Method and apparatus for managing web services within a computer network system

[0001] This application claims priority pursuant to 35 U.S.C. §119(e) to U.S. Provisional Application No. 60/376,101, filed Apr. 25, 2002, for Method And Apparatus For Managing Web Services Within A Computer Network System.

[0002] 1. Field of the Invention

[0003] The present invention relates to the field of a computer network system and, in particular, to a method and apparatus for managing Web Services within a network system.

[0004] Portions of the disclosure of this patent document contain material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure as it appears in the Patent and Trademark Office file or records, but otherwise reserves all copyright rights whatsoever.

[0005] 2. Background Art

[0006] In general, a web is an unstructured network system that uses HyperText Transfer Protocol (HTTP) as its transaction protocol. The World Wide Web comprises all HTTP nodes on the public Internet. An internal web comprises all HTTP nodes on a private network, such as an enterprise's Local Area Network (LAN) or Wide Area Network (WAN). If the organization is a corporation, the internal web is also a corporate web.

[0007] Note that internal webs, also known as intranets, are only logically “internal” to an enterprise. Physically, they can span the globe as long as access is limited to a defined community of interest.

[0008] Web Services generally provide access to applications and data over the web through a platform independent, standards-based transport mechanism called Simple Object Access Protocol (SOAP). These services can describe themselves through an eXtensible Markup Language (XML) document formatted using the Web Services Description Language (WSDL).

[0009] Referring now to FIG. 1, the intranet 10 within an enterprise 1 are typically separated from the Internet 30 through a firewall 20. Basically, a firewall 20 is a barrier to keep destructive services on the public Internet 30 away from the intranet 10.

[0010] Referring now to FIG. 2, the machines on a service-orientated network can be categorized as two types: servers (130, 140, 150 and/or 160) and clients (110). Those machines that provide Web Services to other machines are servers (like Net servers 150, JAVA servers 130 or Mainframe servers 160); the machines that are used to connect to those services are clients 110. It is possible and common for a machine to be both a server and a client, but for purposes here the machines are referred to as one or the other.

[0011] Referring now to FIGS. 1 and 2, the advent of service-oriented network has provided an enterprise 1 the unprecedented ability to integrate with internal machines and externally provided services. However, this integration created problems for the enterprise 1 as to how to manage both these internal machines within the intranet 10 and the externally provided services (e.g., services on another intranet or the Internet). Current Service Oriented Architecture (SOA) has yet to develop an extensible and pluggable system to manage these machines and/or services, such as managing the security risk and/or the performance and availability of the services provided by the servers. Thus, there is a need for an enterprise 1 to develop a system to manage its SOA in an extensible and pluggable way.

[0012] The present invention is directed to a method and apparatus that manages Web Services within an enterprise having an intranet. In an embodiment of the present invention, a Management Server (MS) is connected with a Management Server Client (MSC) via a network. The MS and MSC work in concert to manage Web Services by providing performance monitoring, security, contract and Service Level Agreement (SLA) management, and other performance enhancements amongst other things with the enterprise in a unique, pluggable, expandable architecture.

[0013] In another embodiment of the present invention, the MS is connected to a MSC via a network using a Web Services Application Programming Interface (API). The MSC is connected with a server for providing Web Services to a client. The Web Services are provided to the client through the MSC. The MS provides configuration data to the MSC on how to manage the Web Services provided through the MSC.

[0014] In yet another embodiment, the MS is connected to a plurality of MSC's. Each MSC is connected with a plurality of servers. Each of the servers can provide Web Services to a plurality of clients. The Web Services are provided to each client through at least one MSC.

[0015] In a further embodiment, the Web Services from a server are provided to a client through a MSC that is connected to the server.

[0016] A more complete understanding of the present invention will be afforded to those skilled in the art, as well as realization of additional advantages and objects thereof, by a consideration of the following detailed description. References will be made to the appended sheets, which first will be described briefly.

[0029] The invention is a method and apparatus for managing Web Services within a network system of an enterprise and between enterprises. In the following description, numerous specific details are set forth to provide a more thorough description of embodiments of the invention. It should be apparent, however, to one skilled in the art that the invention may be practiced without these specific details. In other instances, well known features have not been described in detail so as not to obscure the invention.

