Learn About Security: Open Authorization in Federated Applications using IBM Security Tools

IBM Tivoli Federated Identity Manager (TFIM) simplifies application integration by providing single sign on between disparate web applications, so the users do not have to share their passwords or re-enter them. TFIM uses various protocols to achieve federation, which include SAML, WS-Federation, and OpenID. Our Security LoB has been invited by IBM to participate in a beta program to implement the popular authorization protocol, OAuth. OAuth, which stands for Open Authorization, is a protocol that allows users to approve applications to act on their behalf. OAuth makes it possible to exchange critical information across distinct organizations based upon a service level agreement that states one application as an OAuth client and the other as an OAuth provider. One major benefit of the OAuth protocol is its emphasis on authorization, when compared to its alternatives. This is giving rise to a hybrid model in which our customers can combine protocols like SAML or OpenID for authentication and OAuth for authorization. OAuth, besides making the token exchange mechanism transparent to the user, provides mechanisms to define the scope which the Client could access regarding the user’s data on the Provider.

Here is a fictitious example. Imagine PFAP as a financial application dashboard developed by Prolifics that provides a user with a consolidated view of his account balances across multiple banks. First, PFAP would have to be in an agreement as an OAuth client across all of the banks, from which account information would be obtained on behalf of the user. Once an agreement is set up with each Provider, PFAP would be registered as an OAuth client to those particular banks (Providers) and so would be provided with a client ID and a shared secret for each one. This information (Client ID, Shared Secret) would help the Provider determine, if the application (Client) requesting data on behalf of user, is one of its trusted OAuth clients. Assuming an agreement between Prolifics and a leading financial firm, PFAP is one of the OAuth clients that has access to the Firm's customer data, upon approval. The first time a user logs into the PFAP application, he will be asked to add his account number to PFAP. Once the user selects “Add Account” button, the user would be redirected to the Firm's website, where he would be asked to put in his credentials. At this step a token would be requested by PFAP from the Firm in the background, which gets authorized upon user logging into the Firm's website. This action grants access to PFAP to act on the user’s behalf.

From the user’s perspective, once logged in the Firm would display a “Consent to Authorize” page where the user would needs to permit access to PFAP to act on his behalf and retrieve information within a certain scope, which in this case would be user’s account balance. Once the user agrees to permit PFAP to act on his behalf and retrieve balance information, a verifier code is sent to PFAP in the background. PFAP would then request an access token from the Firm's application sending the verifier code, Client ID, Shared Secret and few other parameters to request an Access token. The Firm would verify the Client ID and Shared Secret to determine if PFAP is one of its OAuth clients and then would verify the Verifier Code to generate an Access token. Once PFAP receives the Access token, it enables PFAP to get the user’s data on his behalf though within a permitted scope, which in this case would be the account balance. So next time the user logs in, since PFAP would already have an Access token, the user would be able to see his balance information without having to login to the Firm's website. Now, implementation of hybrid models is being thought upon, where a combination of OAuth with protocols like SAML or OpenID would help us achieve SSO at the same time. For instance, once logged into PFAP, an implementation of hybrid model would enable the user to perform other operations in the Firm's website like balance transfers, by launching a new link to the Firm without the need to login again (SSO).

BPM Best Practices for the Financial Industry

In our current economic environment, the financial industry is challenged today by two very significant needs to improve efficiency and enhance service. I spoke about these business needs last year at an event hosted by Prolifics and IBM, and they couldn’t be more significant today. To satisfy these requirements, organizations are tasked with driving down costs by consolidating duplicated and siloed systems into well-defined, reusable services and managing customer service levels with greater flexibility.

This industry has a collection of 'habits,' or best practices, that have a powerful effect on business performance in these critical areas. Over time, we have captured the best practices that have proven to be successful with process management programs within the financial industry. At this seminar, we reviewed 11 specific practices that help financial services organizations experience success with projects/delivery, team competency and leveraging Business Process Management (BPM) across the enterprise.

