgets
Architect Center - provides architectural guidance for ISVs
- Lead by Gianpaolo Carraro and Fred Chong
- Have produced a SaaS reference application, LitwareHR
- While some of what they write is MSFT centric, most of the articles are generally applicable
- As an architect myself, I admire the work that they do

There are more services listed here, but not all are really SaaS.

Weaknesses

Critics contend that Microsoft will struggle to succeed in the SaaS market while preserving its existing franchises. It already stumbled with its business model when a European partner began offering Office as a service:

Phil Wainewright: Microsoft in a twist over SaaSy Office deal
Phil Wainewright: Microsoft disappoints on SaaS. Didn’t you see it coming?
Larry Dignan: Microsoft to SaaS: We (are going to someday) have you surrounded
Barb Mosher: Will Microsoft Office Have Go To SaaS to Survive?

Its Office franchise is already being eroded by service based offerings (Google Apps, Zoho, Adobe, etc). Somehow it has to prevent Office revenue from being decimated by pure SaaS players.

IBM

Strategy

Searching for interviews on SaaS with IBM's CEO Sam Palmisano or VP of Software Steve Mills does not bring up much of interest. This is a bit alarming, remembering the lessons from my previous DEC post. Of the 5 major software giants covered here, IBM appears to have the least amount of executive mindshare for SaaS.

I am not the only one who sees this: Larry Barrett wrote an entire article analyzing IBM's apparent sluggishness when it comes to SaaS. While I don't see a high level business strategy, IBM has embarked on some SaaS initiatives, covered in the next section.

Donna Bogatin: SaaS: IBM helps drive $10 billion Software as a Service opportunity
Krissi Danielsson: David Mitchell on IBM's SaaS Strategy

Current SaaS Initiatives:

IBM has these intiatives:

SaaSpace.com/Partnerworld - a consulting offering
- Helps ISVs build SaaS solutions
- Helps clients integrate SaaS solutions
Applications on Demand - hosted IBM and non-IBM applications
- Blue Business Cloud - perhaps the successor to the current AOD offering
Blue Cloud - a compute on demand offering (still in development)

Weaknesses

As Larry Barrett noted, IBM doesn't appear to be aggressively pursuing the SaaS model. Sure, it has some initiatives going, but for the size of IBM those initiatives seem undersized.

Also, Jeff Nolan has pointed out that IBM lacks the business apps necessary to execute on an effective SaaS strategy.

Further reading:

Erick Schonfeld: IBM’s Blue Cloud is Web Computing By Another Name

SAP

Strategy

SAP CEO Henning Kagermann helped launch the major SAP SaaS initiative: Business ByDesign which is a hosted version of several of SAP's traditional heavy weight business applications. The intent was to target SMB, but due to problems in execution that strategy may be changing. It also plans to be a SaaS hybrid, with some on-premise software in the mix.

Nichloas Carr: SAP CEO calls SaaS "the better model"
Tony Hallett: SAP CEO on SaaS - a dirty word?

The bright spot for SAP and SaaS comes from its acquisition of Business Objects (BOBJ). BOBJ was already offering Crystal Reports at the time of the acquisition, and appears to be a healthy business.

Current SaaS Initiatives

SAP has three major initiatives:

Business by Design - a SaaS initiative to provide business applications to the SMB market
Crystal Reports on Demand - a collaboration solution for Crystal Reports
NSite Platform - a platform for building SaaS applications, acquired as a part of BOBJ

Weaknesses

By far the biggest perceived weakness with SAP is its failure to execute on its much publicized SaaS release (BBD). Critics point to the major delays (possibly 24 months) as a sign that SAP's applications are a poor fit for the SaaS model. Worse, SAP validated the concept to its customers but failed to deliver, providing key advantage to competitors like NetSuite.

Loraine Lawson: SAP’s SaaS Is Dead. Long Live SAP’s SaaS.

Dennis Howlett: SAP Business By Design likely to be delayed

Further reading:

Steve Hamm: SAP Gets On-Demand Religion

Intuit

Strategy

CEO Brad Smith isn't the most vocal about SaaS, but his company is doing the talking for him. Intuit is clearly pushing the SaaS model, with major product offerings already available. The strategy appears to be simple: offer online equivalents of their product suite:

Sramana Mitra: Intuit Is Not Getting SaaS Credit
Eric Lai: QuickBase success speeding Intuit's move to SaaS
Intuit on the SaaS March

Current SaaS Initiatives

Intuit offers the following products as SaaS offerings:

QuickBooks Online Edition - SaaS version of its accounting software
Quicken Online - hosted version of its personal finance application
QuickBase - a hosted spreadsheet application

It is an older product now finally gaining traction
Currently in plans to provide a QuickBase SaaS application dev platform

Weaknesses

I haven't seen any weaknesses other than stiff competition. The space Intuit plays in will become crowded, with Netsuite and Intacct already delivering SaaS, and Sage likely to become a contender as well.

Technorati Tags: saas,oracle,ibm,sap,intuit,microsoft

How to Survive the SaaS Revolution: Learning from the Death of DEC

2008-06-03T23:45:00.001-06:00

The story of Digital Equipment Corporation goes something like this: it rose to power in the 60's and 70's by being an industry leader in minicomputers, competing against IBM which was pushing larger mainframes. DEC was a powerhouse of innovation and grew impressively to become the number two hardware vendor. However, the 80's saw DEC struggle because it missed a fundamental shift in the industry - the rise of the personal computer. This struggle eventually led to its demise - in the 90's the company succumbed and was acquired.

Today, large software vendors are being faced with a revolution of their own - the rise of Software as a Service (SaaS). SaaS has the potential to be as disruptive to the software industry as the PC revolution was to the hardware industry in the 80's. I don't think SaaS will necessarily produce the exact same results with the software industry, but I do believe that it shows what could happen. It demonstrates that even giants can fall.

This blog entry focuses on a single article from the NYTimes in 1983 which shows an interesting snapshot of DEC in the midst of failing to adapt. This will lead to a larger lesson about what software companies need to do to avoid the same fate.

Note: the views in this blog are my own opinion, and do not represent the official position of my employer.

The Demise of DEC - a Failure to Adapt

I was not even in high school 25 years ago when the following story was published in the New York Times. Older members of the blogosphere have more context into what was going on, but I think the article provides a great glimpse of a computer giant a few years before its downfall. Some of the quotes are shocking in hindsight, as you can see the disaster unfolding in the words of the company president.

NYTimes Story: THE REPROGRAMMING OF DIGITAL

Author: Leslie Wayne

Published: September 4, 1983

Note: the bold text is mine, and the text in quotes is from the original article.

Setup for the downfall, the giant stumbles:

"Digital, one of the stars in the computer industry, has stumbled into tough times. After nearly two decades of almost 30 percent annual growth of sales and profits, Digital reported a 32 percent earnings drop, to $284 million, for its 1983 fiscal year, which ended July 2, the first such drop in 12 years."

because the giant is late to invest and deliver on the next industry revolution:

"Particularly troubling has been Digital's lateness in entering the explosive $5 billion personal computer market. The delay reflects the company's careful and methodical approach to doing business - an approach that some say is inappropriate in an industry where being first with new products is becoming increasingly important. Never before has Digital had to rush a new product to market and, given its size and slow planning cycle, it did not do so with its personal computer. This, critics say, has been a mistake."

while its former profit centers are eroded by the maturing industry:

"At the bottom end of the market, Digital is being squeezed by the growth of personal computers that can do much of what the larger minicomputers can do - and for a lot less. Thus, Digital must defend its position in the maturing minicomputer market with an aging product line, while making inroads into personal computers and office automation, markets where others have already established beachheads. It is uncertain whether the revenues to be gained in these new areas will offset declines in the old."

Decades of prior success may not help the giant:

"Digital gained a reputation as a sophisticated engineering company making high-quality products for scientific and technical uses and for such office functions as payroll accounting and data processing. (Mainframes, by contrast, are used for large, complex computations and huge information storage.)"

and may actually hurt because the same strategies don't play in the new market and it is blind to the danger:

"Mr. Olsen [Digital company president], who presided over the 10-day show, is far more optimistic about Digital's prospects. ''Things have never been better,'' he said in an interview at the crowded Digital show in Boston's Hynes Auditorium. ''I've never been as happy with our products as now, and even though there's been a slight drop in earnings, we've had no layoffs. I see no real problems with our business" ...

Moreover, he is not concerned about Digital's lateness in getting into personal computers. ''We're sticking with the same old strategy, even though it doesn't look too exciting,'' he said. ''We may be the last kids on the block, but we wait until we have a better product.''

Product development is not enough, the entire culture must adapt:

"Digital's difficulties are compounded further by the fact that its essential personality has been that of a company dominated by engineers who sold to engineers and let the technical razzle-dazzle of the machines do much of the selling. Unlike many companies, the Digital sales staff is on salary, not commissions, a practice that Mr. Olsen defends as bringing in higher yields per salesman."

Lessons to be Learned

Important take-aways from the article, all of which are pretty obvious but are important to list explicitly:

The Chief Executive must take the lead in proactively addressing the shift
- Revolutionary change must be supported by the top leader
- Denial is unacceptable: ''Things have never been better...''
Leadership must formulate and execute on a good strategy
- Hopefully something better than: "We're sticking with the same old strategy.."
Respond in a timely and effective manner, or risk being shut out of the new market
- "Digital's lateness in entering the explosive $5 billion personal computer market..."
Old revenue streams may decline
- "Digital is being squeezed by the growth of personal computers that can do much of what the larger minicomputers can do".
Internal cultural changes may be necessary
- "Unlike many companies, the Digital sales staff is on salary, not commissions"

Counter examples of DEC include these established companies, which all responded to the PC revolution during the same time period with better results:

IBM - jumped into the PC market with both feet and captured massive market share
Intel - saw the PC opportunity in 1983 and Andy Grove reinvented the company around it
Hewlett-Packard - launched itself into the PC market
Xerox - very successful at innovation in the PC market, though had problems monetizing

How Disruptive is SaaS?

In hindsight, we know that the PC shift was an enormous change in the way people interacted with computers, and a massive market opportunity for computer suppliers. Will SaaS be as disruptive to the software industry? Many believe so, as do I, but only time will tell. Instead of selling the vision, I will offer a number of links that will help you come to your own conclusion:

Phil Wainewright: Eight reasons SaaS will surge in 2008
Saugatuck: SaaScon presentation
eWeek: How Software as a Service May Reshape Enterprise Computing
Joe McKendrick: Calling all disruptors: the perfect storm of SOA, SaaS, and open source beckons
Joe McKendrick: Confronting the SaaS skeptics
McKinsey (Dubey, Mohiuddin, Baijal), : Emerging Platform Wars in Enterprise Software

But please understand that disruption does not mean on-premise software will go away. Just like mainframes still crank away in basements everywhere, on-premise software will not go away any time soon, if ever. Disruption in this case means that I believe SaaS will take a significant market share next to on-premise software. I will leave it to the analysts to predict the actual market sizes.

Looking at the Software Giants of Today

Remember that DEC was once the second largest computer company on the planet. By the late 90's, after years of struggle, what remained was acquired by Compaq. What does this mean for today's software giants:

Oracle
IBM
Microsoft
SAP
Intuit

Is it possible to determine if one of these giants is on the way to destruction? According to Bob Warfield's recent post, Salesforce Headed for Siebel’s Fate?, put all but IBM in the dead pool (IBM gets a free pass because they also have significant hardware and services businesses) . Bob states:

"All good things come to an end, especially for software companies. Very few live through a paradigm shift of any consequence."

Bob does great work, but I think this statement is far too pessimistic. Software vendors have been living through constant revolution - since the mid 90's we have seen major waves of change in the software industry:

Java
Internet
Free Open Source Software
SOA
Social computing
Dynamic languages
and now SaaS

Software companies have learned to adapt. For example, free open source was supposed to kill all software product businesses, but vendors are still seeing growth (e.g. Oracle DB revenue still growing). As for SaaS, each of the giants have initiatives underway. Some are having more success than others, but I think it is too early to draw any long range conclusions.

As an Oracle employee, I am happy to see that Larry has been heavily involved in the space (including personal investments in Salesforce and Netsuite), and that multiple initiatives are already being delivered with success. SAP has stumbled recently with delays in the Business By Design program, while IBM, Microsoft and Intuit seem to be making some progress.

Which of these giants will pull through, and which will fail? Check back here in 25 years for the definitive answer.

Technorati Tags: saas,cloud computing,ondemand

SaaS Soup: Navigating the "as a Service" Acronyms: CaaS, DaaS, DBaaS, PaaS, SaaS, XaaS

2008-05-29T04:08:00.001-06:00

Ever wonder what all the "aaS" acronyms mean? Do you want to understand how they relate to each other? This blog entry will help. I have created a map of many of the "as a Service" terms you will see in IT and have grouped them according to category. I have also provided an explanation and links for further reading for each so you can quickly come up to speed on all.
I put this together because I am working on the second edition of a visual map of the SaaS, PaaS, and Cloud Computing industries that I released last month. In order to make progress on that map, I found I needed to have a better understanding of all of the common categories in the "as a Service" market. The map in this blog entry has a different focus - instead of mapping out industry players I am mapping out industry terminology. Both maps complement each other.

Map of the "as a Service" Terms

This graphic shows the groupings of the "as a Service" terms that you may encounter in the IT industry. Click the map for a larger view.

Top Level IT Service Categories

This section lists the primary categories around computing as a service. These categories serve as the larger buckets into which we will place the finer grained "as a Service" terms.

HaaS

Hardware as a Service

What: HaaS refers to on demand offerings where hardware is the primary product being offered
Cloud Computing and Cloud Storage solutions are instances of HaaS
Almost all HaaS products will require some bit of software as well
Michael Vizard: Hardware As A Service Is Inevitable
James Governor: On Hardware As A Service, engines as services, and Real SOA

Humans as a Service

What: service offerings that primarily require humans beings to deliver (aka professional services)
Not an industry term, but necessary to properly categorize some of the "as a Service" offerings
OK, I don't mean prostitution wise guy

PaaS

Platform as a Service

What: hosted software that serves as a platform for building SaaS offerings
There are different types of PaaS products, and sometimes HaaS products are mistakenly called PaaS
Some PaaS products may be optionally deployed on HaaS products such as Amazon's EC2
Examples of PaaS: force.com, Bungee Connect, Google App Engine, Etelos, QuickBase, LongJump, Apprenda SaaSGrid

SaaS

Software as a Service

What: in its most generic form, any software offered remotely as a service. Since this definition includes the entire world wide web, there are generally agreed on criteria for SaaS products to narrow the scope:

Primarily business software
Usage based pricing (pay as you go) with no long term contracts
Delivered over the internet, primarily via a browser
Managed by the ISV that developed the application (as opposed to the former ASP model)

Wikipedia: SaaS
Alternate form: Microsoft has pushed the term "S+S", which is a SaaS solution paired with on-premise software

List of "as a Service" Terms

This section lists many terms you will find referring to a "as a Service" offering in the IT industry. They are organized by acronym - sometimes the same acronym may refer to multiple terms. For each term, a few links are provided for further reading.