[0030] Referring now to FIG. 3, in an embodiment of the present invention the Management Server (MS) 220 exists within an enterprise 1 and is connected to the intranet 10. The MS 220 is connected with a plurality of connected Management Server Clients (MSC's) 210 via the intranet 10. The MSC's 210 intercept Web Service calls from the client 110 to the servers 120. This allows the MS 220 to manage and collect statistics from the MSC's 210 that could potentially exist anywhere on either the intranet 10 or the Internet 30. In FIG. 3, the MSC's 210 are shown intercepting Web Service calls between the client 110 and the servers 120. The Web Service calls are shown conceptually and actually occur over intranet 10 and Internet 30.

[0031] Referring to FIG. 4, the MS 220 is connected to the MSC's 210 via the intranet 10 using a Web Services Application Programming Interface (API) 130. This API 130 is secured by allowing only licensed MSC's 210 to enter.

1. Management Server

[0032] In one embodiment, the Management Server (MS) allows an enterprise to manage its enterprise SOA. The MS contains features and functionality that are vital for the management of Web Services. For example, the MS should be Universal Description, Discovery and Integration (UDDI) Standards compliant. It should be customizable with Meta-Data Schemas to enhance the UDDI schema. It should be able to collect and display service performance and service availability statistics and have the ability to perform service ratings and reviews. It should have the ability to perform service contract management, service certification, service level agreement (SLA) management. The MS should also provide for enterprise security integration and service authentication and authorization, as well as provide the data for Management Server Client (MSC) and component pipeline configuration.

[0033] The Management Server (MS) is UDDI compliant. That is, the MS provides for the data schemas and interfaces laid out in the UDDI specification (e.g., the standard in the UDDI Version 2.0 specification).

[0034] UDDI is a registry that contains an industry-wide directory of Web Services. UDDI categorizes each service based on business, service and service type association for easy location by browsing or searching through the UDDI. Because UDDI is based on industry standards, it is a completely cross-platform device from which the large majority of the technical industry can benefit. Business is defined under the UDDI specification as a group that owns and maintains a particular Web Service within the UDDI. Service is defined as the particular Web Service that will be used by others. Service type is defined as a description of the type of service. For instance, “e-commerce” would be the service type for a “shopping cart” Web Service.

[0035] In one embodiment of the present invention, the Management Server is a system to provide for the management of a corporate SOA within the intranet. It does this through a plurality of Management Server Clients as shown in FIG. 3.

[0036] The Management Server also allows a user to customize UDDI Schema. The UDDI Schema is a published, open standard that specifies a way to store and search for Web Services within a SOA. The Management Server allows the user to customize the UDDI Schema while maintaining compliance with the standards.

[0037] In addition, referring now back to FIG. 3, the Management Server (MS) manages a contract between a server 120 and client 110, as well as associating a specified Service Level Agreement (SLA). The SLA specifies the quality of service that supports the contract and the MS manages the failure of the SLA and termination of the contract.

[0038] The Management Server is built using technology known to those skill in art, such as J2EE technology.

[0039] FIG. 5 shows the architecture of the Management Server (MS) at a logical component level. The MS 220 has three data stores; the UDDI Server 301, the XML Data Store 302 and the Database 303. These data stores are pre-existing and provide the data required for the presentation and management aspects of the MS functions. The UDDI Server 301 and XML Data Store 302 provide all the informational content regarding the businesses, services, and service types defined in the UDDI and registered in the MS. The Database 304 contains all other information regarding contracts, SLAs, users, Monitored Access Points (MOA's) and all other performance and management data for the MS and MSC.

[0040] The Content Director 310 is used to combine data from the XML Data Store 302 and the UDDI Server 301 in a format that allows the user to modify the data stored while maintaining the UDDI compliance of a sub-set of the data.

[0041] The Security Integration Framework 303 is built using technology known to those skilled in art, such as the technology available from the Java Specification called Java Authentication Authorization Services (JAAS). JAAS is used to connect the Management Server 220 to the intranet data sources through open standards. The Security Subsystem 330 then uses this data to securely authenticate the user when he/she logs onto the MS User Interface 370.