I’d like to share some of these ‘habits’ with you now:

Make BPM about Productivity and Visibility

• Metrics, KPIs and SLAs should be part of the DEFINE phase
• Don’t scope out metrics
• Remember: visibility is critical to improvement

Never “One and Done”

• Iterative Approach: continuous process improvement
• Additional phases or versions will always happen: The value in BPM is that you can get your first version out there quickly, but the real opportunity here is really in version 2, 3 and 4 where you are bringing entirely new levels of capability and sophistication of efficiency of effectiveness to your organization

Don’t Skip Process Analysis

• Processes are done by many different parties! Process analysis helps you understand: What does the end-to-end look like? What data is needed at different points? What is the velocity that we need in this process? How quickly do we need turnaround time?
• Process analysis sets apart traditional applications development from building process applications

  
Build a Complete Team

• Have the right mix of resources on the team with a broad set of skill sets
• Java (.NET) developers aren’t all you need

Establish the Owners

• A requirement for succeeding with BPM is that processes must be business-owned. You need people from the business to engage and determine what the process priorities are.
• They key benefit to this iterative approach is that you can make tradeoffs and changes to adapt to changing business conditions and requirements. A level of business engagement will ensure that the right decisions are being made.

In addition, financial institutions face a highly demanding environment requiring exceeding agility. The seminar focused on how customers can reap the benefits of the business rule approach to operational decision making in the areas of payments, credit and lending, risk management and customer care for financial institutions. With business rules, key decisions in your financial processes can be changed in minutes to days rather than months - bringing new levels of efficiency to day-to-day operations.

To read more about these 11 Habits for highly successful BPM programs and the benefits of a business rules management system, please take a look at this presentation. For any questions about these topics or Prolifics’ solutions for the financial industry, please email solutions@prolifics.com.

Don Rivera is a Client Executive with Prolifics managing the NY & NJ Metro territory. Don is a certified IBM WebSphere Solution Sales Professional working with SMB and Enterprise accounts to determine how to leverage IBM software technology to meet their critical business objectives. He brings over 16 years of experience working in the information technology industry in various system engineering, sales and business development roles with companies such as Computer Sciences Corporation, Level 3 Communications and BBN Technologies.

Leveraging your Panther Assets with Web Services

Software applications have become a valuable component of modern enterprises. They contain critical business knowledge, and represent significant design and development effort. It only makes sense to extract as much value from these applications as possible. As enterprises grow and merge, the need to share the information in these applications becomes imperative. This applies to your Panther applications we well. For example, order entry systems need to talk to billing systems, shipping systems, and so on.

While there are many methods for accessing your Panther applications, Web Services provides a common method, across diverse platforms, products, and computer languages, in a well-defined manner. As long as each application implements the Web Services standards, applications can freely interoperate with each other. This bi-directional communication is independent of the technology that the target application was written in.

Your Panther applications can participate in this inter-application communication by implementing Web Services, multiplying the value within them. In this way, systems throughout your enterprise, or beyond, can benefit from the existing code and data within your Panther applications.

You can also utilize your Panther tools and skills to create new RAPID Database Transactional Web Services for just about any application. This is totally independent from your existing Panther applications and utilizes the same rapid development platform.

For a complimentary Discovery Call, please call your Business Development Manager at 1 (800) 458-3313 ext 2 or email crm@prolifics.com.

Prolifics BPM Methodology - 5 Steps to Improve Your Process and Build Your Evidence-Based Business Case

Business process improvement is a systematic approach that helps organizations become more efficient by optimizing their core business processes to increase productivity and reduce cost; business process improvement initiatives have emerged to become essential drivers for organizations to compete in a rapidly and unpredictably changing market. According to a Gartner EXP Survey, improving business processes has been one of the top 5 business priorities for the past 5 consecutive years.

The business process improvement approach is a series of actions taken by a process owner to improve a business process to meet a new goal defined by the organization. Those actions have to follow a methodology or a framework in order to create successful improvement results.

Any process improvement methodology consists of 3 macro level steps that occur in the following order:

In this white paper, I will present Prolifics' methodology for process improvement. The methodology is designed to address those fundamental challenges with traditional process improvement approaches; it also provides a simple road map for process improvement that is powered by innovative technologies that will guide you step by step in your process improvement journey and expedite the process improvement cycle. This methodology is presented in the context of a real customer initiative to improve a core business process.

