EBX5 Technical
Architecture &
Integration
June 2015
Architecture overview
WS Client Client
• 100% Browser-based (HTTP/HTTPS)
• Supported browsers: IE, Firefox, Chrome, Safari
• Web Services client: SOAP over HTTP/HTTPS or JMS
Java Application Server Server
• Servlet container in JRE 1.5+ (Servlet 2.4)
• Example: IBM WebSphere, Oracle WebLogic,
Apache Tomcat, RedHat JBoss
• Deployment: EAR or WAR/JAR
Database
• Oracle Database 10gR2 or higher
• PostgreSQL 8.4 or higher
• Microsoft SQL Server 2008 or higher
RDBMS • IBM DB2 UDB v8.2 or higher
• H2 v1.3.170 or higher (dev)
Hardware / Service Components
Logical Architecture
Interfaces & Deployment
Interfaces
Web Services (SOAP/WSDL)
Data Services
generated from data models
EBX5
File import/export in XML, CSV,
Files
XLS, XLSX
RDMBS SQL Native SQL access
Data Services
Web Services (SOAP/WSDL) dynamically generated from data models. Over HTTP/S or JMS
Product Data Model Product Data Service
(XML Schema doc) (WSDL)
Product Operations
Product-ID select_Product
Dynamically
Name insert_Product generated Data
Family update_Product Services from a
Pricing 0 - ∞ delete_Product Data Model
Price count_Product
Discount getChanges_Product
MDM Features Data
Service (WSDL)
Operations
Note: rich types (here
multi-value complex type) create_DataSpace
supported in both data create_Snapshot Prebuilt Data
model and data services close_DataSpace Services on MDM
close_Snapshot features
merge_DataSpace
validate_DataSet
validate_DataSpace
start_workflow
end_workflow
Data Services
Objectives
• Provide a standards-based service layer on MDM
• Expose all operations as a service
o CRUD on data sets
o MDM features (workflow, version control...)
• Decouple MDM from applications
How it works
• Dynamic generation of Web Services from the data model
• WSDL mapped on XML Schema data model (same standard)
• Absorbs data model changes on the fly
o No code generation required
o No redeployment cycle required
Key features
• CRUD web service on any Data Set (based on Data Model)
o Insert / Update work on both bulk and per record modes
• MDM features on Data Spaces, Workflow...
• Security: HTTP Authentication or WSSE
• SOAP-fault for validation errors
Data Propagation
o EBX provides a canonical format in XML, XLS or CSV (the one created during the data
model design time)
o A middleware (e.g ODI) is in charge to transform this format to a suitable format for
the target system and integrate the transformed data using a dedicated connector.
Web Services
(SOAP/WSDL)
EBX
Files Middleware (ETL, ESB)
(XML/XLS/CSV)
Dedicated
connectors
Java API
Target
Systems
RDBMS SQL
ETL ESB Autre (DQ, BPM, BRMS)
Informatica Powercenter WebMethods ESB IBM Quality Stage
IBM Datastage JBoss ESB Tibco BusinessWorks
Oracle ODI Oracle OSB WebMethods BPM
Talend ETL Tibco ESB Oracle BPM
Microsoft SSI IBM ESB IBM JRules
IBM MQ Informatica Data Quality
Microsoft BizTalk MS SharePoint
MS Excel
Data Propagation
Synchronous/Asynchronous mode:
• EBX provides both modes
• Best practice for real time is to sync at merge time
• Batchs can be triggered using any third party software or using the natively provided
scheduler
Delta/Full propagation:
• EBX enables delta and full stock mechanisms, down to attribute level
• Delta is easily identified using dataspaces
• Native web service to get delta between dataspaces/versions
Data Propagation
Target systems/environments:
• EBX provides native export/import archive mechanism in order to propagate data
between environments (also applies to data model, workflow models, configurations,
etc).
• Leverages dataspace native merging mechanism to put together data from both
source and target systems.
• Can be automated using native scheduler (or third party tool), or in sync with
dataspace merge event.
