Topic 7 References

• This is a slightly edited version of the

Introduction to SOAP presentation “Introduction to SOAP” by
Joe Futrelle, National Center for
Scott D. Stoller Supercomputing Applications, available
at
CSE608: Advanced Computer Security www.ncsa.uiuc.edu/People/futrelle/ppt/nt
uSOAP.ppt

1 2

What is SOAP? What SOAP isn’t

• The Simple Object Access Protocol • A full-fledged distributed object system
• “Platform-agnostic” protocol for with support for
messaging and remote procedure calling – Objects-by-reference
(RPC) between distributed applications – Activation
• Developed by the World-Wide-Web – Message batching
Consortium (W3C)
– Distributed garbage collection
• Encoded in XML, transported over HTTP
– Naming and directory services
– Data encoding described in XML-Schema
– Can use any transport mechanism • SOAP sacrifices these features for
• Stateless (request/response) platform-neutrality and extensibility

3 4

SOAP in a Nutshell Is SOAP Web-Based?

• A SOAP client formats a message in XML • No
including a SOAP “envelope” element – Browsers don’t support it
describing the message
– Likely won’t: SOAP is for application-to-
• The client sends the message to a SOAP application communication
server in the body of an HTTP request
• But it’s based on WWW infrastructure
• The server determines whether the
message is valid and supported – SOAP servers can be implemented as CGI
scripts or Servlets
• The server formats its response in XML
and sends it to the client in the body of – SOAP messages work through proxies
an HTTP response and firewalls
– SOAP clients use HTTP client libraries
5 6
 SOAP Use Scenario: RPC SOAP Message Components
• Envelope (required)
Client App SOAP – Contains Header and Body
envelope – Defines namespaces (optional)
procedure call
– Declares encoding rules (optional)
return
message • Header (optional)
Stub – Contains metadata entries about message
a la HTTP headers
– Specifies which entries must be
HTTP to SOAP server
SOAP understood and by which target “actor” in
chain of recipients
7 8

SOAP Message Components Example SOAP Message

• Body (required) <SOAP-ENV:Envelope> header
<SOAP-ENV:Header>
– Contains application-specific message <lib:PatronID
– May be encoded variously SOAP-ENV:mustUnderstand=“1”>
007
• Fault element (optional) </lib:PatronID>
– Contained in Body </SOAP-ENV:Header> body
– Describes error class (version mismatch, <SOAP-ENV:Body>
headers not understood, client error, <lib:Checkout>
<callNo>435.33</callNo>
server error) </lib:Checkout>
– Extensible, hierarchical fault codes, e.g. </SOAP-ENV:Body>
Server.Availability.NotAvailable </SOAP-ENV:Envelope>
9 10

Why Not Just Put Everything in the Header? Encoding Data in SOAP
• The Header is optional • SOAP permits arbitrary “encoding
• SOAP specializations for RPC require styles” and defines a default encoding
using the body to pass parameters and style
results (we’ll get to that later) • Based on XML-Schema
• Otherwise, no reason • Supports data types
• The SOAP spec notes that a body entry – All built-in XML-Schema types (e.g. string,
is semantically-equivalent to an optional float, integer, date, IDREF)
header entry (with “mustUnderstand” = – Derived types: enumerations, arrays,
0) structs, generic compound types

11 12
 Encoding Data in SOAP: accessors Encoding Data in SOAP: structs
• Typed elements are called “accessors” • Structs are simple compound types
• Accessor types are specified in consisting of uniquely-named accessors,
externally-referenced XML-Schema e.g.
definitions
• Or with the xsi:type attribute, e.g. <naut:Ship>
<name>Titanic</name>
<a:uid xsi:type=“xsd:integer”> <length>882’</length>
4737 <height>104’</height>
</a:uid> <weight>46,328 tons</weight>
</naut:Ship>

13 14

Encoding Data in SOAP: arrays Encoding Data in SOAP (cont.)