[0042] The Data Access Objects (DAO) Layer 340 is used to access data present in the database 304 and is built using technology and design patterns known to those skilled in the art. The Controller 360 and User Interface 370 present data to the user and control the user's interaction with the MS. The API 130 is the same API 130 shown in FIG. 4 and is used to manage and collect data from the MSC's for presentation to the user and storage in the Database 304.

[0043] FIG. 6 illustrates the domain object model for the Management Server 220 shown in FIG. 5. The domain object model shows in detail the relationships between the entities in the system. Referring now to FIG. 6, the User 401 has associated services, businesses and service types, which are all UDDI Entities 402. Essentially, this builds up the user's profile. Each UDDI Entity 402 has associated Meta Data 409 that could be ratings, reviews and any other meta information.

[0044] A User 401 also has Service Contracts 403 with specific Monitored Access Points 406, each of which is associated with a Service Level Agreement 404. The Monitored Access Points 406 are the network locations at which the services are made available. Each Monitored Access Point 406 has an associated Management Server Client 407 that is responsible for controlling access and managing the service from a server to a client.

[0045] There are two types of events in the MS, namely Contract Usage Events 405 and Access Point Monitor Events 408. These two types of events, respectively, record usage of Contracts 403 and Monitored Access Points 406.

[0046] A. Customizable UDDI Schema

[0047] Referring now to FIGS. 5 and 8, the Content Director 310 is used to combine data from the XML Data Store 302 and the UDDI Server 301 in a format, allowing the user to modify the data stored while maintaining UDDI compliance of a sub-set of the data.

[0048] The UDDI is an open, published standard; compliance with UDDI by the MS must be guaranteed while maintaining sufficient flexibility for the needs of an SOA within an enterprise. Referring now only to FIG. 8, in one embodiment of the present invention an XML document format known as Digital Evolution Markup Language (DEML) 603 was developed by the current inventive entity. The DEML 603 contains all the display properties for an HTML page. This, therefore, drives the presentation of the HTML form 623 and stores the attributes (not the data) for the custom fields that the user has defined. The Document Type Definition (DTD) for this document format is shown below:

[0049]

DEML DTD Document
	<?xml version-“1.0” encoding=“UCS-2”?>
	<!ELEMENT Path EMPTY>
	<!ATTLIST Path
	source CDATA #REQUIRED
	pathId CDATA #REQUIRED
	required CDATA #REQUIRED
	repeated CDATA #REQUIRED>
	<!ELEMENT Paths (Path) * <
	<!ELEMENT Label (Phrase) >
	<!ELEMENT Attribute EMPTY>
	<!ATTLIST Attribute
	name CDATA #REQUIRED
	value CDATA #REQUIRED>
	<!ELEMENT Phase (#PCDATA) >
	<!ATTLIST Phase language CDATA #REQUIRED>
	<!ELEMENT Data (Phase) >
	<!ATTLIST Data selected CDATA #REQUIRED>
	<!ELEMENT DisplayProperties ( (Attribute) +,Data) >
	<!ATTLIST DisplayProperties
	editable CDATA #REQUIRED
	type CDATA #REQUIRED>
	<!ELEMENT Validation EMPTY>
	<!ATTLIST Validation required CDATA #REQUIRED>
	<!ELEMENT Field (Paths, Label, DisplayProperties, Validation)>
	<!ATTLIST Field
	xmltag CDATA #REQUIRED
	indexed CDATA #REQUIRED
	identifier CDATA #REQUIRED
	type CDATA #REQUIRED>
	<!ELEMENT CatalogDefinition (Field) + >

[0050] And an example of an implementation of the above format on the XML document is shown below:

[0051]

DEML XML Document
<Field xmltag=“company” indexed=“no”
identifier=“no” type=“attribute”>
	<Paths>
	<Path source=“uddi” pathId=“XPATH to
	tag” required=“yes” repeated=“no”/>
	<Path source=“uddi” pathId=“/bindingDetailExt/binding
	Template/®comany”
required=“yes” repeated=“no”/>
	</Paths>
	<Label> <!-- Label in HTML form -->
	<Phrase language=“English”>Company</Phrase>
	</Label>
	<DisplayProperties editable=“yes” type=“textbox”>
	<Attribute name=“maxlength” value=“255”/>
	<Attribute name=“size” value=“30”/>
	<Data selected=“no”>
	<Phrase language=“English”/>
	</Data>
	</DisplayProperties>
	<Validation required=“no”/>
	</Field>
[continued . . . ]

