SAML and Security

SAML and Security


Federation:
Federation describes scenarios in which no group or organization manages all users and resources in a distributed application environment. Instead, administrators in diverse domains must manage local security policies that support mutually beneficial transactions among their respective spheres of operation. In the world of distributed network services, the term refers to the need for trust agreements among decentralized security and policy domains. Federation lets access-management functions span diverse organizations, business units, sites, platforms, products and applications. Federation requires that an organization trust each trading partner to authenticate its own users' identities. In a federated environment, a user can log on to his home domain and access resources transparently in external domains, such as those managed by customers or suppliers, subject to various policies defined by home and external administrators.Federation used with a new security standard, the XML-based Security Assertions Markup Language (SAML). The standard defines XML/Simple Object Access Protocol-based protocol interactions that support real-time authentication and authorization across federated Web services environments. The standard defines request and response messages that security domains use to exchange authentication, attribute and authorization information in the form of trust-assertion messages about named users and resources. Users log on to their home domains through authentication techniques such as ID/password or Kerberos, and this authentication is communicated to a federated destination site through a SAML authentication assertion.

How SAML works

One of the most important of those security issues is user authentication - specifically, allowing a user to sign on or use multiple Web services from separate but affiliated sites, without having to authenticate himself at every step of the process. That's the job of SAML (Security Assertion Markup Language), an XML-based standard for authentication and authorization that provides a "single sign-on" so that people can be authenticated once and then be able to access multiple Web services. SAML allows each individual site to have its own mechanism for sign-on and authentication, but will allow sites to accept authenticated users from other sites.

Why SAML is needed

Before we take a look at how SAML works, let's take a look at why it's needed. Let's say someone visits an airline site with a Web services architecture, and reserves tickets after signing on and being authorized to buy the tickets. The site offers special deals with partner sites on hotel stays and car rentals, and so the user decides to make reservations with them. In order to make reservations with each of those partner sites without SAML, the person will have to sign on separately to each site, using different user names, passwords and authentication information. He also might have to enter special codes that say he is entitled to the special deals. But with SAML, the person would only have to sign on to the first site, and he would then automatically be authenticated via SAML at the affiliated sites.Even more problematic are complex B2B transactions done via Web services. Web services will most likely be used in automated transactions that involve multiple business partners, including manufacturers, distributors, packagers, suppliers and retailers. With no way to authenticate each partner and what they can and can't do in a transaction, these transactions won't be able to be done automatically. With SAML handling authentication, complex transactions can be automated without worrying about authentication problems.

SAML Implementation

So how does SAML tackle all this? At its base, SAML is nothing more than a series of XML-based messages that detail whether users are authenticated, what kind of rights, roles and access they have and how they can use data and resources based on those rights and roles. It will work with HTTP, SMTP, FTP and SOAP, among other protocols and technologies.

The three main components of the SAML specification are:

Assertions SAML has three kinds of assertions:
1. Authentication assertions are those in which the user has proven his identity.
2. Attribute assertions contain specific information about the user, such as his spending limits.
3. Authorization decision assertions identify what the user can do, for example, whether he can buy an item.

Protocol:
This defines the way that SAML asks for and gets assertions, for example, using SOAP over HTTP for now, although using other methods in the future.

Binding: This details exactly how SAML message exchanges are mapped into SOAP exchanges.

The assertions are exchanged among sites and services using the protocol and binding - and those assertions are what authenticates users among sites.

SAML in real life

How does SAML work in real life? Let's take a real-life example. Say someone logs in and uses a Web service, is authenticated and then wants to go to a partner site. With SAML, he can be authenticated at the second site without having to sign on. The nearby figure shows each step of the process:

Step 1 the user has authenticated himself with Site 1 and wants to visit Site 2. He clicks on a link to go to Site 2.In

Step 2, instead of being sent straight to Site 2, he is instead sent to the SAML service for Site 1.