To read this white paper, click here.

Hanna Aljaliss is a Solution Architect in the BPM & Connectivity practice at Prolifics. He has over 7 years of consulting experience in the IT field - 5 of those were focused on IBM Business Process Management and SOA implementations. He has led several major enterprise initiatives across different industries from the conceptual stage to the live solution stage. Hanna holds a Master degree in computer engineering from Stevens Tech and has been a frequent presenter at the IBM's Premier Conference for Business and IT Leaders (IMPACT).

Converting your Legacy JAM Application into a Panther Web Application

Converting a legacy JAM/Panther 2-tier application into a Panther Web Application offers a significant advantage: a conversion allows reusing a significant portion of the existing code as most JPL and C functions continue to be fully functional.

Although straightforward, the conversion process is not trivial or automatic. The conversion process does present some challenges and involves making changes and additions to the existing code.

In this document, I start by quickly describing some key differences between a JAM/Panther 2-tier application running on a GUI environment and a Panther application running on the web. Then, I proceed to discuss aspects of the application that are reviewed during the process of converting a GUI application to the web.

Key differences between a GUI application and a Web application
In a GUI environment, when a JAM/Panther application is executed, it runs on a dedicated process that performs several tasks for the application: this one process makes the calls required to display the screens and widgets to the user, handles the screen event cycle and maintains the application state. In this same process, all the screens and JPL code are loaded and executed. This process, also, connects to the backend, which is typically a database that is accessed through the Panther DBi.

When an application is executed on the web, the architecture is quite different. For starters, instead of having one process perform virtually all the tasks required for the application to work, several processes (residing in different hosts) are involved in performing the tasks required for an application to run on the web.

On the web, the browser is the only program running on the client computer. It allows the user to interact with the web pages dynamically generated on the server. Once a given page is displayed to the user, there is no interaction with the server until the user performs an action that results in submitting a request to the server. More specifically, as the user interacts with a page in the browser, several events are generated and they can be divided into two groups: events that are handled locally by the browser alone (for example, when the user tabs between the fields in the page) and events that require server processing (for example, when the user clicks on a push button to perform a search in the database).

When an event in this second group occurs, the browser submits a request to the HTTP server. The request is then passed along to an available Panther Web Application process, which executes the appropriate Panther code and replies with a new rendition of the screen in the form of a new HTML page. This HTML code is then transmitted back to the browser and displayed to the user.

This is perhaps the root cause of most of the changes required for converting an application to the web: whereas in a GUI environment, a single process continually handles the screen event cycle, executes the appropriate Panther code and displays the application screens using the platform’s native API. On the web, these operations are split between the browser (which renders the HTML code it receives and maintains its own event cycle as the user interacts with it) and the Panther Web Application processes residing on the server (which receive requests from the clients, execute the appropriate Panther code, and reply with HTML code that is sent back to the browser).

The Panther Web Application processes that actually execute the Panther code are a pool of processes called Jservers. Each of these Jserver processes handles one request at a time, and generates a response. Being stateless processes, the Jservers retain no memory of previous transmissions: as soon as a Jserver process has produced the reply for a request, it again becomes available to process more requests, which may come from the same user session or, in most cases, from an altogether different user session. Using stateless processes is a common practice for web applications because they allow excellent scalability: a small number of stateless processes can handle requests coming from a large number of users.

Maintaining the Application state
So, if the Jservers are stateless processes: how is the application state maintained for each user session on the web? The short answer is: by caching data.

Panther Web automatically caches application state data, such as the values of hidden widgets, scroll state of widgets, and bundles.

Two modes of caching data are supported: embedding the cached data in the generated HTML code, or keeping the cached data on the server and embedding just a reference to the cached data in the generated HTML code.

Panther Web also provides functions to define and use context global variables from JPL code. Such variables are set by a specific user session and remain private to that user session.

Functions to store and retrieve data in HTTP cookies are also provided.

HTML Generation
As described previously, the application screens are dynamically rendered as HTML code to be presented on the browser. Panther automatically generates the HTML code for the screens and the widgets in them.

The HTML generated by Panther may need to be customized, mainly for 2 reasons: to fine-tune the visual appearance of the screen on the web and to integrate JavaScript code.