[0052] When the data is to be displayed in an HTML Form 623, it is collected from the UDDI 602 and XML Data Source 601. The data is processed along with the DEML file and combined into a combined format as shown below in step one 610:

[0053]

Combined XML Document
<Field identitier=“no” xmltag=“company” type=“attribute”
pathId=“XPATH path to tag” indexed=“no” source=“uddi”>
	<Label>
	<Phrase lanquage=“English”>company</Phrase>
	</Label>
	<DisplayProperties editable=“yes” type=“textbox”>
	<Attribute name=“maxlength” value=“255”> </Attribute>
	<Attribute name=“size” value=“30”> </Attribute>
	<Data selected=“no”>
	<Phrase language=“English”>Company Name</Phrase>
	</Data>
	</DisplayProperties>
	<Validation> </Validation>
</Field>

[0054] This document is then transformed to HTML in step two 620 through the application of an eXtensible Style Language (XSL) transformation. The results of this transformation are displayed to the user 623. When the user updates any data or customizes the fields, this information is sent to a Processor 626 that extracts the data and saves (step three 630) the modified data to the XML Data Source 601 and/or the UDDI 602, as well as updates the DEML 603, if required.

[0055] The Customizable UDDI Schema of the Management Server (MS), while complex in design, is easy to use. In operation, the user is able to add data fields and content to the existing UDDI Schema display on the Management Server through a simple “Add Field” icon. The user is then led through a process of specifying the type and characteristics of the field. Once defined, the data field can then be populated with data and saved.

[0056] When the system saves the modified Schema, the UDDI data will be saved to the UDDI server and the custom data will be sent to the XML data store for later retrieval.

[0057] B. Contract and SLA Management

[0058] In one embodiment of the present invention, the MS is also used to create contracts and SLAs between users, roles or domains and Service Access Points. In order to create a contract, the following information must be submitted: 1) start date and time of the contract; 2) end date and time of the contract; 3) contract size (number of times the service may be called); and 4) regular expressions for domain, role and user parameters.

[0059] The following table shows some examples of the regular expression combinations that can be used to specify service users:

[0060]

Domain	Role	User	Who has access?
Mainframe	Administrator	*	All administrators on the
			mainframe
App1	*	*	All users on the App1 system
*	*	CEO	CEO on all systems
*	*	*	All users

The domain is the security domain within the enterprise that the user is authenticated against.
The MS and MSC can authenticate users against any of the systems to which it is connected.

[0061] In operation, users with sufficient access permissions can initiate a contract with a particular service by navigating to the desired access point, clicking on the icon and entering the contract parameters detailed previously. The MS manages the negotiation between the user and all related parties using a customizable workflow that can be set up by system administrators.

[0062] A Service Level Agreement (SLA) can also be associated with a contract that is used by the Management Server to notify the service users when the contracted service fails the terms of its SLA. This includes the following performance and availability parameters:

• • [0063] 1) Response Time—this is the time that the service takes to respond to a particular query.
  • [0064] 2) Mean Time Between Failure (MTBF)—this is the average time that a Service Access Point is running correctly between failures.
  • [0065] 3) Availability—this is the percentage of time that the Service Access Point remains live over time.
    If any of the above SLA parameters are not adhered to, then the users are alerted through the MS user interface.
    2. Management Server Client

[0066] Referring now back to FIG. 3, the Management Server Client (MSC) 210 is placed between the target client 110 and the servers 120. MSC 210 can be deployed as a stand-alone component; or on the application server, router or firewall.

[0067] Referring now to FIG. 7, the Management Server Client 210 is essentially a pluggable pipeline architecture 550 that communicates with the Management Server 220 through a Web Services API 130. The Management Server 220 serves as a data store and management interface for control of the remote Management Server Client (or Clients) 210.

[0068] In one embodiment of the present invention, the Management Server Client is an intermediary designed for the management of an entire SOA in a scalable way. It does this by intercepting the Web Services calls made within the intranet.