Step 3 the SAML service appends a partner ID and a special handle to Site 2's URL in the user's browser.
For example, if the user wants to go to the site http://www.buymenow.com, after the SAML service appends the extra information, the URL might now be https://www.buymenow.com?SAMLart=. Note that the protocol has changed to the secure https instead of http. The user is redirected now to Site 2's SAML service, which examines the URL with the appended information. Based on the information in the URL, Site 2's SAML service communicates with Site 1's, and Site 1 sends along the authenticated identity of the user, along with any rights that the user has.

Step 4 the user is sent to Site 2, fully authenticated. The user can now perform transactions on the site just as if he had logged directly into the site.

The future of SAML

SAML is not yet a fully accepted standard. OASIS, the consortium that develops XML standards, is expected to accept the first official SAML standard this summer or late spring. Sometime in the fall, you can expect products to be available that can make use of the accepted spec.As with all standards, though, expect some problems. It's unclear whether a Web service built using an early version of SAML will be able to completely work with a Web service built using a later version. Considering that SAML 1.0 hasn't even been accepted yet, it's a moot point right now, but could be problematic in the future.A bigger potential issue is whether Microsoft will buy in to the spec. Even though Microsoft is an OASIS board member, it's working on its own separate authentication protocols, known as WS Security and WS License. If Microsoft decides to continue work on them and use them as an alternate to SAML, all bets are off as to how useful the protocol will prove in the long run.

AD and LDAP


Active Directory is a database based system that provides authentication, directory, policy, and other services in a Windows environment

LDAP (Lightweight Directory Access Protocol) is an application protocol for querying and modifying items in directory service providers like Active Directory, which supports a form of LDAP.

Short answer: AD is a directory services database, and LDAP is one of the protocols you can use to talk to it


Active directory is a directory service provider, where you can add new user to a directory, remove or modify, specify privilages, assign policy etc. Its just like a phone directory where every person have a unique contact number. Every thing in AD(Active Directory) are considered as Objects and every object is given a Unique ID.(similar to a unique contact number in a phone directory.

Ldap is a protocol specially designed for directory service providers. Windows server OS uses AD as a directory server, AIX which is a linux version of IBM uses Tivoli directory server. Both of them uses LDAP protocol for interacting with directory.

Apart from protocol there are LDAP servers, LDAP browsers too.


reference: http://searchsoa.techtarget.com

ESB Tutorial

ESB Tutorial

Our ESB tutorial provides the tips, expert advice, definitions, implementation examples, trends and news you need to get started with or optimize the performance of an enterprise service bus.

Table of Contents
Introduction
What is an ESB?
ESB tips and expert advice
ESB news and trends
How to use an ESB
ESB products


Introduction
The enterprise service bus (ESB) is a software infrastructure that facilitates application integration. An ESB is valuable to the implementation of a service-oriented architecture (SOA) because it exchanges messages, executes transactions, orchestrates services, and performs publish and subscribe functions between disparate and distributed applications.

The ESB was created to meet demands and avoid common problems that other enterprise application integration (EAI) platforms could not. The popular hub and spoke EAI platform, in which all integrated applications work through a single message broker, creates a single point of failure, an incredible risk for a complex business system. The ESB, though, has numerous brokers, and so avoids this risk.

The ESB is also more suited for SOA. Unlike the hub and spoke platform, an ESB facilitates the loose-coupling of systems and the use of open-standards, two features of most successful SOA implementations. Despite these advantages, there were initial doubts about whether the ESB would be only a brief fad. Nicholas Farges' addressed this question when the ESB first appeared widely in 2003, and his assessment remains an excellent introduction to the ESB platform.

One of those doubts arose from the necessary intricacy of an ESB. Some viewers worried that implementing an ESB would only exacerbate the complexities of service orientation. As an SOA initiative matures, though, the myriad benefits of the ESB become evident: Security, agility, availability, and other key characteristics of EAI all improve once an ESB is in place. Contrary to common fears, the ESB can simplify SOA.