BaaS:

Backup as a Service

Category: HaaS, a subtype of Storage as a Service
What: provides rem0te data backup for your systems; a specific type of Storage as a Service
Perimeter Security: Perimeter eSecurity Launches Remote Backup & Recovery (RBR) Service

CaaS:

Communications as a Service

Category: SaaS
What: non carrier-grade VOIP service offered by a third party
Wikipedia: Communication as a Service
Tom Keating: Gartner says Communications-as-a-Service (CaaS) Revenue Future Looks Bright
Andrew R. Hickey: Communications-as-a-Service taking hold

Compliance as a Service

Category: Humans as a Service
What: the idea (perhaps faulty) that a company can outsource their compliance monitoring to a third party
Mark Macauley : CaaS - Compliance as a Service
Ian Glazer: Why Compliance Cannot be Delivered as a Service

Content as a Service (aka Content On Demand)

Category: SaaS (note it may directly employ Storage as a Service for the actual storage of the docs)
What: offering a hosted content repository, including workflow, versioning, checkin/checkout

Crimeware as a Service

Category: SaaS anti-pattern
What: hosted services to help criminals attack computer systems
Panda Security: Crimeware as a Service (CaaS) Updated
Larry Dignan: The next big thing? Crimeware-as-a-service

Computing as a Service

Category: HaaS
What: aka Cloud Computing, providing computing resources, network, provisioning, etc as a service
Ephraim Schwartz: Verizon to offer CaaS, computing as a service, later this year

CRM as a Service

Category: SaaS
What: offering CRM in a SaaS model, as in Salesforce, Netsuite, RightNow, SugarOnDemand
Intuit Enhances QuickBase CRM-as-a-Service Entry
Nobody is using the acronym CRMaaS yet, but it is probably inevitable

DaaS:

Data as a Service

Category: SaaS
What: a hosted web service that provides access to aggregated data (stock market, salary, etc)
Jill Dyche: Data-as-a-service, explained and defined
Lars Leckie: DaaS - Data as a Service
Strikeiron: Data as a Service

Data Warehousing as a Service (or DWaaS)

Category: SaaS
What: a cloud based data analytics solution, just upload your data and the service will crunch it
The Register: And now it's time for Data Warehouses as a Service
Kognitio: Data Warehousing as a Service

Data Mining as a Service

A synonym of Data Warehousing as a Service
Jeff Kaplan: Data Mining as a Service: The Prediction is Not in the Box

Database as a Service (or DBaaS)

Category: HaaS, a subtype of Storage as a Service
What: offering a database (relational or not) as a hosted service, a subtype of Storage as a Service
Doug Henschen: Q&A With Gartner's Don Feinberg on Database as a Service and Cloud DBs
Steve Bobrowski: What Exactly Is Database as a Service?
Longjump: Database-as-a-Service (DaaS)

Development as a Service

Category: PaaS
What: a cloud based IDE, allowing developers to build applications with just a browser
SFDC: Salesforce.com To Offer DaaS Service, New Pricing Model, Competition

Desktop as a Service

Category: SaaS
What: providing virtual employee desktops via a remote host
IDC: DaaS Interview - Mike Rose, IDC Analyst
Desktone: Virtualization Meets DaaS - Desktop-as-a-Service
Saloob: Saloob, Inc., releases world's first on-demand DAAS Solution - Desktop As A Service Thin Clients.

Document Management as a Service

Synonym of Content as a Service
SpringCM: Document Management as a Service

EaaS:

Ethernet as a Service

Category: HaaS
What: a solution provided by network carriers to provide virtual ethernet capacity from a much larger line
SearchTelecom.com: Ethernet as a service (EaaS)

ERP as a Service (or ERPaaS)

Category: SaaS
What: offering ERP in a SaaS model
Michael Hickins: Workday Introduces ERP as a Service

Email as a Service

Category: SaaS
What: a hosted email service
Email As a Service: Much Bettter Than Hosting Email On YOUR Server
Andrew Conry-Murray: Voltage's E-mail Encryption as a Service

HaaS

Human Resources as a Service (HRaaS), Human Capital Management as a Service (HCMaaS)

These terms are not used yet, but probably coming soon to a Workday blog near you

IaaS

Information as a Service

A synonym to Data as a Service
Webinar: Implementing Information-As-A-Service: A Practical Approach
TechTarget: Oracle-Tangosol deal may lead to a new service-enabled data package
Guy Creese: Information as a Service

Infrastructure as a Service

A synonym to HaaS
Wikipedia: Infrastructure as a Service
Dan Farber: Infrastructure as a Service video

Integration as a Service

Category: SaaS
What: offering integration capabilities for SaaS applications
Dr. Dobb's: MuleOnDemand Integration-as-a-Service
Gartner: Cape Clear Updates ESB to Enable Integration as a Service

Identity as a Service

Category: SaaS, a subtype of Security as a Service
What: offering a centralized (remote) identity management service
Nishant Kaushik of Oracle: Defining Identity as a Service
Burton Group: Identity as a Service

MaaS

Malware as a Service

Category: SaaS anti-pattern
What: name for any SaaS solution which has been compromised with malware
Nicholas Carr: Malware as a service
Dan Morrill: Malware as a Service

Manufacturing as a Service

Category: None - not related to IT (included here only for reference)
What: providing small batch manufacturing services
Manufacturing as a Service (MaaS)

Mashups as a Service

Category: SaaS
What: enterprise mashups that are offered publicly
Joe Mckendrick: Can Mashups as a Service reach critical MaaS?

Media as a Service (as in: video, audio)

Category: SaaS, a subtype of Data as a Service
What: providing hosted access to audio/visual services
Chris Saad: MaaS - Media as a Service

QaaS

Queue as a Service

Category: SaaS, a subtype of Integration as a Service
What: provides a hosted message delivery service
Amazon: Amazon Simple Queue Service (Amazon SQS)

SaaS

Security as a Service

Category: SaaS
What: the delivery of security capabilities using a SaaS model
Wikipedia: Security as a Service

Storage as a Service

Category: HaaS
What: providing cloud based data storage capabilities
WhatIs: What is Storage as a Service
Amazon: Simple Storage Service (S3)

TaaS

Testing as a Service

Category: Humans as a Service
What: outsourcing the testing of software
TAAS Services

UaaS

UI as a Service

Category: PaaS, a subtype of Development as a Service
What: a rich hosted UI development environment
Salesforce: Visualforce is a UI as a Service

VaaS

Voice as a Service

A synonym for Communication as a Service
M5 Voice as a Service

Everything Else

Confused? Think all of these acronyms and terms are ridiculous? You aren't the first.
In recognition of the proliferation of "aaS" terms, umbrella terms have also appeared:

XaaS: What is xAAS?
Everything as a Service
Whatever as a Service
Something as a Service

Previous Acronym Round Ups:

This isn't the first attempt at rounding up all the XaaS variants. You can find previous attempts here:

Krissi Danielsson: Attack of the -aaS Acronyms, or a Quick Glossary of SaaS Cousins
Nick Carr: A little too much aaS

Technorati Tags: SaaS,PaaS,HaaS,Cloud Computing

Migration Complete: This is My New Blog

2008-05-22T03:38:00.001-06:00

Due to the Oracle acquisition of BEA, the BEA blogging site at dev2dev.bea.com will be merged into OTN sometime in the future. This necessitated a switch to a new blogging platform, and I chose Blogspot. This blog entry explains the process.

Blog Migration Process (MovableType to ???)

For other BEA bloggers about to go through the transition, here is the process you need to follow:

Decide where you are going to go: in a few weeks you can setup an OTN blog and that is not a bad option at all. I decided to go external for certain reasons, but it was a tough decision.
Install Microsoft LiveWriter if you run a Windows machine. Its a great blogging tool, and has migration features.
Point LiveWriter at your old blog if you haven't already. (Weblog->Add Weblog Account)
Point LiveWriter at your new blog. (Weblog->Add Weblog Account)
Click on the More icon on the Recently Posted box in the right nav.
Click on your old blog on the left side
Find a blog posting you want to move, click on it. It will open in the editor pane.
Click on the Weblog dropdown menu and select your new blog. It will reformat your entry to the new style.
Make whatever updates you want. I did

I put a blurb at the top of each entry to explain that the content was migrated from dev2dev
Copied over the comments into the bottom of the page (as static text)
Updated the internal links that pointed to other blog entries of mine on dev2dev

Update the "Set publish date" box in the lower right corner to match the original publishing date
Click the Publish item
Repeat for each entry you want to move.
Register your blog in the Oracle Blog Roll: http://wiki.oracle.com/page/List+of+Oracle-related+blogs

Moving to Blogger.com/Blogspot

I chose to go external, and it was a horse race between Wordpress and Blogger. Wordpress has automated migration, but Blogger has the key feature that I want: fine grained visitor stats. With Blogger, you can hook up Google Analytics, which is an awesome tool for understanding who visits your pages and how.

To do your own comparison, look at:

Blogger vs. Wordpress.com Comparison Chart

If you go with Blogger, this is what I did to get my blog setup as I like it:

Chose a template - I picked a plain one with a white background since that was what dev2dev had
Customized the template - I write big posts, so I expanded the main area by editing the HTML template
Edited my profile
Customized the layout - I added the widget for my Twitter feed on the right
Customized Settings - clicked through each of the settings tabs and made some non-default choices
Added Google Analytics - added a HTML widget at page bottom, and injected the GoogA Javascript block

Work Remaining

I need to finish the comment copying process.
I need to search and replace remaining dev2dev blog links
I want to ping some of my dev2dev inbound links to see if they will update to point to my new pages

Technorati Tags: blogger,wordpress,movabletype,migration

Twitter Microfeed Covering the SaaS/PaaS/Cloud Markets for those without a Cognitive Surplus

2008-05-08T02:36:00.000-06:00

Most of you have probably seen Clay Shirky's material on the great Cognitive Surplus - the free time that everyone wastes by watching TV. Awesome stuff, but if you are trying to keep up with all the activity in the SaaS, PaaS and Cloud industries by definition you have no Cognitive Surplus. We are in information overload. Subscribing to specific feeds or Google Alerts can help isolate the signal from the noise, but sometimes even that can be challenging. Let me propose a solution: I have created a microfeed for this space on Twitter. This blog discusses how you can subscribe to this feed and stay in touch with the news in a very lightweight way.

NOTE: this blog entry was originally posted May 8th, 2008 on my previous blogging system (dev2dev.bea.com).

Twitter and the 140 Character Budget

We had email, then we added instant messaging, and now we have Twitter. What is the trend here? Brevity. Stop with the 3 page emails and get to the point. Its all about time, and we don't have enough.

For those who haven't already taken the plunge into Twitter, let me explain its single most rewarding feature. It limits each message (tweet) to 140 characters. It forces brevity on the author, and this is a very good thing. Like telegrams of the past, authors need to choose their words (actually, characters) very carefully to get their point across in those precious 140.

For Twitter subscribers, this means you get messages that are short and to the point. What's not to love.

Twitter Microfeeds

Twitter began as a personal messaging platform. The message publishing box asks "What are you doing?" The intent is to keep your buddies apprised as to what you are doing throughout your day.

But the Twitter community being who they are have found creative uses for this messaging platform. Microfeeds (a term I prefer to Twitter Feeds), are one such use. The idea being that there is utility in getting short alerts on news throughout your day without being disruptive. This doesn't replace the full RSS scan you do when you have the time, but helps to keep you informed when you cannot spare time to do even that. Coupled with the option to receive your Twitter messages via SMS on your phone, it is also a way to stay informed even while you are out and about.

There are at least two ways to publish a Twitter microfeed:

Using an automated service like TwitterFeed to watch an RSS/ATOM feed and pump the first 140 characters of each entry to Twitter
Hand crafting the feed to fine tune each message

The former is the most timely and easiest, but can be very noisy if you are aggregating many feeds, and may not convey a lot of information in the message since it just grabs the title and maybe a few more characters from the entry. A handcrafted approach assures the readers that they are getting quality messages.

Introducing the SaaS/PaaS/Cloud Microfeed

That was all very abstract. What is important to know is that I have created a handcrafted microfeed for S/P/C and encourage you to try it. I plan to be very selective in posting the following types of information in the space:

Major deals, acquisitions
Product launches
Call for Papers for upcoming conferences
Notice of upcoming events, like webinars
Insightful blog posts

For an SLA, I will attempt to stay under 20 messages per week, with a target load of 2-3 per day. But as we go along, please give me feedback as to content and quantity.

As a sample, here is the feed as it currently stands right now:

Boothby: Joyent video collage of interviews at Web2.0Expo "what is cloud computing" . Tim O'Reilly, others. http://tinyurl.com/5ngh6d about 3 hours ago from web

Wainewright: Taleo acquires Vurv, joins SaaS revenue all stars SFDC, Omniture, Concur http://blogs.zdnet.com/SAAS/ 08:38 PM May 06, 2008 from web

IBM: Call for Papers for IBM's "Info On Demand" conference (Oct. 26-31), http://tinyurl.com/4fljg5 08:49 AM May 06, 2008 from web

MySQL: offering webinar May 15, "Multi-Tenant Architectures with MySQL Enterprise for SaaS Providers". Register: http://tinyurl.com/4pwk4r 08:34 AM May 06, 2008 from web

Craig Balding: NPR (radio) featured him and Cloud Computing for 3.5 minute segment. To listen, see: http://tinyurl.com/4amvdx 02:14 PM May 05, 2008 from web

Mosso: (Rackspace's cloud division) launches Storage-aaService CloudFS private beta, $0.15 per gigabyte http://tinyurl.com/48h4ql 02:06 PM May 05, 2008 from web

Bungee: revise 4/30 tweet - Pg/MySQL anncment is not a hosting offering, support is for connectivity only. See: http://tinyurl.com/5yfnnd 01:41 PM May 05, 2008 from web

Kaplan: THINKStrategies supporting SaaS industry study, call for SaaS providers with rev $10M-250M http://tinyurl.com/578c5b 01:36 PM May 05, 2008 from web

Willis: provides a listing of cloud solutions predating the Laird SaaSMap. "Cloud Vendors A to Z" http://tinyurl.com/67fcau 01:33 PM May 05, 2008 from web

Druker: financial SaaS provider Intacct raises another $15M to help battle Netsuite. Total funding so far $29M http://tinyurl.com/6qvpl3 10:08 AM May 03, 2008 from web

Laird,Dickson: created a visual SaaS/Cloud/PaaS industry map, showing the major focus areas and players. http://tinyurl.com/45ejjj 09:49 AM May 03, 2008 from web

Wainewright: MSFT to try MSOffice stream ondemand (not in cloud) with license change. See also EndeavoursTech. http://tinyurl.com/4qj9nv 09:42 AM May 03, 2008 from web

Wainewright: SAP disaster - delays SaaS 12-18 months after validating market. Gift to Netsuite, Twinfield, CODA. http://tinyurl.com/49rtfs 09:34 AM May 03, 2008 from web

Subscribing to the ondemand Microfeed

The Twitter account being used for this microfeed is:

ondemand

For those already on Twitter, just follow that account and be sure to enable device updates for it. For new users, follow these instructions:

Create a Twitter account, using whatever name you like
Skip the email search wizard
Search for the "ondemand" user using the search box
Click the Follow button

To subscribe your phone to get an SMS message whenever a new post appears, do the following:

Click Settings in the upper right
Click Devices
Enter your phone number, and be sure to check the box to approve SMS
Click the Home link at the top of the page.
Click on the Following link on the right hand side of the page
Click the on button for device updates for ondemand

Twitter Clients

There are many ways to stay on top of this Twitter microfeed. I am optimizing for readability on SMS but really any client will do.

The traditional Twitter website user interface
Enable device updates for the ondemand account, and you will receive SMS messages
Thwirl - a powerful desktop client
Facebook integration

Technorati Tags: saas,paas,cloud,cloudcomputing,twitter,microfeed

Understanding the Cloud Computing/SaaS/PaaS markets: a Map of the Players in the Industry

2008-05-02T01:37:00.001-06:00

The Cloud Computing/SaaS/PaaS space is loaded with interesting vendors, and the space is booming. If you are trying to navigate this world and need a guide, this blog entry will help. We have assembled a visual map of the industry, showing how the major players fit into the overall space. It will give you an overview of who's who, and what types of solutions are being offered.

NOTE: a newer version of this map is now available. Click here to navigate to the most recent research.