[0069] Referring still to FIG. 7, the MSC 210 communicates with the MS 220 through a secure Web Services API 130. This API 130 secures communication and MSC licensing. In one embodiment, Service Component Pipeline Architecture 550 has a pluggable framework 520 in which Components 510 can be deployed for each of the managed Web Services. In another embodiment, the blueprints on building the framework 520 are deployed by the MS 220 to the MSC 210 via API 130. Thus, requiring no persistent storage on the Management Server Client 210. The individual components 510 of the MSC 210 are designed to fit in with the framework 520 and can perform many functions. Some of these functions are Caching, Authentication and Authorization.

[0070] A. Web Services API

[0071] The API is designed as a series of Web Services over the intranet that allow communication between the MS and MSC. The MSC gets its configuration from the Management Sever (MS). When starting, the MSC makes a Web Service Call to the MS over the API to retrieve the configuration.

[0072] Communication across the API is encrypted using the license key supplied with the MSC. This license key is coded to a specific MS and therefore enforces the licensing agreement. The MS will not communicate with more than one MSC with the same key; each key has a unique network location.

[0073] The MSC makes two types of calls to get all the pipeline configuration information. The first contains a list of all the Web Service Methods and the pipeline to which they are mapped. The other requests the details of a specific pipeline. Examples of the two are as follows.

[0074]

Service Mapping XML
<?xml version=“1.0” encoding=“UTF-8”? >
<pipelines>
	<pipeline name=“default-pipeline” lastModifed=“2002/03/11
	05:22.23”
url=“/intercept/DefaultPipeline” action=“*” method“*” namespace=“*” />
	<pipeline name=“custom-pipeline”. lastModifed=“2002/03/11
	05:22.23”
url=“/intercept/custom*”/>
	<pipeline name=“default-pipeline” lastModifed=2002/03/11
	05:22.23” url=“*”/>
</pipelines>

[0075]

Pipeline Configuration XML
<?xml version=“1.0” encoding=“UTF-8”?>
<pipeline name=“default-pipeline” lastModified=“2002/3/11 05:22.23”>
	<group type=“pre-process” async_mode=“synchronous”>
	<component class=“com.digev.msc.component.security.JaasSecurityComp”/>
	</group>
	<group type=“generate-response” async_mode=“synchronous”>
	<component class=“com.digev.msc.component.wscall.CallWSComp”/>
	</group>
	<group type=“send-response” async_mode=“synchronous”>
	<component class=“com.digev.msc.component.response.SendWSResponseComp”/>
	</group>
	<group type=“post-process” async_mode=“no-wait”>
	<component class=“com.digev.msc.component.monitor.ServiceMonitorComp”/>
	<component class=“com.digev.msc.component.monitor.UsageMonitorComp”/>
	</group>
</pipeline>

[0076] The Service Mapping document uses regular expressions to map a particular service call to a specific pipeline name. The Pipeline Configuration document specifies all the components within the pipeline in the order in which they are called. The document also groups the components into separate group types according to function:

• • [0077] 1) Pre-processing—All components related to security, and validation
  • [0078] 2) Generate Response—All components related to transforming, processing and calling the Web Service
  • [0079] 3) Send Response—All components related to handling the HTTP response back to the target client.
  • [0080] 4) Post-processing—All components related to monitoring, which can be done asynchronously to the service call.
    The Pipeline Configuration file (e.g., the blueprint on building the framework) is uploaded from the MS when the MSC is started. The MS provides a user interface whereby the user can graphically create a pipeline for a particular Access Point. The configuration is stored at the MS and uploaded to the MSC when required.

[0081] B. Pipeline Architecture

[0082] The Pipeline Architecture is designed to meet the following requirements:

[0083] 1) Support API level integration as well as an intermediary server;

[0084] 2) Be able to map Web Services method calls to pipelines;

[0085] 3) Implement pluggable pipeline components; and

[0086] 4) No local read/write persistent data storage at the MSC.

[0087] Referring to the object model in FIG. 9, the design of the core framework is known to those skilled in the art and uses a factory model to get the implementation. The intent here is to create a core framework definition that will change slowly, if at all, and glues together the Components 709 to the MSC implementation. All that is defined here is one factory, one data class, a servlet and a number of interfaces. These are described below:

[0088] PipelineFactory 701

• • [0089] The pipeline factory encapsulates an instance of IPipelineFactory, which has only one method getPipeline( ). The PipelineFactory overloads the method with one signature that takes the generic HTTP request, response and servlet contest objects, and another that takes specific objects, such as the Digital Evolution (DE) specific HTTPAccessor object.