While an ESB can help, it's still important to choose the right one. A lightweight ESB can be implemented quickly and inexpensively, so it's often favored by developers working under tight deadlines and tight budgets. Their architect counterparts, though, may have a long-term vision and desire a more comprehensively functional ESB to support a broad SOA strategy. According to a recent Forrester Research report, the right lightweight ESB can satisfy developers and architects alike.

While many organizations are choosing which kind of ESB to implement, many vendors are choosing which kind of ESB to produce. The open-source ESB has grown popular with vendors as they face price pressure from the market and seek to cut development and support costs. Several significant mergers and acquisitions have accelerated the trend.
Back to the top

What is an ESB?

ESB definition
An enterprise service bus (ESB) is a software architecture for middleware that provides fundamental services for more complex architectures.

EAI
Enterprise application integration (EAI) is a business computing term for the plans, methods, and tools aimed at modernizing, consolidating, and coordinating the computer applications in an enterprise.

Enterprise Service Bus (ESB): Lasting concept or latest buzzword?
Nicholas Farges took a close look at the ESB shortly after it was conceptualized. His thorough introduction and analysis remain valuable six years later to anyone who considers using an ESB.

Open source and ESBs
The Enterprise Service Bus [ESB] has been intrinsic to many SOA programs in recent years. You can say you are doing SOA and not have done an ESB. But there is a high likelihood a successful SOA program includes successful ESBs.

Some notes on ESB configuration
For many people, "SOA" is "ESB." But, the definition of ESB is a moving target—it started rather as a "three-ring binder" of accepted corporate integration practices, and now has taken the form of a service architecture that holds various middleware types. The term "bus" is used to allude to the hardware bus that connects chips on printed-circuit computer boards in the realm of hardware. Messaging continues to be the primary service that ESBs provide, and many of them use Java as the language of choice.
Back to the top

ESB tips and expert advice

The ESB and its role in application integration architecture
Although enterprise service busses (ESBs) are not new, they can continue to be a nexus for confusion. After many years and many implementations, what they do, how they do it and whether specific products can help create a SOA are all still matters of contention. Understanding the ESB remains an industry-wide quest.

Jeff Genender on SOA infrastructure
Jeff Genender is an active committer and Project Management Committee (PMC) member for Apache Geronimo, a 'committer' on OpenTerracotta, OpenEJB, ServiceMix and Mojo (Maven plugins), and the author of several books. In this interview, Genender shares his take on SOA infrastructure. He includes message buses, containers, orchestrators and more in his definition, but pays particular attention to ESBs.

Open source licenses explained: caveats and comparisons
There are many pitfalls awaiting enterprise software development shops that use open source code without first setting down a clear strategy, according to Protecode CEO Mahshad Koohgoli. n this Q&A, Koohgoli discusses dual licensing and how companies use some of the more common open source licenses available.

Three tips for choosing an ESB
Jess Thompson, Research Vice President at Gartner, provides his top three tips on getting on the bus.

An open source ESB can cost you
Open source software can theoretically be acquired for free, and CIOs are attracted to products where they don't have to show a capital expense. However, an open source ESB can still have a cost. Read this to find out the risks of an open source ESB.

Use an ESB to simplify the complexity of SOA
Why add yet another moving part into the service-oriented landscape? Isn't management of service-oriented applications already too complicated? The reasons for introducing an enterprise service bus are the same as those applied when choosing to implement an enterprise application integration strategy some years ago. Learn how an ESB can simplify SOA.

Is a lightweight ESB right for your SOA?
It's a classic conflict: Developers focused on a project and facing deadline pressure want to use a lightweight enterprise service bus (ESB), while enterprise architects have to look at the long-term impact on the service-oriented architecture (SOA) environment. Learn when one is better than the other.