SQL Interfaces for data access
RDBMS
Data History Insight
Using SQL Connect,
Data Quality indicators
Master Data are Record level history is
generate historical data in
automatically replicated in stored in native SQL tables
native SQL tables
native SQL tables
Deployment architectures
Multiple deployment options can be combined
Active/Passive DB clustering EBX clustering
Failover (using D3)
EBX EBX EBX EBX
(Active) (Passive)
DB cluster RDBMS
RDBMS RDBMS RDBMS
Sync using D3
Pool of EBX
EBX EBX
RDBMS RDBMS
Integration scenario
Examples
Example: Authoring and export via an ETL
Insert a new Merge Data
record Space
Export update
Main Data Space
Update
Transform and
export
Example: Authoring and export via an ESB
Insert a new Merge Data
record Space
Notify
middleware
Main Data Space
Update
Get changes or Push updates
select to apps
Example: xRef look-up in an integration process
Main Data Space
Integration Push updates
Transform
process to apps
Look-up xRef
Example: Import data in staging areas
Merge Data Merge Data
Space Space
Main Data Space
Staging 1
Staging 2
Import data Import data
from App 1 from App 2
Example: Launch approval workflow
Approve in Merge Data
workflow Space
Main Data Space
Start Workflow
Update
Launch
approval
workflow
Import data
from App
D3: Distributed Data
Delivery
Distributed architecture
Master EBX Slave EBX D3 Master
Data Governance Time Data Consumption Time • Defines a data space as deliverable
• Associates it to delivery profiles
EBX • Control & monitor profiles subscribers
D3 Slave • Broadcasts data updates
• 2-phase commit
EBX D3 Slaves
EBX
• Automatic registering
D3 Master
D3 Slave • Receive updates
• Commit changes
EBX • Read-only on synchronized data spaces
• Write on local data spaces
D3 Slave
Master EBX
1. Data is updated in EBX (via UI or Services)
Slave EBX
Data Governance Time Data Consumption Time 2. Update is pushed to D3 Slaves
3. Update is received by D3 Slaves
1 EBX 2 3 EBX
4. Acknowledgment by D3 Slaves to D3 Master
4 5. D3 Master sends commit instruction to D3 Slaves
D3 Master 5
D3 Slave 6. Update is committed to EBX Slaves
6
Messages: SOAP on HTTP/HTTPS, Data updates on TCP-IP
Example: Geographical Federation
Master
EU Cluster
MDM
Slave 1 Slave 2
NA Cluster
APAC Cluster
Slave 5 Slave 6
Slave 3 Slave 4
Example: Realtime Data Cluster
Read-only access
Update
Load Balancer
EBX Master EBX Slave 1 EBX Slave 2
SOAP HTTP Synchronisation
App Server SOAP HTTP App Server App Server
JVM JVM JVM
Data Spaces Broadcast
EBX EBX EBX
TCP/IP Socket
RDBMS RDBMS RDBMS
Managing master data at different levels
Product data is
managed centrally in
the master MDM
instance
Master
MDM Slave MDM
Product Data
Local suppliers are
Product Data managed in the slave
Local Suppliers MDM instance and
Product data is linked to global
synchronized to the products
slave MDM instance
Integration with Enterprise
Security Systems
Custom Authentication
Requirement
o Enterprise directory (for instance LDAP, Active Directory) responsible
for holding the users' authentication information (login/password).
• Passwords are not stored in EBX5.
• Whenever opening a session (log on through the GUI, SOAP request or
access through the Java API), authentication is performed against the
enterprise directory.
Implementation
o Users declared in EBX5 directory only with their login (no password),
to be able to assign them roles.
o Develop a custom Java class (using EBX5 API) responsible for
delegating the authentication to the enterprise directory (usually
using the LDAP protocol).
Fully externalized users and roles
Requirement (in addition to the "custom authentication" use case)
o User - role associations declared and maintained in the enterprise directory.
Implementation
o EBX5 directory not used.
o Authentication delegated to the enterprise directory.
o Custom Java component responsible for retrieving the user's roles from the enterprise directory
whenever needed by EBX5 (in order to avoid overloading the directory, this component would
typically maintain a cache of users and roles with an appropriate synchronization policy).
Active Users and roles cache
Custom Java
Directory LDAP component
Users Roles
Authentication
Permissions
evaluation
HTTP engine
Core features
EBX5
Custom internal directory in EBX5
Requirement
o Periodic password expiration.
o Account locking when typing a wrong password three times in a row.
o Specific pattern for passwords :
• Eight characters length.
• Must contain letters and digits.
Implementation
o EBX5 built-in directory not used.
o Custom directory inside EBX, as a data set in a dedicated Data Space
• Based on a custom schema (built-in directory's schema can be re-used and
enriched).
• Specific rules (password expiration + account locking) in a custom Java class
overriding built-in authentication.
o Define role-based permissions on these Data Space and data set:
• Only authorized users (directory's administrators) can access and update it.
• The Data Space hosting the directory is hidden for business users.
Single sign-on (1/2)
EBX5 can be integrated into a SSO context, in order to share user
authentication with other applications (Once authenticated, the user can
access any application part of the SSO context).
EBX5 is compatible with the different kinds of SSO Systems:
NTLM (Integrated Windows authentication)
Kerberos
IBM Tivoli Directory Server
Lightweight Third Party Authentication (IBM WebSphere)
Central Authentication Service (CAS)
Single sign-on (2/2)
EBX5 does not handle authentication anymore.
Override the built-in authentication mechanism. Implementation will depend on the target SSO
System (EBX5 API gives access to the HTTP request, this is useful for ticket-based SSO Systems).
When a user without any active EBX5 session tries to access the GUI :
o Check if the user is already authenticated in the SSO context.
o If not, redirect him to the SSO authentication page.
o If yes, open an EBX5 session for this user and redirect him to the GUI home page.
EBX5 GUI login policy can be customized if necessary
o Configuration done in the deployment descriptor of ebx.war (web.xml).
o Choose the appropriate authentication method (Basic, Digest or Form-based, as described in Servlet
2.3 specification).
W
hen using Form-based authentication method : Customize the default login page in order
to submit login/password to the SSO authentication system.
Thank you.
www.orchestranetworks.com
twitter.com/orchestramdm
www.linkedin.com/company/orchestra-networks
www.facebook.com/OrchestraNetworks