I was greatly assisted by Kent Dickson, VP of Product Management for SaaS at BEA, in building this map. Steve Bobrowski, Director of SaaS Evangelism, also contributed comments. Thanks to both!

Defining the Markets

Before we look at the map, we need to define the major areas that we are covering. Note that in many ways these markets overlap so trying to differentiate which solution is in which is not a meaningful exercise. Needless to say, drawing out the map is a subjective effort, and not all solutions fit neatly into their assigned bucket. The purpose of the visual map is not to address subtleties, but to draw the industry in general terms.

Cloud Computing

Cloud computing refers to the virtualization of the data center, such that server machines are not thought of individually but as just a commodity in a greater collection of server machines. Cloud computing solutions in general strive to eliminate the need for an application deployer to be aware of the actual physical machines that are used to host the application. Some have called this idea “hardware as a service”.

Solutions that are most closely associated with the Cloud Computing market are indicated with the icon on the map.

Software as a Service (SaaS)

An application that is delivered through the SaaS model typically is done so:

Over the internet,
Remotely by a third party, with little/no opportunity to bring that application in-house
With a usage-based pricing model

Solutions that are most closely associated with the SaaS market are indicated with the icon on the map.

Platform as a Service (PaaS)

When a vendor offers a Platform as a Service, they are offering an integrated platform to build, test, and deploy custom applications. The PaaS is offered to you in a SaaS model (remote, usage-based). Dion Hinchliffe recently published a comprehensive whitepaper on this topic.

The PaaS market is indicated with the icon in the map view.

Core Cloud Services

After defining the 3 markets, there remains a set of solutions that contribute to all as fundamental building blocks. In other words, these solutions address cross cutting concerns.

In the map they are marked with a distinct icon to set them apart.

The Visual Map

Below is the visual map as promised. You will find a larger version hosted here. An explanation of each category and a full clickable URL list of the solutions is offered below the map.

If you wish to make changes, the original mind map drawing file assets are located here. Please post comments with your thoughts, or use this map as a basis for your own vision of the industry. Please give credit back to the original source (see Creative Commons) if you do.

Defining the Solution Groupings

In the map, we grouped solutions according to the problems they aim to solve. This section details the intent of each category.

Please note that for every category, there are more vendors that could be included. We are not attempting to provide a comprehensive list of every player in the industry. THINKStrategies created the SaaS Showplace if that is what you are looking for.

This map only shows solutions that are both 1) available in some form today, and 2) have significant mindshare in the industry. Feedback is appreciated if you disagree with any solution that was included or excluded.

Left Side

Cloud Providers - vendors who provide server hardware in commodity form, as a virtualized cloud

Cloud Deployment - solutions surrounding the deployment of applications to a virtualized cloud

Virtual Appliances - packaging and virtualization format solutions for provisioning applications into a cloud

Topology Management - solutions focused on the coordination of many virtual appliances (app, DB, network) in the cloud to form a full deployment

Billing, Contract Management - solutions that provide metering, billing, pricing, and contract management to help charge for use of a system

Security - solutions focused on solving security requirements in these markets

Data - services that deliver/retain data for applications

Hosters 2.0 - Hosting Service Providers with SaaS focus. Perhaps a controversial grouping and impossible to define, these hosters tend to appear over and over in these markets

Nerd Stuff - geeky topics fall into this category. MapReduce is mechanism for solving large computing tasks, like Google Search indexing

Right Side

On Demand Apps - the heart of the SaaS market, only a few depicted here but we could add "...and a cast of thousands". These are the end application products offered for consumption in a SaaS model

Integration as a Service - service solutions that help in integrating multiple systems, possibly multiple SaaS systems

Content as a Service - hosted content repositories

BPM and Workflow - service based offerings for managing workflow and process

Platform as a Service - incarnations of the PaaS concept

Reference Solutions List (with clickable links)

Cloud Computing,
SaaS, and PaaS
Industries
2008

Cloud Providers
On Demand Apps
- ~ Oracle On Demand Apps
- ~ Salesforce SFA
- ~ Netsuite ERP
- Google Apps
Integration as a Service
Content as a Service
BPM and Workflow
- ~ ProcessMaker
- BPM as a Service
Platform as a Service
(PaaS)
Cloud Deployment
- Virtual Appliances
  - Packaging
    - ~ rPath
    - ~ CohesiveFT
  - Formats
  - ~ BEA Weblogic Server VE
- Topology Management
  - ~ 3Tera AppLogic
  - ~ Elastra Cloud Server
Billing, Contract Mgmt
Security
- ~ OpenID
- ~ OAuth
- Security as a Service
  - ~ Ping Identity
Data
- Storage as a Service
- Database as a Service
Hosters 2.0
Nerd Stuff
- ~ MapReduce
  - ~ Apache Hadoop
  - ~ Google MapReduce

Technorati Tags: saas,cloud,paas,virtualization

Comments from the original blog:

Very useful chart. You've misspelled Itensil (not Intensil)in the BPM as a service node -- the website link works though, so don't change that. I'd argue that Itensil is really a PaaS product with pre-built workflow, and invite your readers to have a look and let me know if you agree.

Posted by: kpatterson on May 16, 2008 at 12:34 PM

FYI - I will be working on an updated map shortly. The feedback is still rolling in. thanks for all the email/comments.

Google - yes, they are listed as a PaaS with their new App Engine offering

MorpheXchange.com - thanks for the note, just published an entry on them on my Cloud/PaaS/SaaS microfeed

And thanks to OpSource for the mention today of the map in their monthly newsletter.

Posted by: plaird on May 14, 2008 at 1:24 PM

Very interesting article. Just two questions -- Did Google recently add an offering to the cloud computing space ? Is a company called mediamax.com involved in the storage-as-a -service category ?

Posted by: hsr0508 on May 14, 2008 at 11:22 AM

I'm a bit cautious of messing with the wiki list Peter but may I also point you to MorpheXchange.com as one of the emergent PaaS players particularly incorporating open source technologies to guard against the lock in fear. Incidentally, the platform has opened itself to Java after debuting Rails. Check them out. Best. alain

Posted by: friarminor on May 13, 2008 at 9:34 AM

Peter Thanks for the feedback, much appreciated. Looking forward for your comment on my post:)

Posted by: natishalom on May 6, 2008 at 8:03 PM

Nati - thanks for the comment, this is what I am looking for. Responses:

Rightscale, MySQL, Coherence, GigaSpaces, etc: maybe not all of those, but I also have been getting emails offline, and will need to make a v1.1 of the map to include a handful of corrections/omissions. The feedback is still coming in, so will wait a little while. I don't want the map to turn into a 1000 node monster, so I want to be very selective. Jeff Kaplan's SaaS Showplace is the comprehensive source backing all of this.

Oracle SaaS Platform: this was a late addition, and upon further reflection not exactly right. I now see the Platform bucket broken into two, with PaaS (minus ORCL). Then with a new bucket perhaps containing on-prem platform software that is "SaaS ready". Still noodling on this though.

Your blog: thanks for the link, I wasn't following your feed, now I am. I would agree in general about lock-in, not totally on board will all of your conclusions. I am deciding whether to add a comment to your blog, write a response blog entry, or succumb to laziness and just let it be. :)

Cheers - PJL

Posted by: plaird on May 6, 2008 at 10:23 AM

Interesting review. It captures many of the players in this emerging space.
I think that your missing some important platforms such as RightScale.
I also wanted to point out that one of the main problems with Platform as a Service that are mentioned is the fact that offer radically proprietary solution. In your list there are few that i rarely heard of in that context such as Oracle SaaS platform..
I recently wrote a post describing other platform choice that can help building SaaS applications in a way that could be easily ported to any cloud environment. It support also existing Java/Spring and .Net frameworks. In this way you don't have to switch entirely to completely different proprietary framework to leverage the value of cloud based environment.
The post is available here:
Google App Engine - what about existing applications?
You can also view Dave Rosenberg post that points to other frameworks on that regard Sun's OpenSolaris on EC2--overcast but not completely Cloudy
On the data services side i think that your missing few important and common services that are used by many of the applications running on cloud today such as MySQL, and other data-caching services such as Oracle-Coherence, GigaSpaces, Terracotta, Memcache etc. Some of which integrates with SimpleDB thus providing in-memory front end for better performance and reliability. (See example here SimpleDB such as the one with SimpleDB)

Posted by: natishalom on May 6, 2008 at 4:51 AM

Hi Jim - good questions.

A lot of parallels are drawn between the ASPs of the 90's and the SaaS providers of today. One of the key differentiators is that SaaS does not require the tenant to make a large upfront payment like they did in the ASP/outsourced model. SaaS is offered with usage based pricing - e.g. you pay $50 per user per month. There are other differentiators, but that is key.

As for the zero customization solutions being very limited, I think you are right. Per-tenant customizations are critical for the enterprise, be it UI, data model, business process, etc. I think all SaaS vendors are working on solving this, and some have solutions today.

I posted a list of SaaS podcasts which offer a much more in-depth response to your questions. I found them very helpful in explaining what is happening in the industry.

Thanks for the comment! PJL

Posted by: plaird on May 5, 2008 at 10:30 AM

This topic is getting a ton of exposure right now, I just finished the Wired article on Amazon's EC2 http://www.wired.com/techbiz/it/magazine/16-05/mf_amazon I have a number of questions on this topic, I'll start with Isn't this simply Outsourcing 2.0? IBM,AmDocs,etc... host infrastructure for many of our customers, you happen to know the hardware, os, and IP of the machine it is running on, change it to a cloud of resources (virtualize and absract it), and change the pricing model...Voila outsourcing 2.0. SaaS gives you more than outsourcing, but SaaS to me is not going anywhere fast, and is only riding the buzz of cloud computing. Cookie-cutter (no customization) solutions offering no diversity from the competition who are all using the same service. I see value in the space, but I have the feeling this is more hype than real value.

Posted by: jcalise on May 3, 2008 at 10:14 PM

Great article Peter, I now have a much better idea of the space. Did not realize was that many players involved. Thanks for sharing this data! Cheers, --alex

Posted by: atoussai on May 3, 2008 at 7:59 PM

Excellent break down of the space, and a great reference to use going forward.

Posted by: jcalise on May 2, 2008 at 10:45 AM

Mining Twitter for the Enterprise: Survey your Customers' Candid Thoughts using a Social Web 2.0 Service

2008-04-27T02:30:00.000-06:00

One BEA customer recently posted on Twitter: "hating weblogic". Another said: "F@#% you weblogic for not handling HTTP 500 errors properly."

Whether you personally participate in one of the numerous internet social platforms or not, some of your customers are out there. WebLogic isn't the only brand being discussed - name the brand and there are customers voicing their opinions on these platforms.

This blog entry focuses on Twitter, and shows how you can mine Twitter for feedback on your brand using a tool called TweetScan. Because of the very informal nature of Twitter, and it's low barrier to participate, it is a good channel of candid opinions on your brand. Companies like Comcast have already used TweetScan to identify and remedy customer relationship problems in a highly proactive manner. How is your brand perceived on Twitter?

NOTE: this blog entry was originally posted April 27th, 2008 on my previous blogging system (dev2dev.bea.com).

What is Twitter?

Twitter is a service that allows you to publicly post messages in small doses - 140 characters or less. The basic idea is to answer the question What are you doing? but you can use those 140 characters to say whatever you want.

While blogs are a great source of public opinion, they tend to be more filtered because they require more effort to produce. Twitter lowers the barrier to post dramatically, and therefore is a better medium for capturing those minor annoyances and random thoughts we all have throughout our day. There is also less of a imperative to post something interesting - your readers only need to invest the time to read 140 characters and not paragraphs of a blog entry.

Me and Twitter

I am a reluctant poster to Twitter. Do people really care that I just ate dinner or that I am about to watch a movie? Not really, apparently, as I don't have too many followers. Granted, I haven't been at it that long, but is this time well spent?

Is participating in Twitter worth your time?

I really don't know, and certainly am not an expert. But I suspect it depends on how you view Twitter specifically, or the other social platforms in general. Are you using it to get something done, improve your social life, for pure entertainment, or what.

Sarah Perez talks through the issue in her blog Real People Don't Have Time for Social Media, and an e-consultancy article "Social media's inconvenient truth" expands on it.

"But there's an inconvenient truth that proponents of these sites tend to ignore - the average person just doesn't have the ability to participate fully in social media."

TweetScan - Improving the Signal to Noise Ratio for Observers

The silver lining is you don't have to participate to acquire great value from these social computing tools. Lots of people are using Twitter as a medium for publishing their unfiltered thoughts. As simply an observer, you can use these platforms to great advantage. But how?

A problem that cannot be ignored is the amount of noise on these platforms. While Twitter is a wealth of information on customers' opinions and comments, much of this is chaff - "sitting on toilet listening to lily Allen". But buried within the mountain of irrelevance are some nuggets of useful information - "Angry at BEA. Why doesn't WebLogic play nice in OSGi?".

With just plain old Twitter, its impossible to separate the crud from the gold. TweetScan is the solution - it is a search engine built on top of Twitter to help you find the diamonds in the rough, especially when you are focused on a searchable keyword like your product brand.

Monitoring your Customer's View of your Brand

Savvy marketing and customer relationship people have started to take advantage of TweetScan to help manage their PR and to capture raw customer data. Michael Arrington's adventure with Comcast is the most famous.

Michael Arrington was having trouble with his Comcast internet account. Calls to their service center didn't provide a relief, and so he fired off some Twitter posts in anger. Being who he is, others picked up on this and triggered a fire storm of net activity. Then something wonderful happened:

"And this brings me to the point of this post. Within 20 minutes of my first Twitter message I got a call from a Comcast executive in Philadelphia who wanted to know how he could help. He said he monitors Twitter and blogs to get an understanding of what people are saying about Comcast, and so he saw the discussion break out around my messages."

As far as PR and customer relationships go, this is a fantastic show of force by Comcast. But not everyone who posts to Twitter is a famous net personality like Michael. It is fair to assume that Comcast cannot afford to provide the same level of response to the average joes out there. At least one on one. Instead, Comcast can monitor the Twitter channel and detect general patterns in service problems. Michael sums up how this can benefit Comcast (and its customers):

"Well before most people they have identified blogs, and particularly Twitter, as an excellent early warning system to flag possible brand implosions."

A few more references to using Twitter like this:

Blip.TV - Blip.TV used TweetScan to eavesdrop on its customers and detected and resolved a service problem using this approach.
Using Twitter as a Research Tool - Krishna De talks about using Twitter derived information for research.

WebLogic on TweetScan

The brand I care about is WebLogic. As an architect on WebLogic Portal, I am heavily invested in this brand. Up until now, the primary way we received feedback on the product have been these channels:

Monitoring the WebLogic newsgroups
Customer support cases
Direct interactions with customers

All of these have been effective, but it is interesting to see how TweetScan can provide a new channel for feedback. Here are some selected entries in the current search for "weblogic" on TweetScan, with a focus on the negative posts:

We see negative comments on the newsgroups. But these Twitter posts are far more unfiltered and more of the flavor "how do you feel about weblogic", as opposed to the newsgroups/support cases which are "what is not working for you with weblogic". Now, most Twitter posts by definition don't have nearly enough information to really understand the underlying issue. But you get a flavor of what your customers are feeling, and you can always follow up for clarification by asking the user to clarify offline.

And to be clear, this list is fairly typical of ANY brand you search on. Pick a brand, and do the search, and you find a litany of complaints and negative comments. This is normal. Check your pride at the door before searching on your brand. Twitter posts on brands usually err on the side of being flames, not praises.

Technorati Tags: Twitter,TwitterScan,PublicRelations,Web2.0,SocialComputing

Comments from original blog:

Jott - looks useful. Notice they have a "custom service" capability where you can give it a server URL to HTTP POST the messages to, instead of predefined endpoint like Twitter. I love open systems.