Data Services for ESB's
Some ESBs are adding MDM/data services capabilities (e.g. Sun, WSO2). We ask an expert: Do you think that's something an ESB should be doing or is this functionality that's best handled outside a service bus?
Back to the top

ESB news and trends

Cloud Silos and the role of ESBs in the cloud
MuleSoft is prepping its iON cloud platform for a public performance. It features an ESB engine that is said to support orchestration and more flexible data handling than point-to-point cloud computing integrations.

In 2010, cloud computing met ESBs, data caches, services and more
Cloud took on the look of middleware architecture in 2010. Cloud poster child Salesforce.com expanded beyond its original Apex language support, buying Ruby-based cloud house Heroku and forging a development deal with VMWare's Spring application framework group.

Forrester analysts: SOA still strong
Businesses that already use SOA are expanding their SOA initiatives and new businesses are starting to adopt SOA and to implement SOA technologies. The first-time SOA infrastructure purchase may be shifting from ESBs to other technologies.

ESBs in the cloud: Tricky in the early going
Stratos SOA platform maker WSO2 has announced a retooled version of its enterprise service bus (ESB) along with other middleware for cloud computing environments, it begged the question: What do IT shops need to know about ESB implementation in the cloud?

ESB watered down by EAI, but distinction remains
The definition of ESB has lost some of its distinction as a distributed architecture, says Progress software's Hub Vandervoort. Read what differentiates a barebones ESB from one that evolved from earlier EAI concepts.

Is open-source remaking the ESB market?
The enterprise service bus (ESB) market is evolving as open source players enter it, but as in biological evolution, it appears to be a matter of adapting to survive.

SOA complicated by ESB proliferation
Enterprise service bus (ESB) intermediation remains an issue despite the adoption of WS-* standards, argues John Michelsen, chief architect at iTKO Inc., the testing vendor specializing in service-oriented architecture (SOA).
Back to the top

How to use an ESB

Message brokering as part of an approach to flattening the problem of diverse mobile device support
Mobile devices keep growing more numerous. As they grow in numbers, they also grow in variety. It can be difficult to develop applications that work with all these devices. Employing an ESB as a message broker between the devices and the applications can simplify compatibility issues.

FAA uses open source ESB to handle flight data
Last year the Federal Aviation Administration (FAA) selected an open source enterprise service bus (ESB) to provide integration support for a system that uses Web-based services to handle flight and weather data for airlines. Earlier this year, a SWIM Prototype became operational at the FAA's William J. Hughes Technical Center in Atlantic City, NJ.

U.S. Coast Guard adopts SOA and ESB to better track ships at sea
As it moved in recent years to SOA and a full enterprise architecture, the U.S. Coast Guard sought to upgrade legacy systems' operation. The thinking was that, for a SOA implementation to be successful, an organization does well to get used to sharing data across multiple channels. With the SOA conversation beginning in early 2007, the USCG actually began producing new systems this past January with its new enterprise service bus (ESB).

User combines open source ESB with data services to speed customer reports.
Generating customer reports is the bane of most development operations. These requests flood development groups. The issue has only grown worse as organizations compile more and more data, and users more imaginatively ask 'what if?,' further taxing programmers' time. Read this article to learn how one company has taken a data services approach to solving the problem, at the same time implementing a type of Web services mashup to address user needs.

SOA integrates university's ERP project
Service-oriented architecture (SOA) allows departmental developers working on a variety of applications at the various campuses and facilities of the University of Illinois to provide data access without worrying about the data sources. Read why all that data is now available from the ESB for Ajax and rich Internet applications (RIAs) developed for the University of Illinois campuses in Champagne-Urbana, Springfield and Chicago, as well as the online campus.
Back to the top

ESB products

ESB IDE offers “round trip” editing
ESB developers could laboriously hand code or they could adopt tools from vendors that could speed up the process but at a cost – the tools could themselves be complicated and they tended to obscure access to underlying code. An IDE seeks to address this concern.