[0090] IPipelineFactory 710

• • [0091] Defines the method for getting a pipeline instance given a request.
  • [0092] public IPipeline getPipeline(HttpAccessor _accessor) throws GException;

[0093] IPipeline 707

• • [0094] Defines the two execute methods and a getWSInfo method. One execute method execute the whole pipeline, while the other executes a section of it. The getWSInfo( ) method get the WSInfo object. The implementation of this class should be “statefull” since it contains a reference to the “statefull” WSInfo class.
  • [0095] public void execute( ) throws GException;
  • [0096] public void execute(String _sProcessStep) throws GException;
  • [0097] public WSInfo getwSinfo( );

[0098] WSInfo

• • [0099] This is the data class that contains the current state of the request and response objects. It exposes the basic request and response objects, as well as represents these objects by different toolkits. These toolkits include the DE Proprietary WSReqestObject and WSResponseObject, as well as the Apache Axis Project's MessageContext object. This will allow the user to integrate newer toolkits without breaking existing Components 709.

[0100] IComponent 705

• • [0101] This interface contains an execute and an initialization methods. Instances of implementations of this should have initialization called once, then maintain this state and allow for the execute to be called free threaded.

[0102] Interceptor

• • [0103] This servlet (i.e., program written in a platform independent programming language, that runs on a server) is only for the MSC exposed to HTTP. Its implementation gets a pipeline from the factory and then executes the pipeline.

[0104] PipelineFactorImp 702

• • [0105] This class provides an implementation of IPipelineFactory. This class has two main functions, finding the pipeline to handle an incoming request and initializing and updating the pipelines. To find a pipeline, the PipelineFactoryImp iterates through all the PipelineProfiles, calling the PipelineProfile to see if it can handle the given request. When it gets an affirmative response, then it requests an instance of IPipeline from the PipelineProfile. All of the pipeline information is contained in the PipelineData class so that this class can build up the new configuration while running the old and replace the old with the new. This prevents the data for the pipeline from ever being in a transitory state.

[0106] PipelineData 703

• • [0107] The pipeline data class is just a data class for the pipeline information. Besides holding the list of pipelines, it also holds a hash of the components to facilitate reuse.

[0108] IPipelineConstants

• • [0109] This interface defines constants used by multiple MSC classes.

[0110] PipelineProfile 704

• • [0111] This class holds the set of IComponents associated with a pipeline. It has an inner class Pipeline that implements the IPipeline Interface. The PipelineProfile class performs two functions: it determines whether a given request, as represented by a WSInfo data object, should be served by this pipeline configuration. Then, when a request needs to be processed with this pipeline profile, the PipelineProfile class creates an instance of the inner class, providing the inner class the WSInfo data object.

[0112] PipelineProfile.Pipeline 705

• • [0113] This class holds the state of the request that is being processed, plus a system for sharing data between pipeline components. This provides methods to execute the whole pipeline or just a sub-section of the pipeline.

[0114] GroupComp 708

• • [0115] The group component provides a way to group components that have some commonalities in how they need to be executed. These commonalities can be from the step where they need to be executed to the node where they need to be executed.

[0116] Pipeline Componets 709

• • [0117] These components are examples of some of the types of components that can be inserted into the pipeline.

[0118] PipelineUtil

• • [0119] This class provides pipeline utility functions. It can map the human readable textual representation of the pipeline group type to the corresponding index.

[0120] In operation, when designing a new Pipeline Component for the framework, the developer must implement the IComponent interface. This is the only restriction that the architecture places on the design of new Pipeline Components. In order to load the Component, the developer would then list the Pipeline Component's class name in the Pipeline Configuration XML document that is uploaded to the MSC on startup.

[0121] C. Caching Component

[0122] One of the Pipeline Components built for the Management Server Client (MSC) is a Web Service Caching Component. This component caches the Simple Object Access Protocol (SOAP) Responses for a particular SOAP Request and returns that SOAP Response to a client within a specified Time-To-Live (TTL) period.