• Arrays can be built of any type, e.g. • Values can be used in multiple places
using references
<SOAP-ENC:Array <e:Book>
SOAP-ENC:arrayType="phNo[]"> <title>My Life</title>
<phNo>217-435-4927</phNo> <author href="#Person-1"/>
<phNo>217-957-4937</phNo> </e:Book>
</SOAP-ENC:Array> <e:Person id="Person-1">
<name>Henry Ford</name>
• Array values can be of any subtype of </e:Person>
the array’s declared type • Including ref’s to external resources
15 16

Using SOAP for RPC RPC Example: Digital Library

• A method is invoked by sending a SOAP • Supports card catalog search and
request to a URI representing the target object checkout
• Method calls are represented in the Body by a • Target objects / methods
struct named after the method
– Catalog / search
• Method arguments are represented by struct
members – Circulation / checkout, return
• Return value is encoded similarly, with • Security
method name + “Response” as the struct – Authentication: patron ID
name, and returned in a SOAP response – Fault: unrecognized user
• Errors are signaled with the Fault entry

17 18
 RPC Example: Digital Library RPC Example: Catalog Search
• Catalog
– Represented by a URI, e.g. POST /catalog/ HTTP/1.1
http://www.lib.org/catalog/ Content-type: text/xml
– Supports one method: Search <SOAP-ENV:Envelope>
–Find items which match a particular query <SOAP-ENV:Body>
–Result: list of entries containing <lib:Search>
information about items <author>Kafka</author>
–Fault condition: malformed query </lib:Search>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

19 20

RPC Example: Catalog Search Response RPC Example: Catalog Search

• Now let’s make a malformed query:
HTTP/1.1 200 OK
Content-type: text/xml <SOAP-ENV:Envelope>
<SOAP-ENV:Body>
<SOAP-ENV:Envelope> <lib:Search>
<SOAP-ENV:Body> <author>**$(D-3.2</author>
<lib:SearchResponse> </lib:Search>
<lib:Item> </SOAP-ENV:Body>
<callNo>473.57</callNo> </SOAP-ENV:Envelope>
</lib:Item> …

21 22

RPC Example: Catalog Search Response RPC Example: Digital Library

<SOAP-ENV:Envelope> • Circulation
<SOAP-ENV:Body> – Represented by a URI, e.g.
<SOAP-ENV:Fault> http://www.lib.org/circulation
<faultcode> – Supports two methods: Checkout / Return
Client.MalformedQuery –Acquire/release rights to a particular item
</faultcode> –Result: rights token / acknowledgement
<faultstring> –Fault conditions: item not found, item
unavailable / not checked out,
Illegal Characters unrecognized user
</faultstring> – Must understand authentication
</SOAP-ENV:Fault> … –Require patron ID in Header

23 24
 RPC Example: Circulation Checkout RPC Example: Circulation Checkout
… continued from last slide …
POST /circulation/ HTTP/1.1
Content-type: text/xml
<SOAP-ENV:Body>
<SOAP-ENV:Envelope> <lib:Checkout>
<SOAP-ENV:Header> <callNo>435.33</callNo>
<lib:PatronID </lib:Checkout>
SOAP-ENV:mustUnderstand=“1”>
007 </SOAP-ENV:Body>
</lib:PatronID> </SOAP-ENV:Envelope>
</SOAP-ENV:Header>

… continued …
25 26

RPC Example: Checkout Result RPC Example: Circulation Checkout

• Now let’s try that without authentication:
<SOAP-ENV:Envelope>
<SOAP-ENV:Body> <SOAP-ENV:Envelope>
<lib:CheckoutResponse> <SOAP-ENV:Body>
<rightsToken> <lib:Checkout>
87-RJC-Q <callNo>435.33</callNo>
</rightsToken> </lib:Checkout>
</lib:CheckoutResponse> </SOAP-ENV:Body>
</SOAP-ENV:Body> </SOAP-ENV:Envelope>
</SOAP-ENV:Envelope>

27 28

RPC Example: Checkout Result Notes about RPC with SOAP

• Request and response formats must be
<SOAP-ENV:Envelope> described in XML-Schema and reside in
<SOAP-ENV:Body> their own namespace
<SOAP-ENV:Fault> • Namespaces are declared in the SOAP
<faultcode> Envelope
Client.NoPatronID
• RPC calls may be made through SOAP
</faultcode>
intermediaries (proxies)
<faultstring>
– Faults and “must understand” contracts
No Patron ID Specified
must be maintained between
</faultstring> … intermediaries and target objects
29 30
 Notes about RPC with SOAP SOAP Status and Resources
• SOAP servers may validate messages • SOAP 1.2 Specification
against XML-Schemas, ensuring that (a W3C Recommendation)
data in messages conforms to the – http://www.w3.org/TR/soap/
declared data types
• Useful Microsoft whitepaper
• Binary data may be sent in one of – http://msdn.microsoft.com/xml/general/so
several XML-Schema encodings ap_webserv.asp
• Open-source Implementation of SOAP:
Apache Axis
– http://ws.apache.org/axis/

31 32