Oracle details SOA, Java roadmap with BEA
BEA customers will not be forced to migrate to Oracle Corp. middleware products, Charles E. Phillips Jr., Oracle's president, said when he outlined plans for the integration and support of the two companies product lines in July 2008. The integration includes in innovative convergence of Oracle's ESB and BEA's Aqualogic bus.

Eclipse group releases Swordfish, an open-source ESB
Recently at EclipseCon, the Eclipse Foundation formally released Swordfish, an enterprise service bus (ESB) based on OSGi. It joins a host of other open ESBs, including OpenFuse, Mule, and others.

Open source/commercial ESB hybrid reflects SOA reality
Iona Technologies Inc. today announced its own hybrid model for selling Artix, its closed source enterprise services bus (ESB), and FUSE, its open source ESB based on technology developed by the Apache Foundation.

FUSE ESB brings Apache ServiceMix 4.0 to market
In its first product release since formally becoming a division of Progress Software, Iona has announced FUSE ESB 4.0, a commercial version of the Apache ServiceMix 4.0, open source enterprise service bus (ESB). The software seeks to combine the openness of open source with the rigor of some commercialization.

http://searchsoa.techtarget.com/tutorial/ESB-Tutorial

ESB-Integration Comparison

soa-patterns

Call Management for IVR, CRM and other components:

Call Management for IVR, CRM and other components:

CTI or Computer Telephony Integration is most important piece in an ICM environment.

Example:
CTI events are a key to keeping track of all the calls coming in and out of the call center.
For example, every time a call rings an agent's phone, a "CALL_DELIVERED" event is generated and sent over the CTI connection. Every time an agent answers a call, a "CALL_ESTABLISHED" event is generated and sent over the CTI connection. Several types of events exist and act as triggers for any application that might be listening to the communication. The CallID is also used to match up the voice call with the data so that the two elements do not get separated while traveling between multiple peripherals.

The CTI connection allows the call routing infrastructure to monitor the status of the telecom peripherals on the network. Since all the peripherals have CTI connections, the call router can verify if a destination peripheral is online and available before making a decision to send a call to it. An example would be an emergency situation such as power outage in a call center. The call router has the ability to determine (sending by heartbeats down the CTI connection). If a response is not returned within a specific time interval, the call router will automatically re-route calls to a different call center.

VRU
Voice Response Unit, is a combination of a computer that runs voice applications and hardware that allows it to communicate with the caller. Its primary function is to answer calls and provide voice menus to callers that allow them to service themselves without agent interaction.

Example:
In a healthcare insurance card member and provider, VRU is the peripheral that customers interact with that prompts them to enter a card number over the telephone. In latest environments it is not uncommon for the VRU to be equipped with voice recognition hardware that allows the customer to navigate through the menus by speaking instead of pushing the buttons on a telephone. Text-to-speech technology which speaks dynamically created content back to the customer such as account balances, telephone numbers, and addresses.
The hardware associated with a VRU usually consists of an operating system, incoming telephone lines and a CTI link connecting the VRU to other peripherals on the network.

VDN
Vector Directory Number, is an extension to devices that employees are used to dialing in an office environment. It usually consists of 4 to 6 digits, and is only connectable from inside the company's voice network. Every VDN is associated with a vector or multiple vectors. Vectors are programming steps that allows the switch to logically manipulate the call.

Example:
A vector might have a step that plays an announcement, collects touch-tone digits, routes the call to another VDN, or most importantly queues the call to a skill group.
Skill groups are agents that are grouped together because they have the same skill sets.
When the ACD queues a call to a skill group, it places the caller on hold and waits for an agent with specific skill set to become available to answer the call. When an agent in the skill group becomes available, the call is transferred and the agent services the customer.

ACD
Automatic Call Distributor is a telephone switch that sits at the front of a company's voice network. All calls arriving from the network carrier gets delivered to the ACD using TDM (Time Division Multiplexing).