Posted by: plaird on April 30, 2008 at 10:39 AM

Excellent post, Peter, on an important topic.

As people become increasingly frustrated with voice mail systems and email auto-responders when trying to report problems to companies, tools like blogs and Twitter will become the means by which honked-off customers express their frustrations. That trend will grow, and with it the need for companies to get proactive, pay attention, and track these sites and services in order to manage customer satisfaction and public relations.

BTW: In conjunction with Twitter, I also use Jott, a free service that transcribes voice messages to text, and pushes those messages out to my Twitter account, or to one of my blogs, or directly to an email to a contact -- all based on how I configure the service. Cool stuff: I just dial the Jott number, use voice commands to select the message destination, then recite my message. Unless there's a lot of background noise, the transcription is pretty good, and it's a lot easier and faster (for me, anyway) than trying to type a Twitter post on a tiny cellphone keypad.

Posted by: brhubart on April 29, 2008 at 1:38 PM

Someone asked offline what my twitter handle is so they can follow me:

Follow: plaird

Posted by: plaird on April 28, 2008 at 8:41 AM

Dennis,

Thanks for posting your experience. Sorry I missed you in my google search for similar stories. You illustrate the point exactly.

I renewed my searching and I found a couple more links on the topic:
Posted by: plaird on April 27, 2008 at 9:48 PM

I am no Michael Arington - by any stretch of the imagination. I'm just a guy. Last week I had a similar experience with twitter based support from SlideShare. The best thing is I sent out just 1 twitter message in frustration and within 10 minutes, 2 employees of SlideShare contacted me via twitter to give me the low down on the problem I was having. I blogged the story under How Twitter-Enabled Customer Support Saved the Day. I was completely blown away and felt much more special than my individual status really warranted. Extremly powerful use of technology. Dennis Stevenson blogs.ittoolbox.com/cio/origina-thinking

Posted by: denthewise on April 27, 2008 at 8:52 PM

SaaS Podcast Links and Notes - Key Insights into the World of SaaS, Platform as a Service (PAAS), On Demand

2008-04-24T02:26:00.000-06:00

About two months ago I had 14 hours to spend alone in a car - I was meeting some friends out in Telluride and decided to drive it from my home near Boulder Colorado. Fortunately, I prepared myself. I stocked up on a collection of tech podcasts and made productive use of the time as I rolled through the beautiful mountains. Because I am the architect for BEA's SaaS Platform (code name Genesis), a fair number of the podcasts were focused on SaaS. This blog entry recaps the key insights from some of those SaaS podcasts. Links are provided to the original audio.

NOTE: this blog entry was originally posted April 24th, 2008 on my previous blogging system (dev2dev.bea.com).

SaaS at BEA

For those that know me as an architect on WebLogic Portal, this blog entry may seem odd. What does SaaS have to do with WLP, or even BEA?

The answer is I took on responsibility for the BEA SaaS Platform architecture a few months back and have been hard at work defining that (and not blogging, if you notice the gap in posts). The idea at BEA is to provide a platform for building SaaS applications that includes features like metering and billing, multi-tenancy, and cloud provisioning.

If you pay attention to the space, you will notice that 2008 appears to be the year of Platform as a Service (PAAS). Perhaps I will explain what is going on with that in a future blog entry. This post is focused on podcasts. For those of you are interested in learning about SaaS, I have provided links to podcasts that I found very helpful in understanding the business of SaaS.

The Podcasts

Here is the collection of podcasts that I would recommend.

Podcast Title	SaaS is Mainstream
Podcast Participants	Jeff Kaplan (THINKStrategies), Paul Gillin
Podcast Series	SaaSAdvantage Series, SaaSCon
Podcast Link	SaaSAdvantage #1

Podcast Notes:

Compliance/security issues were expected to prevent the adoption of SaaS, but are actually helping.
SaaS vendors are savvy on compliance, and implement it as well/better than IT can.
SaaS vendors have been certified on compliance standards such as SAS-70.

Further Reading:

How the Rise of SaaS Relates to SOX, SAS 70 and Your Legal Contracts - Amanda Finch

Podcast Title	Living in a SaaS World
Podcast Participants	Mitchell Ashley, Jeff Kaplan
Podcast Series	Converging on Microsoft, NetworkWorld
Podcast Link	SaaS Podcast

Podcast Notes:

SaaS and IT
- SaaS growing faster than Gartner thinks, because Gartner just interviews IT.
- A fair amount of SaaS is sponsored directly by the business, outside of IT.
- However, more SaaS solutions are now targeting IT instead of trying to work around IT
Microsoft SaaS Strategy
- They are very cautious, so much to lose
- Microsoft Live solution is an experiment
- They can’t alienate their all important VAR sales channel
Channel sales and Offering SaaS products
- Role of the sales channel changes
- Historically have helped to implement complexity
- SaaS removes complexity
- Channel partners must evolve into advisors, not just implementors
Business buyers of SaaS are trying to figure out the sourcing model for apps
- Outsourcing is changing from major deals (outsourcing entire IT dept) to focused SaaS deals
- “Outtasking” more appropriate name for this

Further Reading:

SaaS IT Management - Michael Cote

Podcast Title	What is Saas (Part II)
Podcast Participants	Jeff Kaplan
Podcast Series	WhatIs.com
Podcast Link	WhatIs Podcast

Podcast Notes:

Industry is ready for SaaS
- Cost conscious, especially now with possible recession in the US
- Outsourcing of IT functions is now a proven model
- Internet bandwidth is in place to support this (to the office, home)
- 75% of IT budget locked in maintenance, not a successful model
- TCO is proven to be lower with SaaS
How ISVs need to adapt when selling a SaaS solution:
- Technology – must adopt web application model for delivering product
- Revenue model – subscription model requires longer time to receive revenue
- Must continually invest in the relationship – not a one time sale
- Lower switching costs mean more competitive market

Further Reading:

Suddenly SaaS is a CIO's Best Friend - John Soat
Why IT Now Sees SaaS as a Savior - Jeff Kaplan

Podcast Title	Lecayla Session
Podcast Participants	Conor Halpin, Jeff Kaplan
Podcast Series	Spotlight on SaaS, THINKStrategies
Podcast Link	Lecayla Podcast

Podcast Notes:

Per user pricing is the obvious, but is not a totally effective billing model
- Easy to turn into a compete-on-price model with competitors
  - If the other guy charges $20 less per user, it's too easy for the customer to focus on that.
- All users are not equal, some will use the system every day, some twice a year
- Key is to bill based on added value – transactional events
- One of Lecayla’s tenants offers a hybrid model to their customers
  - User based for frequent users
  - Transaction based for infrequent users
Vendors with existing perpetual license products are afraid of cannibalization
- Can avoid by pricing based on type of usage as well as transactional
- Example: BI vendors make a ton of money off of end of quarter financial roll ups
  - Low transaction volume, but high value transactions and very time sensitive
  - Priced out of low end markets that are high transaction volume, low value per transaction
  - Can continue on-premise model for former, SaaS for the latter
- Enforce through contract

Further Reading:

Properly Pricing Software-as-a-Service Within an Established Product Portfolio - THINKStrategies

Podcast Title	Understanding SaaS Architecture
Podcast Participants	Gianpaolo Carraro, Fred Chong (MSFT), Paul Gillin
Podcast Series	SaaSAdvantage Series, SaaSCon
Podcast Link	SaasAdvantage Podcast #8

Podcast Notes:

SaaS barrier: Loss of control
- Lack of workarounds if the software doesn’t provide what you need
  - Cannot just query the DB
- Ops and SLAs are in the hands of the SaaS vendor
- Internet connections aren’t as reliable as LAN
SLA issues
- Outages
- Data security
- Termination terms – how to extract the data
- Compliance issues
- Response times, backups

Further Reading:

Microsoft Whitepaper: SaaS an Enterprise Perspective

Podcast Title	Understanding SaaS Architecture
Podcast Participants	Colleen Smith (Progress Software), Dana Gardner
Podcast Series	Briefings Direct (Interarbor)
Podcast Link	Progress Podcast

Podcast Notes:

Business Implications of SAAS Software
- Cash flow
- Down market opportunities (long tail)
- SMB opportunities
ASP vs. SAAS
- ASP was all about hosting
- ASPs did not manage application
- No multi-tenancy with ASPs
- ASPs had no application expertise
Why time is right for SaaS
- Cost of computing is low – web browser is the distribution
- Long tail is reachable – new Geos, adjacent markets, low end
- Computing clouds
Business Service Providers
- Combination of SOA and SAAS
- BSP provides an end to end service
- Vertically focused

Podcast Title	Software as a Service and IBM
Podcast Participants	Dave Mitchell (IBM), Scott Laningham
Podcast Series	IBM developerWorks
Podcast Link	Mitchell Podcast

Podcast Notes:

What is SaaS?
- SAAS is all about transfer of risk to the ISV
- SAAS implies a subscription model/pay as you go
- SAAS is served remotely, with little/no option to bring back in house
What is ASP?
- Software is purchased up front by the customer, not a subscription
- Hosted remotely, but can be brought back in house
Ajax/RIA is enabling more applications to become SaaS
- SaaS requires a web application
- RIA/Ajax allows more applications to become viable as web applications

Technorati Tags: saas,ondemand,paas,billing,metering,IT,podcast

WebLogic Portal: Exposing Portlets (JSR 168, WSRP, JSF, Struts, etc) as Enterprise Google Gadgets

2008-04-23T02:19:00.000-06:00

Wondering how to expose Google Gadgets from WebLogic Portal? As promised, this is the second entry in a two part series talking about Google Gadgets. The first entry explained how to build a simple gadget. Now we will explore how to surface a Java portlet as a gadget using WebLogic Portal. Exposing a Google Gadget from any WLP portlet type (JSR 168, WSRP, JSP, Pageflow, JSF, Web Clip, etc) requires no coding - just a simple XML configuration file. This blog entry will show you exactly how to do it.

NOTE: this blog entry was originally posted April 23rd, 2008 on my previous blogging system (dev2dev.bea.com).

History of the Integration

As I mentioned in the first posting we have been doing demos of WLP portlets as Google Gadgets for a long time - since the second half of 2006 with our WLP 9.2 release. This was all possible because of a feature introduced in that release called Portlet Publishing. Portlet Publishing allows any WLP hosted portlet to be exposed as a URL. If you understand the basics of Google Gadgets, you can hopefully see how this feature can be used to turn any portlet into a gadget simply by referencing that portlet's URL in the gadget descriptor.

Early demos used a servlet to dynamically generate the appropriate Google Gadget descriptor on the fly. We even experimented with clever hacks to enable Single Sign On between iGoogle and WLP. We worked with the Google Gadget engineering team to explore ideas in this area.

But in the end we decided not to productize the integration. This is due in large part because authoring the Google Gadget descriptor for a portlet is quite easy, and therefore an official feature wouldn't add tremendous value. Additionally, we were concerned about the supportability of such a feature, for example what would happen if the descriptor format changed. Also, the explorations around authentication were not enterprise quality approaches, and so not something we wanted to promote.

Therefore, at this time WLP does not offer a "Generate Google Gadget..." option in the IDE, or provide any other specific feature. However, as this blog entry will show, using the FULLY supported feature of Portlet Publishing, you can expose your portlets as gadgets with NO CODING required.

Portlet Publishing

Before we can talk about generating a Google Gadget, we need to take a look at Portlet Publishing. Once again, this feature exposes any WLP hosted portlet as a URL - an HTTP addressable end-point. The power of this feature is that any thing that can consume an HTTP end-point (e.g., an IFrame within any webpage) can be host to a WLP portlet. It is important to note that Portlet Publishing works for all WLP portlet types, like JSR 168, WSRP, JSF, Struts, Web Clipper, etc.

This means that with a single deployment of your portlet on WLP, it can be used over the following channels simultaneously:

Directly embedded in a standard WLP portal/desktop
Directly embedded in any JSP hosted on the WLP server (see the portalFacet JSP tag)
Federated to external WSRP consumers (WSRP is a web services standard for consuming remote portlets)
Federated to any consumer of HTTP, notably browsers via IFrames and XmlHttpRequests (which means ANY website on the planet)

In WLP 9.2 and WLP 10, Portlet Publishing was limited to the library instances of portlets. This meant user preferences were not supported through the HTTP channel. However, with WLP 10.2, Portlet Publishing has been augmented to allow for Desktop Instances (and thus user preferences) to be exposed over the HTTP channel. Consult the documentation for more details on this point.

To consume portlets published over the HTTP channel in any web page, you can inject the portlet into the HTML using one of these techniques:

An inline frame (iframe) that points to the URL to the portlet
DOM Injection - using simple JavaScript that WLP provides, you can dynamically inject the portlet into the page using Ajax (XmlHttpRequest)

Once again, consult the documentation for more details on these points.

Exposing your WLP Portlet as a Google Gadget

You have hopefully read my previous blog entry on how to build a simple Google Gadget. This section builds on that knowledge. Essentially, we will author a Google Gadget descriptor that points at a WLP portlet exposed over HTTP (via Portlet Publishing).

To make this entry as simple as possible, we will use the library definition form of the Portlet Publishing URL. For example, assume you have a portlet that is exposed at this URL:

http://wlp.bea.com/dvt/portlets/wlp/stackWLP.portlet

If you are unfamiliar with WLP, the .portlet file is a file based XML document that describes a portlet's meta data. In this case, it has been deployed in the portlets/wlp directory of the dvt webapp. When directly addressed, Portlet Publishing kicks in and serves up the portlet implementation associated with this .portlet file (this is the library definition approach to publishing).

You can now easily author a gadget descriptor that targets that URL, and thus exposes that portlet as a Google Gadget:

<?xml version="1.0" encoding="UTF-8" ?>

<ModulePrefs

title="WLP Portlet Gadget"

height="120"

author="Peter Laird"

</Module>

Copy this gadget descriptor to a public web server, and then add this gadget to your iGoogle portal as I showed in my previous post. And Presto!

The Fine Print

Some details to think about:

Titlebars: WLP will by default render a titlebar to the portlet, and so will iGoogle. To avoid nested titlebars, use the "light" decoration option with Portlet Publishing desktop portlet instances.

Authentication: if you have a cookie based web SSO solution in place, your users will automatically be logged into the WLP server even when the user navigates to iGoogle (by virtue of how iframes work). In other circumstances, you will need to provide a login screen within the portlet.

Add to Google button: it is often nice to have an "Add to Google" button on the portlet. This is easily done by just copying the URL pattern seen on other sites that provide such a button. You will essentially need to embed the URL to your gadget descriptor into the button link.

Preferences: you will need to decide what to do with preferences. WLP manages preferences on the server side. If your portlet is exposed over multiple channels, stick with that. However, if the portlet will ONLY be consumed as a Google Gadget, you may consider using the Google provided preference service.

JavaScript Libraries: Google provides a number of JavaScript libraries for Gadget developers. When developing a portlet that will only be exposed as a gadget, feel free to use these. However, if the portlet will be exposed over multiple channels (like on a WLP desktop), be aware that none of the Google libraries have been certified within WLP.

References

WLP Portlet Publishing documentation - an amazingly powerful feature, allows WLP portlets to surface just about anywhere. Available since WLP 9.2.
Google Gadget Developer documentation - excellent documentation covering gadgets in much greater depth than I have done here
Google Gadget Ventures - get funding to develop your enterprise gadget
Enterprise Gadget Handbook - Jonathan Sapir of LimitNone produced an extensive document discussing the merits of enterprise gadgets
WLP Demo Server - running WLP server

Technorati Tags: gadgets,google,weblogic,portal,portlets,168,wsrp,JSF,Java,enterprise2.0

Introduction to Google Gadgets

2008-04-22T02:17:00.000-06:00

We have been showing how to expose WebLogic Portal portlets as Google Gadgets for almost two years now. Embarrassingly enough, we haven't written any blogs or articles on HOW to do it. We have answered email questions about it, but nothing public. This two part blog series will correct that omission. You will hopefully see that it is really quite simple to do. This first entry will talk about building a generic Google Gadget (without WLP), and then the following entry will show how to convert any WLP portlet into a gadget.