Using the Panther editor, the name of a pre-existing HTML document can be specified in the HTML-template property of a screen thereby providing the structure of the HTML generated for the screen. This allows you the flexibility to determine how the HTML for the screen is generated. The provided HTML template is tied to the Panther backend by embedding Panther-provided tags into it, thus specifying the exact location where the HTML code for the dynamic elements are to be included in the resulting HTML page.

Custom HTML properties can also be set for the individual widgets on a screen. These properties allow making additions or changes to the HTML attributes within the INPUT element that Panther generates for a widget.

These properties can also be used to hook in JavaScript functions and JavaScript libraries such as Dojo and jQuery.

To give you an example of the kind of things that can be done by customizing the HTML generation, see the screen shot of an application screen in the Panther editor.

By including the code shown below in the screen JPL, the attribute property of the Single Line Text widget called “i_odate” is modified before Panther generates the HTML for the screen:

When the screen is displayed in the browser, see how the widget is no longer displayed just as an input field, but as a Dojox calendar widget.

Navigation
GUI applications typically have menu bars that allow the user to navigate between screens. On the web, there is no natural replacement for menu bars and many alternatives are available for providing navigation controls on the web. During the conversion, it is necessary to select the one that better suits your needs.

Web Event Handling
You can provide JPL procedures with the names listed below, and those procedures get executed as events occur in a web application:
web_startup – This procedure is called when a Jserver process is started. The code to open the connection to the database is typically invoked from this JPL function and the database connection is maintained through the whole life of the Jserver process. This procedure can also be used to load public procedures and data used through the application, specify database error handlers, and define global variables.
web_enter – Each screen can have its own implementation of this procedure. It gets called after the screen entry event and before the web browser data is loaded into the Panther screen structure. This is only called once on each request submitted.
web_exit – Each screen can also have its own implementation of this procedure. This is invoked after all other events have been processed and immediately before Panther dynamically generates the HTML output for the request being processed.
web_shutdown – This procedure is invoked when the Jserver process is shutting down. This is where any required application clean up is typically invoked, including the code to close database connections.

Conclusion
Several approaches need to be evaluated when facing the prospect of making an existing Panther GUI application available on the Internet or an intranet.
This document has provided you with a glimpse of the differences between the two environments and has presented aspects of the application that need to be addressed during a conversion. Hopefully this information has piqued your interest about converting GUI applications to the web in general and the Panther Web product in particular.

Eduardo Ramos is a Project Manager at Prolifics. He has over 16 years of experience in the IT field, specializing in the development and migration of multi-tier applications using various technologies including Panther and the IBM WebSphere family of products.

Outsourcing IT

I’ve been thinking recently about the whole “Cloud” thing, “Cloud computing”, “Cloud hosting”, “Identity Management in the Cloud”, cloud-this and cloud-that. In an essence, it all seems be a business telling to its IT department – you are too expensive. We want to get rid of you, without getting rid of the services you provide.

Business knows that an IT department is important. It saves money in many ways, keeps the back-office running and helps in executing business processes. But in many organizations IT costs too much, with all its security, high availability, disaster recovery, compliance and support requirements. Business cringes seeing all the capital job proposals and budgets for IT spendings. This is why they are looking for an alternative. Say, an alternative, that gives the back-office support without having to worry about all the high-ticket items, like HA, DR and GRC. Items that IT seems to stick every year on the annual budget proposals. An this is exactly what the “cloud” tries to provide. The cloud is an abstracted business function, where all high-ticket IT items are spread over multiple clients and thus are cheaper to have for any particular client. The IT department, after all, is just a business paid expense, that has no real, intrinsic value all by itself.

The business, of course, wants the high level of service, the good “Service Level Agreement” to cover the needs of the business. This is where we enter the world of ITIL. The SLA’s the ITIL are a step in getting IT outsourced. An SLA’s without a extra value is a way to make IT separable, commoditizable. I am not saying they are bad. I am saying if you exceed at delivering the services on the SLA’s without bringing benefits to a business, you are no different than a third party outlet selling server time for a monthly fee.