The ACD has CTI connectivity through hardware blades MAPD that allow it to communicate with other peripherals on the network.

TDM
Time Division Multiplexing, is a process of taking multiple phone lines from the carrier and multiplexing the information into a single transmission where each frame is sent in specific time slots. When then transmission reaches the destination site, the information is de-multiplexed back into individual phone lines.

PBX
Private Branch Exchange is a private telephone network used within a company. The users of the PBX phone system share a number of outside lines for making external phone calls. A PBX connects the internal telephones within a business and also connects them to the public switched telephone network (PSTN).

PSTN
Public switched telephone network

MAPD
The ACD has CTI connectivity through hardware blades known as the Multi-Application Platform on Definity (MAPD –it is an Avaya product) that allow it to communicate with the other peripherals on the network.

High Level Call flow through IVR and Pega using various other components are mentioned in the above diagram.

Note: there is other similar product in the market that provided the connectivity to CTI.

Enterprise Integration - SOA vs EAI vs ESB

Enterprise Integration


WebSphere Message Broker:

WebSphere Message Broker is capable of understanding the content of message that it moves through the Broker. Customers can define the set of operations on each message depending on its content. WebSphere Message Broker are capable of processing messages from various sources (data transformation, data translation, Protocol Transformation), such as Java Message Service (JMS) providers, HyperText Transfer Protocol (HTTP) calls, or data read from files. By connecting these nodes with each other, customers can define linked operations on a message as it flows from one application to its destination.
Message Broker can do the following:

• Matches and routes communications between services
• Converts between different transport protocols
• Transforms message formats between requester and service
• Identifies and distributes business events from disparate sources

Capabilities WMB

1. Message routing
2. Message transformation and enrichment

•     Publish/subscribe
•     Point to Point

IBM Enterprise Service Bus:

WebSphere Enterprise Service Bus (ESB) is a flexible connectivity infrastructure for integrating applications and services. An ESB provides the connectivity to implement a service-oriented architecture (SOA), reducing the complexity of integrating applications and services. With WebSphere ESB

It provided the connectivity between heterogeneous applications, data flow, message flow, protocol transformation, connectivity between mainframe, java application, SOA supports, service enabling. 

IBM Integration Bus:

IBM Integration Bus is designed to solve integration requirements between back-end systems, from simple point-to-point connectivity to sophisticated topological using SOA patterns such as ESBs. It has built-in connectors that enable integration between web services, files, databases, packaged applications such as SAP and Microsoft® Dynamics CRM, variety of configuration and transformation options such as graphical mapping, Java™, and Microsoft .NET®.

IBM Integration Bus incorporate an increasing number of integration use cases, such as BPM, business rules, Microsoft .NET, and workload management. Migration from WebSphere Message Broker to IBM Integration Bus is a simple version-to-version upgrade. it provides a single command to migrate between the two environments.

IBM Integration Bus incorporates WebSphere ESB use-cases, with WebSphere ESB capabilities folded into IBM Integration Bus in time. 

IBM Integration Bus complements WebSphere DataPower integration gateway products, which are designed for all edge-of-network scenarios.

IBM Integration Bus Developer: 
It is used by developer and it only use for development purpose. It can migrate to other version of IIB easily.

IBM Integration Bus Express:
is an entry level enterprise service bus (ESB) at a low price point for developmental projects, small and midsize companies. 

IBM Integration Bus Standard:
IIB Standard is a flexible, scalable ESB for small to medium size projects.

IBM Integration Bus Advanced:
It supports businesses of any size can eliminate point-to-point connections and batch processing regardless of platform, protocol or data format. This has full capabilities of ESB

Conclusion:

WMB was the initial version of one of product for message routing and message transformation. 

ESB infrastructure based on SOA ESB design pattern, which have other capabilities other than such as data translation, data flow, protocol transformation, service enabling, connectivity between heterogeneous and desperate system

IIB, this is an advanced version of software which does have all the features which have ESB and WMB. it does have BPM, BPEL capabilities. Systems, protocol, database etc. can be connected using IIB from end.