NOTE: this blog entry was originally posted April 22nd, 2008 on my previous blogging system (dev2dev.bea.com).

What are Google Gadgets, and iGoogle, please?

Google Gadgets are web based widgets/portlets/[insert your favorite web component term here] that are based on technology provided by Google specifically to make federating gadgets easy. To see gadgets in action, the best place to try them out is on the iGoogle portal.

Gadgets can really do anything. This example shows an eBay integrated gadget that allows a user to interact with their eBay account within the gadget:

The technology provided by Google can be lumped into these buckets

An xml file format for describing a gadget (called the descriptor)
A gadget preferences model - for storing user specific preferences for a gadget external to the gadget implementation
Various JavaScript libraries for doing useful things
An online directory of pre-built gadgets
iGoogle - the reference platform for users to use gadgets
Google Gadgets for your Webpage - a JavaScript mechanism for including a gadget on ANY web page

Several things are notably missing from what Google provides with regard to gadgets

Gadget hosting - aside from a few official Google gadgets, all the gadgets are hosted independently by their creators
Gadget validation - treat every gadget with suspicion; even though it is flying the colors of a well known brand it may be hosted by a guy in a basement.
Authentication - there is no provided mechanism for gadgets to inherit authentication from the consuming page, notably no single sign on with iGoogle

Finally, note that there is another gadget technology offered by Google called Desktop Gadgets. There gadgets are targeted toward Google Desktop, and aren't related to the gadgets we are discussing.

The Google Gadget Phenomenon - why should you even care?

Google Gadgets and iGoogle were the fastest growing product offered by Google in 2006 and had strong growth again in 2007

“The star performer for [2007] was Google’s personalized start page service iGoogle which increased traffic in the 12 months to November by 267.64%.” (TechCrunch)

Useful Gadgets get heavily used:

“The Google gadget ecosystem received 960 million pageviews last week” (Niall Kennedy)

These metrics are largely based on use of gadgets and iGoogle in the consumer space. But consider how your enterprise can benefit from deploying Google Gadgets:

A new channel to your customers within iGoogle
Offered as a widget to your customers to place on their own web pages
A new channel to your partners/employees within iGoogle

Building a Simple Google Gadget - as easy as falling off a bike?

This section discusses the express route to building a gadget. Steps to build:

Create a gadget implementation, which is nothing more than an HTML document served from a public web server.
Create a gadget XML descriptor, that refers to the gadget implementation.
Add the gadget to iGoogle.

Step 1: Create the Gadget Implementation

Save this HTML into a file on a public web server.

<html>

<body>

Hello World.

</body>

</html>

Step 2: Create the Gadget Descriptor

Save this XML into a file on a public web server (I have also hosted one publicly here for now: http://wlp.bea.com/blogs/simplestGadget.xml). You will need to update the href included in the body to the URL to your HTML document created by step 1.

<?xml version="1.0" encoding="UTF-8" ?>

<ModulePrefs

title="Simplest Gadget"

directory_title="Simplest Gadget"

title_url="http://wlp.bea.com"

description="Very very simple gadget."

height="120"

author="Peter Laird"

</Module>

Step 3: Add the gadget to iGoogle

Login to iGoogle, and then click the Add Stuff link, and then Add Feed or Gadget link. Provide the URL to the XML document created in step 2.

Step 4: Enjoy!

Next Steps

In the next blog post, I will show how to expose any WLP portlet as a Google Gadget. Stay tuned!

References

I only covered a small part of the Google Gadget technology. Their developer documentation is excellent, so please refer to it for more details:

Google Gadget Developer Documentation
Building Dynamic Google Gadgets in Java - a slide deck I have used to present Google Gadgets to Java developers

Technorati Tags: weblogicportal,googlegadgets

Deploying the ALBPM Workspace into WebLogic Portal

2007-12-17T01:13:00.000-07:00

Customers that purchase both WebLogic Portal (WLP) and AquaLogic Business Process Management (ALBPM) will certainly want them to work together. Specifically, customers want to be able to deploy the ALBPM Workspace user interface as portlets on a WLP portal. This blog explains how to do that, and provides a script to help automate the most tedious steps.

NOTE: this blog entry was originally posted December 17th, 2007 on my previous blogging system (dev2dev.bea.com).

Use Case

The ALBPM Workspace contains a total of 4 portlets. By default, they deploy in their own pre-built web application. But if you have both ALBPM and WLP in your environment, it would be useful to be able to deploy the portlets into WLP.

The four portlets are:

Actions Menu: lists the operations the user can perform, like create a new process
Views Menu: lists the various views available, like process inbox and bookmarks
Worklist: displays the list as directed by the Views menu, like the list of active processes
Instance Detail: shows the details of a specific process

A view of the completed Workspace on WLP:

Integration Implementation

Behind the scenes, there are some challenges to this project. First, when the user authenticates with WLP, they shouldn't have to also sign into ALBPM. Fortunately, ALBPM implemented an SSO mechanism in ALBPM 6.0. This can be enabled via a couple of checkboxes during the configuration of ALBPM (more on this later).

Second, the portlets and all supporting file based artifacts need to be brought into the WLP Web Project. While most of this is straightforward, it is an error prone operation. Also, merging in the necessary web.xml entries for the ALBPM workspace into the stock WLP web.xml is tricky. A simple error can create headaches. This part screams for an automated solution.

To make this integration as easy as possible, I have created a distribution that contains movies and an Ant script. The movies will to help guide you through the process. The Ant script removes a lot of tedious steps from the process.

Note: while this integration guide and script are deemed reliable, they are not officially supported. The official documentation is the supported source of information on this integration.

ALBPM 6.0 Workspace for WLP 10

There is official documentation to explain how to integrate the products. But sometimes seeing the integration is the best teacher. Therefore, the distribution that I have created includes a series of movies. Additionally, it contains an overview presentation on the process of integrating the products. Finally, the actual deployment of the ALBPM Workspace onto WLP is scripted via an Ant script that I provide.

I have hosted the files of the distribution in this location:

ALBPM 6.0 Workspace for WLP 10 Download Center

Note: to view the Flash FLV movies you will need an FLV player, such as the free FLVPlayer

ALBPM_for_WLP_slides.zip and ALBPM_for_WLP_slides_movie.zip

Start with these. One zip contains the Powerpoint presentation, the other contains a movie of me talking through the slides. This deck explains what the integration is all about, and the high level steps needed to perform the integration.

ALBPM_for_WLP_movie1.zip, ALBPM_for_WLP_movie2.zip, ALBPM_for_WLP_movie3.zip

These zip files contain detailed walk throughs of various parts of the integration. View these movies in order, and use the Pause button so you can follow along while you perform the integration on your machine.

ALBPM_for_WLP_script.zip

This zip contains the Ant script and associated files that will automate the ALBPM Workspace deployment into WLP. This script does a ton of file copying and also includes some new files (.portlets) to make this a smooth process. While you can do all of this by hand, the script gets the job done quickly and correctly.

Acknowledgements

I didn't complete this project by myself. The ALBPM Development and QA teams (Eduardo, Nico, Mariana, Alex, Mariano, and others) did a lot of work on sorting out the process to get the products integrated. Additionally, some folks from BEA Professional Services (Paddy in particular) helped get this going. THANKS!

Additional Resources

Need more information? Here are some good links to get you started:

WLP Download - download WebLogic Portal (minimum version 10.0)
ALBPM Download - download AquaLogic BPM (minimum version 6.0 MP1)
ALBPM for WLP Official Documentation - official docs for integrating the products
Alex Toussaint's Blog - ALBPM product manager's blog
Jesper Joergensen's Blog - ALBPM product marketing blog
Josh Lannin's Blog - WLP products manager's blog, check out the 5 part WLP futures series

Technorati Tags: weblogicportal,albpm

Comments from the original blog:

Hi Praveen -

Yes, something with the Apache config is doing strange things with that. We just did a lot of Apache work to speed up the WLP demos, and I am nervous to touch it to sort out the issue. I have found that Firefox, not IE, should be able to download the files fine. Can you try that?

PJL

Posted by: plaird on May 5, 2008 at 11:16 AM

Peter, thanks a lot. It seems like a very useful information but I am not able to download using the hyperlinks. Can you pls help me in getting these? my emailID: awasthypr@saic.com Thanks again!!

Posted by: praveenawasthy on May 5, 2008 at 2:15 AM

ALBPM 6.0 MP2 Update

I produced the script and movies against ALBPM 6.0 MP1. However, I tested against 6.0 MP2 with success (with one caveat).

The only issue is that there are some JSPs in the ALBPM MP2 workspace that cause the Workshop IDE (WLW) to report build failures (about 45). You will need to disable JSP validation for the WLP web project to get around this.

Project Properties->Validation->uncheck the JSP validator

I have updated the presentation to include this GOTCHA, and will also work with the ALBPM team to discover the root cause.

Thank you Neville for reporting the issue.

PJL

Posted by: plaird on January 8, 2008 at 9:31 AM

Kunai -

Sorry about that, I was using an 3rd party file share to host the files. I have rehosted the files on our WLP demo server at wlp.bea.com. I updated the link in the blog too.

Thanks for the note!

Posted by: plaird on January 3, 2008 at 11:35 AM

Peter, I'm about to get started on deploying ALBPM Workspace on WLP and I would've loved to have downloaded your slides, movies on the subject. However, it appears that the hyperlinks for these downloads have been disabled. Is there any other way we can exchange this information? Please feel free to send an email at "kunal.r.shah@citi.com" Regards, Kunal R Shah

Posted by: kunalrshah on January 3, 2008 at 11:07 AM

AquaLogic Commerce Services 5.1 for BEA Workshop 9.2

2007-10-18T02:10:00.000-06:00

BEA released AquaLogic Commerce Services this year to help BEA customers with their commerce initatives. ALCS is a product that offers a storefront and comprehensive merchandising capabilities out of the box. If you need to build a commerce solution for your business, ALCS makes it quick and easy. This blog entry describes a supplemental distribution that allows BEA Workshop developers to get up and running easily on ALCS.

NOTE: this blog entry was originally posted October 18th, 2007 on my previous blogging system (dev2dev.bea.com).

NOTE: as of 2009, the ALCS product has been discontinued.

AquaLogic Commerce Services

This blog entry will not focus on the ALCS product itself, but if you have not seen it here is a quick overview. It is a full solution for developing commerce projects for the enterprise. ALCS provides a fully customizable commerce solution that offers many features for both developers and merchandisers.

Features at a Glance

Complete storefront delivered in the box - a powerful web shopping experience
Merchant Tools - catalog management, promotion management, analytics
CSR Tools - order management, fulfillment
SEO - world class SEO capabilities to drive customers to your door step
Ajax one page checkout - fast track your customers through the checkout process
Developer friendly - productive development experience based on Velocity and Spring MVC technologies
Extensibility - highly customizable and extensible architecture offers complete control over the solution
SOA foundation - features exposed via web services, and integrated into the BEA SOA story
Scalability - built on enterprise Java technology, ALCS can scale to meet the demands of the largest commerce projects

For more detailed information on the features in the product, please check out the product information page.

Introducing ALCS 5.1 for WLW 9.2

One of the benefits of ALCS for BEA customers is that it deploys to WebLogic Server and integrates with WebLogic Portal. It fits in with the products that you already know and love. This makes deployment consistent with other projects you have deployed on the WebLogic stack.

However, for the ALCS 5.1 release the development environment out of the box is not aligned with the BEA Workshop IDE. This will get sorted out for the next release of ALCS. Until then, I have created a supplemental solution for ALCS 5.1 that allows for easy integration with BEA Workshop 9.2.

Called ALCS 5.1 for WLW 9.2, the supplemental download has the following features:

Script target to reprovision the ALCS sample application into the Workshop project structure (aka WTP)
Script target to reskin the sample store from "Snap it Up" to "Avitek Digital" (credit to Dan Tortorici!)
Script target to add in prominent disclaimer/promotion announcements to the store

The download available on dev2dev CodeShare includes ample instructions and a presentation that provides more context.

DOWNLOAD ALCS 5.1 for WLW 9.2

Additional Resources

To get started with ALCS, also consult the following documentation:

ALCS Product Documentation: top level link to the ALCS technical documentation
Developers Guide: a comprehensive developers guide
ACLS 5.1 Download: link to download a free evaluation of ALCS
ALCS Marketing Center: materials to help convince your boss to use ALCS
Wendy Bales' blog: great thoughts from the ALCS product manager

Technorati Tags: WebLogic,AquaLogic Commerce,ALCS,Workshop

WebLogic Security: Configuring the Database Authentication Providers (SQL, Custom, DBMS)

2007-09-25T02:05:00.000-06:00

I have gotten a lot of WebLogic security related questions offline as a result of my last blog post. A couple of people have asked for more details behind the WebLogic SQL Authenticator (a database authentication provider) that I mentioned. This blog entry will give deep background into your options when it comes to authenticating users from a database repository. I will finish by explaining how to configure the SQL Authenticator.

NOTE: this blog entry was originally posted September 25th, 2007 on my previous blogging system (dev2dev.bea.com).

First, a bit of terminology. When looking in the WebLogic Server documentation for a database authentication provider you will find at least a few names:

We all love choice, but what's up with all these names? Are they all the same thing, or does WLS provide multiple provider implementations?

In short, WebLogic does provide multiple database authentication provider implementations. This blog entry will sort out specifically what providers are available to you when authenticating from a database. We will look inside the WebLogic providers to understand what features are supported by which provider. After we have that covered, I will describe how to configure a SQL Authenticator provider in the WLS Console and how to provision the database.

Peter's Best Practice: Use a Database Backed Authentication Provider!

Before we dive into the details, I want to take a moment to congratulate you on reading more about this topic. I have worked at BEA many years, and I have been involved in many customer production escalations. When it comes to Authentication repositories, my experience tells me that you are safest performance-wise with a database backed authentication store. While customers have certainly been successful with other types of authentication repositories, if you want to minimize risk the database approach trumps all others. A database backed repository has few moving parts, and the query necessary to authenticate a user is a simple SELECT. So if you want my opinion, I say go with a database when you have the option.

The Official Flavors of WebLogic Database Authentication Providers

Back to the topic at hand - what are the WebLogic database authentication providers? The official documentation source, edocs.bea.com, will get us started. The docs explain what is provided for you:

Weblogic Security Providers

A set of Database Management System (DBMS) authentication providers that access user, password, group, and group membership information stored in databases for authentication purposes. Optionally, WebLogic Server can be used to manage the user, password, group, and group membership information. The DBMS Authentication providers are the upgrade path from the RDBMS security realm. The following DBMS Authentication providers are available:

SQL Authentication provider - A manageable authentication provider that supports the listing and editing of user, password, group, and group membership information.
Read-only SQL Authentication provider - An authentication provider that supports authentication of users in a database and the listing of the contents of the database through the WebLogic Server Administration Console. The authentication provider requires a specific set of SQL statements so it might not meet all customer needs.
Custom DBMS Authentication provider - A run-time authentication provider that only supports authentication. This provider require customer-written code that handles querying the database to obtain authentication information.This authentication provider is a flexible alternative that allows customer to adapt a DBMS Authentication provider to meet their special database needs.

The documentation is reflected by the WebLogic Console, which provides the following dropdown of authentication providers to choose from. Notice that the three database authentication provider types appear.

While the above descriptions provide some information about the difference between these providers, we can do better. Because you are a developer, you probably want the inside story. Today is your lucky day!