[0123] FIG. 10a is a caching sequence diagram on the SOAP Response to the SOAP Request if it is not in the Caching Component. FIG. 10b shows the sequence if the SOAP Response to the SOAP Request is stored in the Caching Component.

[0124] The Management Server allows the user to configure caching for each method call for a particular Web Service. An example of how the user can enable/disable caching and perform a simple timeout mechanism (TTL) is shown below:

Service Methods Caching Detail:

[0125]

Method Name	Refresh Frequency (ms)
getUser		UPDATE	DO NOT CACHE
getUserBySoap		UPDATE	DO NOT CACHE

[0126] Due to the fact that certain preferred MSC embodiments operate without any persistent data storage, the pipeline component is configured by means of a service call to the Management Server. The Management Server keeps a record of the cache configurations for each service and method.

[0127] In one embodiment, the Cache Pipeline Component reads the SOAP Request and is discerning enough to recognize the parameters passed in the service call, ignoring all other information that would not affect the SOAP Response data. This method signature and data is compared to previous method calls stored in the Cache and, if found, the appropriate SOAP response is sent.

[0128] In another embodiment, the Cache Pipeline Component: 1) reads a SOAP Request; 2) decides which parameters in the SOAP Request would affect a SOAP Response; 3) ignores the parameters that would not affect the SOAP Response; and 4) compares whether parameters that would effect the SOAP Response (“effective parameters”) are the same as the parameters stored in the Cache Pipeline Component (“cached parameters”). If the effective parameters are the same as the cached parameters, the Cache Pipeline Component sends SOAP Response data stored in the Cache Pipeline Component (“cache response data”). The cache response data corresponds to the cached parameters. If the effective parameters are not the same as the cached parameters, the Cache Pipeline Component forwards the effective parameters to a server to generate SOAP Response data for the effective parameters (“server response data”). After the Cache Pipeline Component receives the server response data, the server response data and the effective parameters are saved in the Cache Pipeline Component. The saved effective parameters can now be used as new cached parameters (“the new cached parameters”). The saved server response data can now be used as a new cache response data for future SOAP Requests that have the same parameters as the new cached parameters.

[0129] In operation, the Caching Component is enabled through the Access Point Management functionality present on the MS. The timeout can be set along with the ability to disable it for each individual method call.

[0130] D. Authorization Component

[0131] The SOAP Message is comprised of two parts: the SOAP Header and SOAP Body. The SOAP Header is typically used to pass additional information along with the SOAP Message that is not part of the actual Service call, including information such as security assertions.

[0132] Security Assertions are records of previous Authentication or Authorization events that have occurred during the course of a user's transaction. A standard has been presented to the W3C standards organization called Security Assertions Markup Language (SAML). When a Service call is made by the Client to the Server, the user's authentication assertion must be present in the SOAP Header in the form of a SAML document.

[0133] The Authorization Pipeline Component is used to authorize a user's access to a particular service based on the Contract registered in the MS. The pipeline component makes a call to the Management Server and passes the Authentication Assertion present in the SAML document. The MS uses this information to locate a Service Contract and, if it is found to be valid, returns an Authorization assertion to the MSC.

[0134] Referring now back to FIG. 3, the Authorization Component, in operation, is implicit on the contract between the client 110 and servers 120. This is covered in detail under the Management Server—Contract and SLA Management described above.

[0135] Having thus described embodiments of the present invention, it should be apparent to those skilled in the art that certain advantages of the within system have been achieved. It should also be appreciated that various modifications, adaptations, and alternative embodiments thereof may be made within the scope and spirit of the present invention. For example, Web Services within an enterprise's intranet have been illustrated, but it should be apparent that the inventive concepts described above would be equally applicable to other types of network systems. The invention is further supported by the following examples.

[0136] In one example, a client/server computer system comprises a client, a server for providing services to the client, and a Management Server Client (MSC) connected with the server. The services are provided to the client via the MSC. The client/server computer system also has an API and a Management Server (MS) connected with the MSC via the API. The MS provides configuration data to the MSC and upon receiving the configuration data via the API, the MSC manages the services provided from the server to the client. In another example, the MSC uses a pipeline to manage the services provided from the server to the client. In a further example, the pipeline comprises a plurality of components. In yet another example, the configuration data comprises a blueprint for utilizing the components to build the pipeline within the MSC.