Developing BPEL processes with Integration Designer

IBM Integration Bus (WMB) 
It is Strategic Integration Technology to replace all other IBM ESB related products.

Hub and Spoke:
          SOA vs EAI vs ESB

Some other details:

1. IIB and ESB Details
2. IIB
3. DataPower vs Message Broker
4. IBM-integration
5. IIB and WMB
6. two-way SSL for Message Broker and Integration Bus
7. FAQ - IIB and WMB
8. Difference between WMB and ESB
9. ibm-integration-bus

Cloud Computing?

This subject is very vast area and it does have lot of components (Servers/Data center/Infrastructure etc.) and entities (CRM/BPM/SOA etc.) involved to make Cloud computing (IT/Services) available.

Cloud Computing help to reduce the operation cost for customer to maintaining the hardware (IT/Data center/Servers), software (Services) and new changes for customer.

What is Cloud Computing?
Cloud computing is virtualized resources are leveraged to serve as a platform for Internet-based software, infrastructure and/or services. It is highly scalable, robust, high availability, universal accessibility, easily customization.

Cloud Computing Architectures and Services

Cloud architectures are divided into different categories based on user access and ownership:

Public Clouds:

It hosts of pay-per-use, virtualized servers by third-party cloud vendors/service providers. This managed by a third party. This is like leased servers/services as per need basis. It is also called external cloud. It will maintain and customized by third party on request basis.

Private Clouds:

A virtualized IT infrastructure that hosts services for employees and is managed by an organization’s IT staff, shifting the IT department’s primary role from service and maintenance to service provider. It is also called internal cloud. In a private cloud, all data remains under the full control of the host organization.

Hybrid Clouds:

The integration of on-premises IT infrastructures and internal cloud applications with applications and information deployed to a service provider either on a temporary or permanent basis. This model enables an enterprise to serve as its own cloud provider as well as a host for outside applications.

Cloud computing system architecture (CCSA), It offerings are divided into four additional categories:

Platform-as-a-Service (PaaS):

A full or partial development and deployment environment that supports online access and collaboration.

This type of cloud enables developers to leverage a robust developing environment – via an IT infrastructure – without the necessary investment in hardware and additional management personnel.

Infrastructure-as-a-Service (IaaS):

A comprehensive computer infrastructure (servers, storage, software and networks) made accessible to users via the Internet.

Software-as-a-Service (SaaS):

Software applications – including complex customer relationship management (CRM), SAP, financial applications and enterprise resource management (ERM) programs – accessible via the Internet. These solutions are available through the dedicated SaaS provider.

Desktop-as-a-Service (DaaS):

PC desktop virtualization for single-user clients. Facilitates virtualized access to an individual workstation, including operating system interfaces and built-in storage hardware.

Opinion about Cloud:

Ther are multiple views and multiple thoughts. It will compare as offshore BPO, offhsore data management and similar.

In my opinion security is the major issues and concerned about every company it could be banking, finance, Healthcare or similar. These companies have many laws and regulatory about their data sharing more about their data stealing.

Currently all the data, network, hardware, software, security system and all stuff is owned by individual companies and still there are data theft, data stealing, individual security theft and many more cases and here i am referring to big name like Citi bank, Google and many more.

So in this case i really think cloud as a service will succeed in the long run.

Reference:
http://www.infoworld.com/d/cloud-computing/what-cloud-computing-really-means-031

Agile- Scrum

Agile and Scrum?

Agile is like a match box and Scrum is one of the stick type in match box. So Agile is umbrella and scrum comes under that. There are many other sticks like extreme programming and so on.

What is Scrum? Is it process, is it methodologies or it is some magic?

Scrum is not a process and it does not dictate anything.

It is kind of framework and it consists with different roles Product owner, Scrum Master and team.

I will define all these roles later.