Inside the WebLogic Database Authentication Providers

To get the inside story let's head straight for the source - the authentication provider configuration files. You will find them here:

BEA_HOME/WL_HOME/server/lib/mbeantypes/cssWlSecurityProviders.jar

If you open up this JAR, you will find 4 files of interest: DBMSAuthenticator.xml, CustomDBMSAuthenticator.xml, ReadOnlySQLAuthenticator.xml, and SQLAuthenticator.xml. Three of those map directly to the official authentication provider implementations, so those are obviously their configuration files. The fourth, DBMSAuthenticator - what is that? If you look into the XML files, you find that DBMSAuthenticator is the base class for the rest of the providers. By looking at the Extends attribute on the MBeanType element, you can derive the class hieararchy of the providers, shown below.

Now that you understand how the providers are related, how do you know which one you want? WLS/CSS authentication providers have two components - the JAAS code that actually performs the authentication at runtime, and then a set of management "mbeans" that the provider chooses to implement. Every management feature that a provider can support is surfaced as an mbean interface. The key to understanding what a provider can do for you is to look at the mbean interfaces that it implements. Each interface is optional, meaning a provider may choose what features it can support.

Here is the list of mbeans for authentication providers which provide the manageability around users and groups:

SSPI MBean Quick Reference

GroupReader Read data about groups.
GroupMemberLister List a group's members.
MemberGroupLister List the groups containing a user or a group.
UserReader Read data about users.
UserPasswordEditor Change a user's password.
GroupEditor Create a group. If the group already exists, an exception is thrown.
GroupRemover Remove groups.
UserEditor Create, edit and remove users.
UserRemover Remove users.

Mapping out our providers into a table and the mbeans they implement shows the vast difference in manageability. You will want to select a provider based on your requirements for managing users and groups from WLS.

Using the CustomDBMSAuthenticator

This provider is obviously not for use in situations when manageability from WLS is important. It offers no management support. What it does offer is a lowest common denominator approach to integrating a database user repository. Employ this provider when you need to surface just authentication capabilities to WLS, and nothing else. You simply need to implement a plugin that answers the most basic of questions.

CustomDBMSAuthenticatorPlugin Javadoc - explains what needs to be implemented
Sample CustomDBMSAuthenticator provider - the MedRecDBMSPlugin from the MedRec sample (found in your install at BEA_HOME/WL_HOME/samples/server/medrec/src/security/com/bea/medrec/security)

Configuring the SQL Authenticator

You are more likely to be using the Read-only SQL Authentication provider or the most powerful SQL Authentication provider. These providers give you manageability from the WLS Console (and WLP Console if using WLP). They are easy to instantiate - the UI surfaces the options you need to configure. I won't go into all the options, but it is important to see that you can change the SQL for each operation if you have a custom schema. The SQL for these providers is designed to be modified to allow you to retrofit a custom database schema. But you can also use the default schema if you are provisioning a brand new user repository (see below for the schema).

After configuring the provider, any deltas versus the defaults will be persisted into config.xml. You can see below, I updated the Datasource of course (this is required) but I also made an arbitrary change to the Create Group SQL. See how it wrote the update into config.xml.

<sec:authentication-provider xsi:type="wls:sql-authenticatorType">
  <sec:control-flag>
    SUFFICIENT
  </sec:control-flag>
  <wls:enable-group-membership-lookup-hierarchy-caching>
    false
  </wls:enable-group-membership-lookup-hierarchy-caching>
  <wls:data-source-name>
    p13nDataSource
  </wls:data-source-name>
  <wls:sql-create-group>
    INSERT INTO GROUPS VALUES ( 'arbitrary change' , ? )
  </wls:sql-create-group>
</sec:authentication-provider>

The Default Schema DDL for the SQL Authenticator

You can define whatever schema you want to store users and groups when using the SQL Authenticators. But if you are starting fresh, why not just use the default schema and the default settings on the provider. I would highly recommend this approach.

It doesn't look like we officially document the default database schema so let me show you what it is. I list the Oracle DDL below, but you can find the official DDL for your database vendor in the following location in the WLS 10 install (and a similar location for other versions):

BEA_HOME/wlserver_10.0/common/p13n/db/DB_VENDOR/p13n9_create_tables.sql

CREATE TABLE USERS (
    U_NAME VARCHAR(200) NOT NULL,
    U_PASSWORD VARCHAR(50) NOT NULL,
    U_DESCRIPTION VARCHAR(1000))
;
ALTER TABLE USERS
   ADD CONSTRAINT PK_USERS
   PRIMARY KEY (U_NAME)
;
CREATE TABLE GROUPS (
    G_NAME VARCHAR(200) NOT NULL,
    G_DESCRIPTION VARCHAR(1000) NULL)
;
ALTER TABLE GROUPS
   ADD CONSTRAINT PK_GROUPS
   PRIMARY KEY (G_NAME)
;
CREATE TABLE GROUPMEMBERS (
    G_NAME VARCHAR(200) NOT NULL,
    G_MEMBER VARCHAR(200) NOT NULL)
;
ALTER TABLE GROUPMEMBERS
   ADD CONSTRAINT PK_GROUPMEMS
   PRIMARY KEY (
      G_NAME, 
      G_MEMBER
   )
;
ALTER TABLE GROUPMEMBERS
   ADD CONSTRAINT FK1_GROUPMEMBERS
   FOREIGN KEY ( G_NAME )
   REFERENCES GROUPS (G_NAME)
   ON DELETE CASCADE
;

A Few Details for WebLogic Portal Customers

This thread got started because I was discussing in my last blog how WLP 9.2+ by default uses the WebLogic SQL Authenticator. You can, of course, add more authentication providers and remove the SQL Authenticator if you like. When installing WLP, the installer (or you can use the createdb script) will lay down the default SQL Authenticator schema into the WLP schema. Therefore, by default, WLP uses just a single schema for both authentication and Portal operations. This is the most convenient option, but you can change this by switching out the configured datasource.

More Information

For further reading, I suggest these links:

Security Fundamentals - official WebLogic security primer

WebLogic Server SSPI - the CSS security architecture

SSPI Provider Samples - reading aboout the SSPI is good, but coding is even better. Try building your own ATN provider.

Foundations of WLP Security - official doc about how WLP integrates into WLS Security

Implementing SSO with the WLS SSPI - my dev2dev blog on SSO with Identity Asserters

JAAS Fundamantals - a dev2dev article by Bill Kemp and Rich Helton

Technorati Tags: J2EE,WebLogic,Security,Authentication,SQLAuthenticator

Comments from the original blog:

Great article! I was able to successfully help my client configure one for their needs. Thanks again.

Posted by: sghattu on November 11, 2007 at 6:57 PM

I just got a question offline that I will record here - the developer was having trouble creating an Ant build script for building a custom Atn provider.

My answer:

When building providers, I have always used the Sample SSPI download from dev2dev CodeShare. It contains a working build script so all of this is taken care of for you.

SSPI Code Sample

Posted by: plaird on October 19, 2007 at 10:21 AM

Hi Peter, Interesting post but I would like to get more details on your SQLAuthenticator console configuration screenshot. Could you provide me more details on the DataSource name you use. I'm running into troubles with that part! I've tried to provide a configured JDBC data source name but this does not work as the DS is not yet initialized when the security is initialized (not able to start the console anymore). I've tried to provide a Data Source Factory name also without any success!! (Can start the console, but error in the log saying: Connection Pool not usable) Any idea? I'm using Oracle 10g thin jdbc driver and WebLogic server 9.2 Thanks in advance Daniel

Posted by: ni2corp on September 25, 2007 at 11:43 PM

Discussion on WebLogic Security: Authentication Providers, Internal LDAP, JAAS, WebLogic Portal, Profile

2007-09-22T01:55:00.000-06:00

This blog entry comes from an email thread I had with a fellow BEA colleague. We traded a number of emails - he asked a lot of great questions about how WebLogic Portal (WLP) supports various security features. Since WLP relies heavily on WebLogic Server for those features, my answers apply to WebLogic in general and not just Portal. I am posting the email thread here because I think that this discussion might be of interest to others.

NOTE: this blog entry was originally posted September 22nd, 2007 on my previous blogging system (dev2dev.bea.com).

Before I show the thread, I should provide a glossary of abbreviations and concepts:

WLS: WebLogic Server, the J2EE application server that most people associate with the name "WebLogic"
WLP: WebLogic Portal, the J2EE portal product built on top of WLS
CSS: in this context, not cascading style sheets. Common Security Service is the componentized security package that WLS uses for security.
SSPI: the pluggable security subsystem provided by CSS to WLS
ATN: authentication, which refers to the process of verifying who a user is (with a password perhaps)
ATZ: authorization, which refers to the process of deciding whether the authenticated user has the privilege to perform a certain action
UUP: a WLP feature that aggregates profile information for a user from a variety of backend sources using a plugin architecture
Internal LDAP: an LDAP repository embedded in CSS historically used for some default SSPI providers

Discussion Thread

From: Colleague

Quick follow-up to our discussion in the hall at BEAWorld, you said that WLP wants to stop using the internal LDAP server altogether and use the database instead. I forgot, though, did you say that had already happened in a previous release, or is that slated for the next release?

From: PJL

Yes and no.

For ATN, WLP does not use internal LDAP. WLP switched to the WLS/CSS provided SQLAuthenticator in WLP 9.2. This does not mean that customers must use it, it is merely the default. A customer may choose to toss the SQL ATN provider and plug in an LDAP, Active Directory, etc. provider instead.

Here is the WLS doc reference to SQL Authenticator: Configuring RDBMS Authentication Providers

As for ATZ (WLP entitlements and delegated administration), we rely on the default ATZ provider from WLS, which in turn uses the internal LDAP store. Currently, we are tightly bound to the default ATZ provider for various reasons, and so WLP therefore has a hard dependency on internal LDAP. This is not ideal, and so WLP wants to eliminate the internal LDAP dependency.

The forthcoming solution to this problem is for WLS to support a database as the backend store for the default ATZ provider. They should have this in the next WLS version (but no promises folks!), and so we will pick it up in a future release beyond Flatirons (the next WLP release).

From: Colleague

Right, makes sense. A couple more questions:

Can customers configure more than one ATN provider, e.g. extranet users in SQL and employees in Active Directory, is that a supported WLP configuration?

Do documents stored in WLP's virtual content repository (VCR) use the default ATZ provider as well?

Where does the Unified User Profile (UUP) fit into this picture?

From: PJL

>> Can customers configure more than one ATN provider, e.g. extranet users in SQL and employees in AD, is that a supported WLP configuration?
Yes, and you can do logic like AND and OR via the JAAS control flags (this is WLS/CSS doing that, not WLP).

>> Do documents stored in WLP's virtual content repository (VCR) use the default ATZ provider as well?
Yes, Entitlements defined on VCR documents are stored in the default ATZ provider. The documents and metadata themselves are in the WLP database if the BEA Repo is being used, or in third party systems like Documentum or Sharepoint.

>> Where does the Unified User Profile (UUP) fit into this picture?
Profile is the third leg to this: ATN, ATZ, and Profile. For WLP, all three are independent, and linked together just by username. So ATN could come from Active Directory, whereas profile can be aggregated from, for example, a mainframe, LDAP, and Siebel via UUP. WLP passes the UUP plugins the username that was authenticated, and then each plugin is responsible for retrieving the correct profile info.

From: Colleague

One piece I'm still a bit fuzzy on is how groups fit into this whole picture, I've been reading this section on edocs:

Adding and Managing Groups (WLP docs)

It sounds like WLP periodically syncs group info from the providers into some local store, which I'm guessing is the default RDBMS. Is that correct?

From: PJL

Good question.

Actually WLP doesn't really maintain its own group mapping. The ATN providers provided by WLS are responsible for doing that. We do some caching of the group tree because it can be expensive to build, so that is what those docs are talking about. But we don't write that in-memory cached tree out to the database or file system.

To see how an ATN provider is involved in group membership, look at how the SQL Authenticator gets configured as an example:

SQL Authenticator Configuration help

You can see that it has methods for managing group relationships. How this happens at runtime is a deeper dive into the WLS/CSS SSPI ...

WLS/CSS authentication providers have two components - the JAAS code that actually performs the authentication, and then a set of "mbeans" that the provider chooses to implement. Most of the mbeans are optional to implement. Here is the list for ATN providers which provide the manageability around users and groups:

SSPI MBean Quick Reference

GroupEditor Create a group. If the group already exists, an exception is thrown.
GroupMemberLister List a group's members.
GroupReader Read data about groups.
GroupRemover Remove groups.
MemberGroupLister List the groups containing a user or a group.
UserEditor Create, edit and remove users.
UserPasswordEditor Change a user's password.
UserReader Read data about users.
UserRemover Remove users.

So WLP uses methods from the GroupReader and GroupMemberListers mbeans on the ATN provider to have access to group membership. The SQL Authenticator implements the GroupReader and GroupMemberLister mbeans by using those SQL queries. The LDAP ATN provider GroupReader and GroupMemberLister mbeans derives Group structure from the directory structure.

That's a little abstract - it sometimes helps to see the code. Here is the javadoc for GroupReader and GroupMemberLister java interfaces that the ATN providers implement:

So WLP is not really managing it's own group repository, it's the ATN Providers that are storing that information. A little complicated, I know.

From: Colleague

So does the LDAP ATN provider support the GroupEditor as well? That is, can you write group membership changes back into external LDAP repositories?

From: PJL

The LDAP ATN provider that WLS/CSS provides is read only. You can see what mbeans it implements by looking here:

Navigate to BEA-HOME\wlserver_10.0\server\lib\mbeantypes
Open cssWlSecurityProviders.jar
Find the .xml file that is associated with the provider you care about, in this case LDAPAuthenticator.xml
In that xml file, you will see the mbean interfaces that it implements listed:

<MBeanType

 Name          = "LDAPAuthenticator"

 DisplayName   = "LDAPAuthenticator"

 Package       = 
   "weblogic.security.providers.authentication"

 Extends       = 
   "weblogic.security.providers.authentication.LoginExceptionPropagator"

 Implements    = 
   "weblogic.management.utils.LDAPServer,
    weblogic.management.security.authentication.UserReader,
    weblogic.management.security.authentication.GroupReader,
    weblogic.management.security.authentication.GroupMemberLister,
    weblogic.management.security.authentication.MemberGroupLister,
    weblogic.management.security.authentication.UserPasswordEditor,
    weblogic.management.security.authentication.GroupMembershipHierarchyCache"

 PersistPolicy = "OnUpdate"
>

Since it does not include GroupEditor or UserEditor, you can infer that it is a read-only provider (aside from password). If you are a WLP customer, another way to see which mbeans are implemented for each ATN provider is through the Portal Administrator tool (PAT). Because the PAT disables certain user/group management functions in the tool depending on what mbeans are implemented on the selected provider, the PAT provides UI to show which mbeans are implemented. See the image below:

From: Colleague

Also, is there any way to create a group that includes members from more than one provider, e.g. "John" from the DB and "Bob" from LDAP? Or do you need to use roles for that scenario?

From: PJL

Yes, group membership is aggregated from the collection of installer providers. Multiple providers can contribute membership associations to a single group. Or how about this question: can "Bob" be authenticated by the SQL ATN provider, and put into the "Human Resources" group via the LDAP provider? I believe this does work.

More information...

I would encourage you to use these resources to learn more about WebLogic Security:

Security Fundamentals - official WebLogic security primer

WebLogic Server SSPI - the CSS security architecture

SSPI Provider Samples - reading aboout the SSPI is good, but coding is even better. Try building your own ATN provider.