So, before you dismiss the “cloud” business as yet another popular, but short lived word in the IT vernacular, think of the implications that this model has for the future of IT. There is a trend of businesses cutting back on the IT departments. I really see only one way for the IT department to survive this transition. IT can live on by becoming a cloud integration department. On the low level, someone needs to integrate in-house systems with the clouds during and after the transition to could based services. On the high level, someone needs to understand the business and to know how to map it to the services different clouds provide.

Granted, it may take a decade before the onslaught of the clouds, depending on how much push the business is doing toward cost-cutting, but start training up now for one of these roles, if you are working in an IT department.

PS. Yes, the cloud providers will need the IT skills to develop and maintain the cloud offerings, but the number of jobs will be much smaller compared to the in-house IT staff.

To see the original blog entry, please click here.

Alex Ivkin is a senior IT Security Architect with a focus in Identity and Access Management at Prolifics. Mr. Ivkin has worked with executive stakeholders in large and small organizations to help drive security initiatives. He has helped companies succeed in attaining regulatory compliance, improving business operations and securing enterprise infrastructure. Mr. Ivkin has achieved the highest levels of certification with several major Identity Management vendors and holds the CISSP designation. He is also a speaker at various conferences and an active member of several user communities.

Enterprise Single Sign-On Tug of War

A desktop based Single Sign-On solution is a joy to have, if you are a desktop user. Equally, it is a pain to have if you work for an IT department and have to support it. It looks like the middle line is very thin in many organizations and the way it moved often determines success of an Enterprise Single Sign-On implementation. Here is a quick list of the typical gripes and the responses one can provide to pull the rope to the ESSO favor.

• Desktop support team: Man, it replaces the Microsoft Gina. We need to provision it to all of the existing desktops, test it on our gold build, communicate with all the user population affected…It’ll take more than you think to implement it.
• Business: Ok, so let’s see how well you manage your assets. If you know them, can provision them and keep them homogeneous you should not have too many problems. If not, let’s work on the asset management first.

• Infrastructure: Users want to be automatically logged in to an enterprise app that is not covered by ESSO yet.  Now we’ve got to develop another profile. This is not easy. The development, testing and support will take a lot of time.
• Business: Yes, it is the on-going cost of the ESSO. Either engage the vendors, get the training and do it in-house, or outsource it.

• Infrastructure: Now we have to have staff to support another server, another database and a bunch of desktops.
• Security: Hey, but no more sticky notes under keyboards with passwords.

• Help desk: We are getting more calls about desktop apps incompatible with the ESSO.
• Business: The incompatible apps will have to be worked through with the desktop support and the vendors.

• Security: We do not want to accept the responsibility for accidentally exposing all personal logins people may store in ESSO, like passwords for web-mail, Internet banking, shopping, forums, you name it.
• Consultant: Set ESSO up with a personal, per-user key encryption. The downside though is if a user changes their passwords and then forgets their response to a challenge question, they will loose their stored passwords.

• Help desk: Everybody is forgetting their responses to the challenge questions. People are unhappy about having to lose their stored passwords.
• Consultant: Set ESSO up with a global key, and let the Security department worry about an appropriate use policy and the privacy policy.

• Security: We do not want to send people their on-boarding passwords plain-text in an e-mail or print them out.
• Consultant: Integrate your ESSO with an identity management solution and have it automatically distribute passwords to people’s wallets.

• Infrastructure: All the setup, configuration and support takes so much time!
• Business and End Users: Hey, it is nice not to have to type enterprise passwords every time. Helpdesk is getting less calls about recovery of forgotten passwords. It saves so much time!

The end of the story is that for every gripe, there is a good response demonstrating the value and the benefit of having an ESSO solution.

To see the original blog entry, please click here.

Alex Ivkin is a senior IT Security Architect with a focus in Identity and Access Management at Prolifics. Mr. Ivkin has worked with executive stakeholders in large and small organizations to help drive security initiatives. He has helped companies succeed in attaining regulatory compliance, improving business operations and securing enterprise infrastructure. Mr. Ivkin has achieved the highest levels of certification with several major Identity Management vendors and holds the CISSP designation. He is also a speaker at various conferences and an active member of several user communities.