Scrum also consists with certain more information likes sprints, scrum estimation, burnout chart, retrospective, adapt and review, scrum meetings, product backlog, sprint backlog.

Release planing metting:

This meeting will eastablised a plan and goal for scrum team.

This meeting will also set the expectation how scrum team can satify the customer and thier ROI.

Sprint planing metting:

This meeting is consist with 2 parts

1. agreement for When what will be done in the sprint for sprint backlog.
2. When the Scrum team will start going to build sprint backlog into a product increment during the sprints.

Product backlog:

It is the all the requirements which is provided and priorities by product owner. Each and every product backlog detailed out. So each backlog can have multiple steps or features.

Sprint:

A projects can have multiple sprints. A sprint can have max 4 weeks time frame. A sprint is time boxed. It will have predefined time for product backlog. A sprint can have multiple features. Team needs to finish the sprint backlog in a sprint.

Sprint backlog:

All features which needs to be cover under the single sprint called sprint backlog.

Scrum Meeting:

Scrum team is require scrum meeting every day and it can not be more than 15 minutes.

It will have folllowings:
1. What has been done since last meeting.
2. What is the plan before next meeting
3. Is there any obstacle/pidement

Scrum review:

Team needs to review the after every sprints to what have been done in current sprint.

This meeting will have scrum team, stakholders to decide what has been done and what needs to be done in next sprint. So in this product backlog can be updated and the priority of the product backlog can be change for next sprints.

Retrospective

Scrum Team needs to covers the better process or method or practice which can improve team performance.

Burnout chart:

How much work have been left after each sprint so team can find out after each sprint how much features have been left.

Scrum estimation/timelines:

It depends on a print cost, how many features will cover in each sprint. How many sprint during the projects. How many peoples are in the team?
Note: Team can not be more than 7(+ , _ 2).

Product Backlog refinement:

Team will do the next sprint product backlog analysis so they can make sprint backlog for next sprint.

Product owner:

Normally this role can perform by anyone in the team but scrum master can not be the Product owner.

Team:

It is set of individuals peoples; they are owner of their work. Team will have developer, tester, architect, BA.

Scrum Master:

Who is responsible to implement the scrum framework in the team, He is not project manager and not responsible to assign the work to the team. A developer can be a scrum master. A scrum master can be dedicated to multiple sprints.

Scrum Artifact:

Product backlog
* All the requirements, order can be defined by Product owner.
Release burndown

* It is graph records the sum of remaining product backlog estimated effort across time.

Sprint backlog
* The requirements consites of the tasks the team perform duringa single sprint.
Sprint burndown

* It is graph records the sum of remaining sprint backlog estimated effort across sprint time.

Velocity:

It is efforts for a single sprint.
each sprint will have sprint backlog and every tasks in the sprint backlog will have some points and than total of the points will be called as a sprint velocity.

Let assume i have velocity in a single sprint is 12

Total point in project = 96

Total sprint required = 96/12 = 8

Buffer - 25% = 8*25/100 = 2

Pre-relased sprint = 1

Total sprint = 8+2+1 = 11 sprint for complete product backlog

MEGA and SOA-

MEGA is well defined requirement, process and modeling tool. It makes any organization to defines their Organization structure, their processes, IT Services, infrastructure solutions etc. All these various components can have single view. It has capability to combines various components into a well defined model. This newly model will be SOA comply.

So yes MEGA can be used as a SOA compliance tool for any organization.

This product is based on BPNM. It is based on Microsoft Visio. It can be used as files system or any databases (not sure about DB2). All the changes can be move from one desktop to another easily. It can have images, documents. It can be connecting to external system which is based on the request; MEGA will provide those external interfaces.

MEGA can be used as a defining your use cases, class diagram (data model -MEGA terminology), activity diagram, sequence diagram (interaction diagram).

It has business layer, application layer for different purposes.

It is very light weight and can be used in any organization.

www.mega.com