Foundations of WLP Security - official doc about how WLP integrates into WLS Security

Implementing SSO with the WLS SSPI - my dev2dev blog on SSO with Identity Asserters

JAAS Fundamantals - a dev2dev article by Bill Kemp and Rich Helton

Bastion - a blog devoted to WebLogic Security

Technorati Tags: WebLogic,Security,Authentication,WebLogicPortal,JAAS

Comments from original blog

Carlo -

OK, good to hear that it worked for you!

We don't certify any other authorizers/role mappers. It sounds like at least some use cases work.

Where my comment comes from is the fact that historically we had code that went around the SSPI and directly to embedded LDAP. Based on your feedback, I looked through the current code base and didn't find anything like that. I will check with the engineer who owns that code to verify. So I might have been wrong in saying it will not work at all.

I did find a couple of places where you may see odd behavior:
- There is code to check if the Admin server is running when doing any policy updates. This is because embedded LDAP relies on the Admin server for distribution of updates in the embedded LDAP replicates in a cluster. You will probably see errors in your logs if your Admin server is down, even if you aren't using embedded LDAP.
- WLP has a class called LDAPChangeListener which flushes a role policy cache entry if a role policy has been updated in embedded LDAP. If you are running in a cluster, and are not using embedded LDAP, it looks like you will have to redeploy the application to get the updated role policy recognized across the cluster. Can you verify if this is true with your system?
Thanks for the correction!

Regards - PJL

Posted by: plaird on January 2, 2008 at 11:31 PM

Hi Peter thank you for your answer. Why should the protection of WLP assets (e.g. Portlets) not work? I have written my own XACML Authorizer (based on the OpenSource SUN XACML implementation) and a RoleMapper also and it works. If WLP correctly use the WebLogic Security framework, it should work and fortunately it does ;-) Did you mean that in a future version it will not work? This scaries me because we are strongly basing our security on these implementations (and on XACML). ciao carlo

Posted by: cdrcdr on December 21, 2007 at 6:19 AM

Carlo -

What types of resources do you wish to manage with the Role and Access policies? Do you wish to entitle WLP assets such as portlets and content items, or JEE assets? For JEE assets, you could use an external repository by plugging in additional providers into the SSPI.

But as for WLP assets, first the bad news. You will not be able to replace the entitlement engine that WLP uses for WLP assets. But I would actually argue that you don't want to replace the entitlements engine, you really want to replace the runtime policy repository. Unfortunately, WLP does not currently support storing WLP policies in anything other than embedded LDAP, except in one case (see ALES link below).

While this isn't great news, WLP will at least remove the embedded LDAP dependency when WLP ships on WLS 10.3. You will be able to store your runtime ploicy repository in a DB then.

Now for the good news...

There is a solution available today. I would encourage you to look at ALES, because it does what you want to do. It centralizes role and policy management in an external repository.

But if ALES is not suitable, there is another potential workaround here. It is possible to *manage* the policies in your external system, and then periodically sync the policies into the *runtime* repository (the embedded LDAP now, DB in a later release). An issue will be figuring out how to author WLP policies; specifically being able to create the WLP asset resource strings. Also, you will need to figure out how to allow for the external management tool to discover the set of manageable resources that do not already have policies.

Hope this helps... PJL

Posted by: plaird on December 14, 2007 at 8:34 AM

Great article! One question: we have our RoleAssignmentPolicies (XACML)as well as the AccessPolicies (XACML)in differnet repositories: we need to wtite our own XACML based authorizer (and Entitlements engine) and (possibly) remove the BEA one from the realm. Would it be possible? There would be problem/limitation doing so? regards carlo

Posted by: cdrcdr on December 13, 2007 at 5:26 AM

Josh - I haven't worked with the LDAP providers in years, so I can't comment on the specifics. But in the follow up blog entry to this one, I explain how to dive into the cssWlSecurityProviders.jar to find the implementations of the BEA Atn Providers and how providers often extend other providers.

By doing that now, I see that the BEA IPlanetAuthenticator extends the base LDAPAutenticator, which already implements UserEditor and GroupEditor. If you wish to implement custom logic for those mbeans, extending the BEA IPlanetAuthenticator provider is probably the way to go. You would create a subclass overriding the UserEditor and GroupEditor methods as necessary, and then wire it up using an XML descriptor.

Look to the IPlanetAuthenticator itself as an example of how to wire up a provider subclass. Put your custom atn provider in its own JAR in the same directory as cssWlSecurityProviders.jar and you should be good to go.

PJL

Posted by: plaird on October 18, 2007 at 9:15 AM

Hi Peter, What steps would I need to take to add the UserEditor and GroupEditor MBeans to the IPlanetAuthenticator? If I intend for users to be created using a custom objectClass defined in the iPlanet Directory Server that has custom attributes, I'm assuming that I'll have to customize the MBean to do this. Is this correct? Thanks, Josh

Posted by: joshbrookes on October 17, 2007 at 11:28 AM

Hi Luciano - yes, this is why we are keen to eliminate internal LDAP as the repository for ATZ. The best way is to have a Propagation inventory that contains a backup of your policies. In that case, you can wipe it clean, and then reapply the inventory (this is not so simple if you do admin work in production, you will need to be careful about the merge). Also, a colleague was looking into a more fine grained fix (directly updating internal LDAP to fix the problem records). I don't know off-hand where he ended up with that - I will point him to this entry. Ciao, PJL

Posted by: plaird on September 24, 2007 at 11:40 PM

Hello Peter, very interesting reading. I wish that more articles like this one could be published by Bea. I take advantage of this blog to ask you a question: we have hit on a Portal9.2Mp1 production installation the infamous out of sync between embedded Ldap and the portal db (p13n tables). Result, Delegated Admin page fails with a NPE and Entitlements also are not very well. It's easy to fix this problem in a non prod environment (wipe p13n tables, wipe ldap files) but which is the recommended way to deal with this issue in a clustered production environment? Thanls a lot Luciano Fiandesio

Posted by: koevet on September 24, 2007 at 11:21 PM

Enterprise Greasemonkey: Solving the Greasemonkey Script Versioning Problem

2007-08-19T01:51:00.000-06:00

As I have covered in previous blogs, Greasemonkey is a powerful client-side tool for augmenting web sites or creating mashups. It consists of a Firefox plugin coupled with scripts that are written and installed to modify web pages as they return from a web server. When this tool is brought into the enterprise, IT must sort out issues like security and deployment. I covered security in my last post, and in this installment I will look at how IT can solve deployment and versioning issues for Greasemonkey scripts.

NOTE: this blog entry was originally posted August 19th, 2007 on my previous blogging system (dev2dev.bea.com). Comments on the old blog were not transferred.

This is part 5 of a series of blog entries on Greasemonkey mashups.

Blog 1: More Mashups: Using Greasemonkey to Weave New Features into Web Sites
Blog 2: Building a Greasemonkey Mashup Tutorial
Blog 3: Greasemonkey in the Enterprise: When is GM the Right Tool for IT?
Blog 4: Beware of Greasemonkey's Inverted Security Model
Blog 5: Solving the Greasemonkey Script Versioning Problem

The Need for Greasemonkey Script Deployment and Versioning

For this blog entry, imagine a web application in the enterprise with these characteristics:

It is a closed source packaged application, purchased from an external vendor.
It is used by a modest sized group of users, all of which are comfortable with computers and web browsing
There are a couple of missing features that dramatically hurt productivity
Those features can be easily woven into the application using a Greasemonkey script

Now, any one of those affected users could write the Greasemonkey script without involving IT. This script could then be passed around via email or a shared drive amongst colleagues. But there are few problems with this ad hoc approach to Greasemonkey:

As the script evolves, distribution and version management of the script will be difficult.
As new users are introduced to the web application, there is no formal process for getting them going with the script.
GM scripts are like .exe's - they can be host to malicious code. Unmanaged distribution could open the door for a hacker.
It is IT's mission to be the solution provider - IT should provide the Greasemonkey script.

Clearly, while IT can let the user community fend for themselves on this project, it would be far better for IT to own the solution. However, as always, unless IT can provide a solution quickly the users are apt to go with the ad hoc approach. Hopefully this blog entry will help you rapidly develop a sustainable solution, and add Greasemonkey to the list of official solutions for your enteprise.

Solving the Deployment and Versioning Issues for Greasemonkey Scripts

The rest of this blog entry discusses a solution that can provide manageability around Greasemonkey in the enterprise. It can solve the issues listed above, particularly the issues around deployment and versioning of a Greasemonkey script. This solution is by no means the only way to address these issues, but hopefully you will find it satisfies your requirements. The following describes characteristics of the solution:

It specifies a new landing page, or Gateway page, for the web application that users will hit before going into the app
This page can contain whatever you want, but it also has elements to help determine if the GM script is installed and up to date
The solution enforces the use of the Greasemonkey script (though it could be easily changed to make it only optional)
It provides version checking
It does not require any changes to the closed source web application
It is not foolproof - if the user avoids the Gateway page using a bookmark the enforcement is not run

The graphic below shows how the Gateway page fronts the web application to make sure the user has the proper Greasemonkey install. Ideally, the Gatekeeper page would be integrated into the web application's login page so a user could not bookmark their way around the enforcement. If the browser is not properly configured, the Gateway page obscures the Enter the Site button until the problem is corrected. Also note that the proper version of the Greasemonkey script should be located on a web server defined and managed by IT so the Gatekeeper page can direct the user to it if necessary.

Versioning is implemented by including a div element on the Gateway page with the version number of the script that users should be using.

<div id="gm-script-ver-415" />

The Greasemonkey script looks for the div tag with it's version number. If it does not find it, it will not make the Enter the Site link visible.

The Solution Step by Step

Check 1: Is the browser Firefox? If not, a message discloses the problem.

Check 2: Is Greasemonkey and the script installed? If not, the page offers the download links for both.

Check 3: Is the Greasemonkey script the current version? If not, the page offers the download link for the latest version.

Success: The browser is properly configured. The user is allowed to continue if all checks pass.

Implementing the Solution

I didn't include the code in this blog but it is attached here. The code is fairly short, and so you should be able to repurpose it for your needs quickly. Also, for illustration, I have deployed an online demo.

Online Demo

I am hoping others will provide alternative solutions - please speak up if you have built one. The solution I built is passive - it requires the user to navigate across the Gateway page. It is easy to imagine a more active solution, one that would use an XmlHttpRequest to periodically phone home to see if an updated script has been published. That type of solution would need to cache the answer, otherwise it's impact to the network could be substantial. I would think that the GM preference store could be used as a cache.

Greasemonkey Versioning on the Web:

There are others who have talked about the versioning issue. Here are some links:

GMVC (Greasemonkey Version Control)

"The objective of this project is to create a database-driven repository of GreaseMonkey Userscripts which allows for the archiving of previous versions, the release of production versions and the limited released of alpha and beta test versions through the same site."

AllPeers Blog Entry

"A first step would be to give web authors at least the option of making their sites script-friendly. This would involve placing a special header on their webpages that can be tied to a specific version of a Greasemonkey script, like so:

<head> <meta greasemonkey:somescript.js="1.2"/> </head> "

Jeff Barr's Blog

"At some point I could see the need for what we could call "Enterprise Greasemonkey," a tightly packaged version of Greasemonkey with a number of scripts installed and locked in to place. This would give system administrators the ability to deploy specialized versions of Firefox to users who don't need to know how to install, customize, or disable Greasemonkey scripts."

Resources:

Online Demo

Code Download

Greasemonkey Home

Dive Into Greasemonkey - a great guide to GM

Technorati Tags: Greasemonkey,Enterprise

Enterprise Greasemonkey: Beware of Greasemonkey's Inverted Security Model

2007-08-18T01:48:00.000-06:00

I have been blogging about the power and usefulness of a tool called Greasemonkey. I have also explained when Greasemonkey is a good tool for use within the enterprise. But before you rush off and use it in your next IT project, you must understand an important issue with the tool. That issue specifically is Greasemonkey's security model, which was designed to protect benevolent scripts from evil websites. But from IT's point of view, the Greasemonkey security model is inverted - it trusts the wrong people. Within the enterprise, the IT hosted websites are trusted. It is the Greasemonkey scripts that may be evil. This blog entry explains the issue, and discusses some coping strategies.

NOTE: this blog entry was originally posted August 18th, 2007 on my previous blogging system (dev2dev.bea.com). Comments on the old blog were not transferred.

This is part 4 of a series of blog entries on Greasemonkey mashups.

Blog 1: More Mashups: Using Greasemonkey to Weave New Features into Web Sites
Blog 2: Building a Greasemonkey Mashup Tutorial
Blog 3: Greasemonkey in the Enterprise: When is GM the Right Tool for IT?
Blog 4: Beware of Greasemonkey's Inverted Security Model
Blog 5: Solving the Greasemonkey Script Versioning Problem

The Power of Greasemonkey

A discussion of the Greasemonkey (GM) security model needs to start first with a discussion of the power of Greasemonkey. Greasemonkey scripts have enormous power, and so a security model is key to its design. In fact, the original version of GM got the model wrong, which led to urgent pleas to uninstall GM until the security model was fixed. The urgency of that issue was due to the danger of misuse of Greasemonkey. And that danger is directly related to GM's power and capabilities.

The first thing to understand about Greasemonkey is that it has full access to the web page. If a web page is displaying sensitive information like account numbers, Greasemonkey can see it. Therefore, a compromised Greasemonkey can do great damage by virtue of the information it can steal.

The second issue to understand is that Greasemonkey is powered by JavaScript and has access to features like event handlers. This can enable GM to snoop on anything the user is doing within the page. For example, a compromised Greasemonkey could capture user input, like the entry of a password.

Finally, Greasemonkey operates at a higher privilege level than normal JavaScript, giving it even more power. The most important capability is the ability for Greasemonkey to be immune to cross domain browser security. Normally, HTTP requests issued from JavaScript (XmlHttpRequest) can only target URLs in the same network domain (e.g. bea.com) as the parent page. This restriction was put in place to help limit (it does not totally prevent) cross site scripting (XSS) attacks. However Greasemonkey, as a plugin, is immune to this restriction. This is a most useful feature when building mashups, but it is does mean that Greasemonkey is operating with higher privileges. It can issue requests to whatever URL it wants, perhaps allowing it to send sensitive data to a malicious web server.

In summary, Greasemonkey is a powerful tool. But just as this power can be put to good use, it can also cause much damage when under the control of malicious parties. The rest of the blog describes how Greasemonkey provides protection, and why IT will have concerns about it in the enterprise.

The Greasemonkey Security Model - Trust the Scripts

Currently, Greasemonkey is a tool in use on the greater world wide web. I don't know the number of people using it, but let's speculate that at most its only a few percent of the users on the web. Let's also speculate that the people using it are fairly sophisticated computer users that know what they are doing. In this situation, we have a small community of users that probably don't attract a lot of attention from the black hats out there. Even if they did, the users have the ability to self-regulate and guard against attackers. Every script is human readable, and so users can look at every script before installing them to determine if the script is safe.

With this understanding of the use case, we can now look at the security model. The Greasemonkey security model operates with the following assumptions:

Trust the Greasemonkey script; the user installed it and therefore it can be trusted not to abuse the powers described above.
Do NOT trust the targeted web sites. Do not allow those sites any access to GM objects or APIs.

What this means is that the focus of the Greasemonkey security model is on malicious web sites. This came about because the first security model was vulnerable to such attacks. A well crafted web site could steal cookies and even files off the machine of the unsuspecting Greasemonkey user. The security model was revised in 2005, and great care has been taken to prevent web sites from hijaking the privileges of Greasemonkey to do harm. For a great article on how this was accomplished, read Mark Pilgrim's explanation of XPCNativeWrappers and how they protect GM.

While attacks from malicious web sites should no longer be a problem, Greasemonkey is still vulnerable from certain kinds of attacks. Specifically, the security model does NOT have facilities for detecting or preventing malicious user scripts. Therefore, the user must be careful to only install scripts from trusted sources. This model is in use for the public web, but is it the right model for the enterprise?

The Enterprise Greasemonkey Security Model - an Inversion of Trust

Moving into the Enterprise, the angels and demons flip sides. In the enterprise, IT primarily owns the web sites. Rogue IT employees aside, these sites can be considered trusted and safe. But in this case the GM users aren't as sophisticated, and there is greater potential for them picking up malicious scripts. These are the same users that have been clicking on .EXE email attachments for years. IT cannot trust that this user community will correctly protect themselves from evil scripts.

From IT's point of view, the Greasemonkey security model is inverted - it trusts the wrong people.

Whether this is a fatal flaw that prevents an enterprise from using Greasemonkey universally is a decision IT must own. Personally, I don't think Greasemonkey should be a part of an enterprise wide application roll-out. But I do still think it has it's place in niche solutions. The Greasemonkey Selection Framework introduced in my previous post should help guide when it is the right tool.

Admittedly, it is valid to view any sanctioned Greasemonkey use as reckless, because it could open a Pandora's box. Once users get a hold of it for authorized uses, it may lead to other unauthorized use within the enterprise. This is something for IT to bear in mind when considering if Greasemonkey is an appropriate tool. As a counterpoint, malicious attacks aren't limited to Greasemonkey scripts. .DOC and .PDF files both have been used in the past in attacks, but that has not prevented enterprise use of those technologies.

Malicious Greasemonkey - a Real World Example

To show that Greasemonkey scripts can be a real danger, take a look at this image below. It is a screen shot of the public Greasemonkey script repository, and it currently displays a big warning message. Apparently, a malicious script writer has been publishing evil scripts to the public at large.

One could argue that this proves that the community approach works. Community members discovered the malicious behavior and have taken action to remedy it. But within the enterprise, would the users be able to catch such a problem?

Enterprise Solutions for the Greasemonkey Security Model

Now that you are aware of the problem, let's talk about how IT can solve the problem of the inverted security model. Unfortunately, a server side solution is not attainable. By design, a content page cannot know about or have access to the user script. Therefore a server side solution cannot prevent a malicious script from running on the page. In fact, public web sites that generate their revenue through ads have feared this problem for years. There is no way for these sites to stop the ad blocking Greasemonkey scripts.

We must look to the client for the solution. Unfortunately, Greasemonkey does not currently have a technical solution to this problem. For instance, there isn't a feature that prevents non-IT approved Greasemonkey scripts from being installed. Once the plugin is installed, the user is free to install any script, and there is no way to detect if that script has been tampered with. So if a coworker sends out an email like "Check this out, I updated the script to add a new feature", unwitting users may pick up a malicious script.

Instead, IT must rely on some coping strategies:

Train workers to treat Greasemonkey scripts with as much suspicion as an .EXE file
IT must host a read-only web site for all scripts to be published where they cannot be tampered with; do not just throw them on a file system
Beg the Greasemonkey developers to add a signing feature

Final Greasemonkey Blog Post Coming Shortly...

The last post in this Greasemonkey series should be done soon...I will show how I implemented a deployment and versioning system for Greasemonkey scripts.

Technorati Tags: Greasemonkey,Enterprise Security

Greasemonkey in the Enterprise: When is GM the Right Tool for IT?

2007-08-17T01:42:00.000-06:00

As I have covered in previous blogs, Greasemonkey is a powerful client-side tool for augmenting web sites or creating mashups. It consists of a Firefox plugin coupled with scripts that are written and installed to modify web pages as they return from a web server. Greasemonkey generally is a tool for techies who want to tweak their favorite sites around the web. But does Greasemonkey have a place in the toolbox of IT departments in the enterprise? My next few blog entries will work towards an answer to that question. In this installment I will introduce a framework for measuring whether Greasemonkey is a good solution for a specific enterprise project.

NOTE: this blog entry was originally posted August 17th, 2007 on my previous blogging system (dev2dev.bea.com). Comments on the old blog were not transferred.

This is part 3 of a series of blog entries on Greasemonkey mashups.

Blog 1: More Mashups: Using Greasemonkey to Weave New Features into Web Sites
Blog 2: Building a Greasemonkey Mashup Tutorial
Blog 3: Greasemonkey in the Enterprise: When is GM the Right Tool for IT?
Blog 4: Beware of Greasemonkey's Inverted Security Model
Blog 5: Solving the Greasemonkey Script Versioning Problem

An Enterprise Use Case for Greasemonkey

You probably did not learn about Greasemonkey (GM) in a Computer Science class at University. When drawing up an ideal solution for delivering a web application, Greasemonkey is probably no where in sight. The truth is Greasemonkey is a pragmatic solution for real world problems when other options aren't available. It is not the cleanest solution, but it makes up for that by being effective. It will always have detractors who will dismiss it as a hack, and an evil one at that. While its shortcomings cannot be denied, it is a mistake to dismiss it.

Greasemonkey has the potential of fast tracking IT projects that would otherwise never get implemented. It can also lower the bar for IT skill sets - a junior scripter can use it to modify the most complex of web applications. I feel that Greasemonkey deserves a place in your IT toolbox, and should be an option when it is an appropriate solution.

But I will be the first to say that Greasemonkey is not for everyone, and is not for every project. Greasemonkey definately has a sweet spot. Outside of that sweet spot, you are best off looking at another solution like other mashup tools or custom development.

For a quick example of good GM use case, imagine a web application in the enterprise with these characteristics:

It is a closed source packaged application, purchased and installed from an external vendor by IT.
It is used by a modest sized group of users, all of which are comfortable with computers and web browsing
There are a couple of missing features that dramatically hurt productivity
Those features can be easily woven into the application using a Greasemonkey script

This web application would make a good candidate for augmentation with Greasemonkey. A GM script could be quickly created that would add the missing features without needing to acquire the source code for the application. The deployment of the script would be relatively simple - the user population is modest in size and are technically competent. IT could be a hero by providing a quick solution to an expensive problem.

But what makes this use case a good fit for Greasemonkey? What other applications are good candidates for a Greasemonkey mashup/augmentation? What guidelines should you use when deciding if Greasemonkey is right for a given project? This blog will answer these questions.

Greasemonkey Selection Framework

This section provides a framework for evaluating whether Greasemonkey is a good fit for an enterprise project. Like any software selection process, you must consider many factors before choosing a best fit solution. You cannot base your decision on a single factor; you must sum the overall suitability against the project requirements. The list below enumerates a number of factors to look at before making your choice. For each factor, I explain when Greasemonkey is best suited.

Factor: Do you have access to the source code of the web application?
Description: IT brings in many packaged applications from external vendors. In such cases, IT may not have access to any source code, or only a partial set (like the HTML files). For applications home grown within IT, this is not an issue as the source code is available.
Greasemonkey Fit: When the source code is available, it may be easier to just update the original application. Greasemonkey is indicated more when the source code is unavailable.

Factor: The application is home grown and the source code is available. But updating the application is very risky?
Description: Even if the source code for an application is available, it may not be cost effective to update the application directly. Perhaps all of the original developers are gone, and there is little documentation on how the site was built. Or perhaps the current staff is unfamiliar with the technology that was used to implement the site. If the code base is complex, it may be risky to make any modification to the source code.
Greasemonkey Fit: Greasemonkey can be a safer solution for adding new features to web applications that are risky to touch. The Greasemonkey script is externalized from the web application, and so the new development is clearly separated from the legacy application.

Factor: How critical is the feature to be added?
Description: Is the feature a productivity enhancement, or is the application as-is no longer valid without the update? An example of the latter would be a feature related to a compliance project. In order for the legacy application to update company financial data, a new "explanation" field needs to be added to a web form for auditing purposes. Users must not submit this form without the added field.
Greasemonkey Fit: It would be difficult to enforce that a user have the Greasemonkey installed and up to date (although the last blog entry in this series will offer a possible solution for this). Therefore, if an application is not valid without the new feature, Greasemonkey may not be the right solution for implementing that feature. For optional features such as productivity enhancements, Greasemonkey is a great solution.

Factor: Is Firefox certified for use in the enterprise, and does it work with the target application?
Description: This factor is obvious, but be careful not to miss this in your software selection. Greasemonkey requires Firefox (there have been attempts to port to IE (gm4ie, GreasemonkIE), but are they complete/solid?). Also, some web applications may not work correctly with Firefox.
Greasemonkey Fit: If your enterprise does not support users on Firefox, Greasemonkey is not an available solution. Also, if the target web application does not work well with Firefox, Greasemonkey is not a great fit for the project.

Factor: To what degree are the target users computer literate?
Description: Within the enterprise, there is a broad range of computers skills amongst the employees. Greasemonkey does require users to be able to follow directions on installing Firefox, the Greasemonkey plugin and the required scripts.
Greasemonkey Fit: The more computer literate the user base, the better for Greasemonkey. While installing plugins and scripts seems like a no-brainer for anyone that would be reading this blog, it is a true obstacle for many within the enterprise.

Factor: What size is the user population that needs the new feature?
Description: The appeal of web applications is in their ease of deployment. IT need only manage the application on a few server machines in the data center. Updates are efficiently deployed. Client side solutions are generally more expensive to deploy, as each client needs to be updated with each new version.
Greasemonkey Fit: The cost of deploying a Greasemonkey script to a small user population is likely modest. On the other hand, deploying a new version of a Greasemonkey script to a huge user population is an expensive proposition, particularly when computer literacy is an issue (see above). Greasemonkey is best when the user population is small.

Factor: Is the application exposed to the public internet?
Description: Many enterprise applications are available to a closed audience of employees and partners. But some applications are also exposed out to customers and the general public on the internet.
Greasemonkey Fit: Because Greasemonkey requires Firefox, the GM plugin, and the proper user scripts installed, Greasemonkey is a good solution when the user base is well known and constrained. Otherwise support costs and customer complaints will be high ("Hello, Avitek Industries, how may I help you?"; "Your website says I need Firefox. What is a Firefox?").

Factor: How often is the page structure in the web application changing?
Description: Regardless of who is changing the web application (IT, or the ISV if it is a packaged application), every update has the potential of breaking existing Greasemonkey scripts. Minor changes to the content will probably be safe, but bigger changes to the page templates will almost certainly cause problems.
Greasemonkey Fit: Greasemonkey works best if the structure of the pages within the target web application is not changing substantially.

Factor: Does the application manage or expose sensitive information?
Description: Some enterprise web applications are low security risks. The site that hosts a monthly employee newsletter probably is not much of a concern from a security point of view. A payroll system is quite the opposite; the consequence of a security breach is severe.
Greasemonkey Fit: My next blog entry in this series will discuss the Greasemonkey security model and why it is not a great fit for the enterprise. Based on that analysis, Greasemonkey is not a good choice for adding features to highly sensitive enterprise web applications. Further, some IT Managers may feel GM is too risky to allow at all. More to come in the next post...

Factor: Does the new feature require many changes to the existing web application?
Description: Javascript can update the DOM of an HTML page quite easily. But for each update on a page, there is code involved. Writing raw HTML (in an .html file, a JSP/ASP file, etc) is far easier than a similar effort in JavaScript code.
Greasemonkey Fit: Greasemonkey is a great fit for features that can be implemented with a few snips to the target HTML. As the number of distinct changes to a page increases, the suitability of Greasemonkey decreases.

Factor: Does the target web application already have JavaScript code that mutates the page?
Description: The web application may have JavaScript code that modifies the page structure. This may be in support of Ajax capabilities, or just the way the initial page load was implemented. A Greasemonkey script runs before any page defined JavaScript runs. This may or may not be a good thing.
Greasemonkey Fit: Implementing a feature with Greasemonkey may be difficult if the page is already mutating itself with JavaScript.

Factor: Does the feature require communication with a server in a different network domain than the web application?
Description: Browser based programmatic requests initiated from JavaScript (XmlHttpRequests) are restricted in their reach - they must not cross a network domain (e.g. bea.com). This is browser security, and this is generally good. But if you are adding a mashup feature to the web application, this would normally prevent the feature from being implemented in the browser. However, Greasemonkey scripts are not subject to this limitation, and can issue an XmlHttpRequest to any network domain.
Greasemonkey Fit: Greasemonkey is a good fit when you wish to implement the feature in the browser but need to connect to a different network domain.

Favorable Enterprise Greasemonkey References

To see how others have used Greasemonkey on enterprise projects, or for opinions on how Greasemonkey can add value to the Enterprise, consult these links:

Greasemonkey Improves Productivity - this company uses Greasemonkey to speed up enterprise form entry

Enterprise Greasemonkey is Inevitable - "...sooner rather than later we're going to see GM within the enterprise - if only b/c they have the potential to take some of the load off of beleaguered, shortstaffed IT staffs."

Firefox in the Enterprise Working Group - focuses on a larger issue than just Greasemonkey, but this expert group is looking at some of the issues noted above.

Using Greasemonkey to Enhance Auditing - this script adds time logging capabilities to JIRA.

Anti Enterprise Greasemonkey References

And the opposing view. There are those who think IT should stay well away from Greasemonkey:

Greasemonkey Primes Firefox For Embarrassment - this is an article you have to pay good money to read. Here is an excerpt from the abstract: "But IT managers beware: Greasemonkey will cause you nothing but headaches..."

[Greasemonkey] is Evil - "What's evil is the idea you mention that we'll end up making sophisticated infrastructure like automated script updaters in an attempt to turn a quick-and-dirty hack into a robust solution."

The Story Continues...

My next blog entry will discuss the Greasemonkey security model, and why IT will see it as "inverted" from what you would want.

Technorati Tags: Greasemonkey,Enterprise

Laird OnDemand

Ranking Cloud Computing Vendors 2009

Google as an Analysis Tool

Ranking the Cloud Vendors in 2009 on Mind Share

1

2

3

4

5

6

8

9

10

11

12

13

16

20

21

22

23

24

25

CloudFutures 2009 (Dec 7-8, San Jose)

Cloud Computing Taxonomy at Interop Las Vegas, May 2009

Peter at Enterprise Cloud Summit

May 2009 Cloud Computing Taxonomy

Descriptions of the Buckets:

Infrastructure

Platform

Services

Applications

Vendor Links

Please Comment

I’m Back, and OnDemand

Where was Peter?

Cloud Computing + Smart Grids, Peter’s New World

What’s Next…

Comparing Cloud Computing Mindshare Levels Between the U.S., Europe, and Asia

Aggressive Extrapolation

The Raw Data: Blog Readership Numbers

Primary Evidence: Cloud Computing Visual Map Entry

What About the SaaS Numbers?

Seeking a Control: My Non-Cloud/SaaS Blog Entries

Other Data Points on Cloud Mindshare and Adoption

Call for Collaboration

Visual Map of the Cloud Computing/SaaS/PaaS Markets: September 2008 Update

NOTE, New Version Available:

Interop NYC 2008

Defining the Markets

The Visual Industry Map

Reference Vendor List

Building a RESTful Enterprise Integration with Oracle and SnapLogic

What is REST?

RESTful Integration in Concept

Example: Oracle WebLogic Portal + Oracle Database + SnapLogic + REST

Oracle and REST

Oracle Internal REST Symposium

Resources

Best Practices for the Suspension or Termination of a SaaS Customer Account

SaaS Customer Bill of Rights

Termination Rights for the Customer

Termination Rights for the SaaS Provider

Further Discussion

Negotiate your Customer Contract

The Good, Bad, and the Ugly of SaaS Terms of Service, Licenses, and Contracts

The Analysis

The Good

The Bad

The Ugly

Links to the Terms of Service

Raw Analysis

Account Suspension/Termination and the Deletion of Data

How Oracle, IBM, SAP, Microsoft, and Intuit are Responding to the SaaS Revolution

Oracle

Microsoft

IBM

SAP

Intuit

How to Survive the SaaS Revolution: Learning from the Death of DEC