This version must be installed on Petals ESB 5.1.0+ Features The component BC Gateway enables to create secured (encrypted and authenticated) bridges between Petals domains governed by separate entities. This bridge will mirror a set of endpoints from one domain to another according to a configuration describing which service must be propagated. See also the documentation for Topologies and Domains to better understand domains. From the point of view of this BC, one (or several in case of HA) container in each Petals domain will either play the role of provider domain or consumer domain: A provider domain, materialised with Consumes Service Units, propagates services of its domain to a consumer domain that connects to it via one or several links. A consumer domain, materialised with Provides Service Units, connects to a provider domain and create endpoints for the propagated services in its domain. By default the Gateway BC takes care of reconnecting in case of disconnection, polling for changes in the activated endpoints to keep the consumer domain a mirror of the provider domain and it is possible to rewrite propagated services names in the consumer domain if needed. By service, we mean one as defined in a WSDL: it is specified by an interface name and a service name. Thus, endpoints are not propagated as such and if multiple endpoints of a given service are available in the provider domain, then there will be only one activated service in the consumer domain for all these endpoints. Usually, an interface name characterises a generic functionality while a service name characterises an implementation of that functionality. On the other hand, an endpoint name is simply a technical mean to locate a given instance of this service in the bus. Full Size Service Units Configuration In terms of configuration (i.e., definition of Service Units), this results in two different artefacts: Consumes and Provides SUs. The Consumes SUs (deployed in a provider domains) declares a list of consumer domains that are allowed to connect to them and to which a selection of services (also defined in the Consumes SU) will be propagated. The Provides SU (deployed in a consumer domain) declares a list of provider domains (usually only one) to which they will connect and propagate services from. The particularity of the Gateway BC is that, while Consumes SUs explicitly define which are the consumed services that are going to be propagated from their domain, Provides SUs do not have to (but can) define the services that are going to be propagated to their domain: these are inferred based on the services actually propagated by the provider domain. Furthermore, only the services that are actually activated on the provider domain are actually propagated: in this way, the consumer domain will constantly mirror the current reality of the provider domain. Component Transport Listeners Technically, the component onto which the Consumes SUs are deployed must define how to listen to incoming connections (on a host and TCP port currently) from Provides SUs. These are called transport listeners and can be shared between multiple Consumes SUs if needed (to avoid duplicating open ports) or not (to isolate certain consumer domains). This version of the component is based on Apache Netty 4.0.36.

Table of contents 1 Features 1.1 Service Units Configuration 1.2 Component Transport Listeners 2 Setting up a simple domain-to-domain propagation 2.1 Provider Domain A 2.1.1 Consumes SU 2.1.2 Component's Transport Listener 2.2 Consumer Domain B 2.3 Examples of Service Propagations 3 Using SSL to authenticate and encrypt exchanges between domains 3.1 Authenticating only the Provider Domain 3.1.1 Provider Domain A 3.1.2 Consumer Domain B 3.2 Authenticating both the Provider and Consumer domains 3.2.1 Provider Domain A 3.2.2 Consumer Domain B 4 Service Rewriting 5 Service Unit Configuration 5.1 Consumes SU 5.1.1 Consumer Domain Element 5.1.2 Consumes Element 5.2 Provides SU 5.2.1 Provider Domain Element 5.2.2 Provides Element 6 Component Configuration 7 Logging 8 Monitoring the component 8.1 Using metrics 8.1.1 Common metrics 8.1.2 Dedicated metrics 8.2 Receiving alerts 8.2.1 Common alerts 8.2.2 Dedicated alerts Contributors Christophe DENEUX 2 (2259 days ago)

Setting up a simple domain-to-domain propagation

Let's consider two domains A and B.
The number of containers in each of the domain is not important here: we must only select for each one container onto which the Gateway BC and its SU will deployed.

The domain A will act as the provider domain and will thus declare in its SU a set of Consumes as well as information needed to identify the consumer domain.

The domain B will act as the consumer domain and will thus declare in its SU the information needed to connect to the provider domain.

Let's consider that A will propagate several services:

• One denoted only by its interface name Interface1 (hence it will matches all endpoints of that interface, potentially with different service name and of course with different endpoint names).
• One denoted by its interface name Interface2 and service name Service2 (hence it will matches all endpoints of that interface and service name).
• One denoted by its interface name Interface3, service name Service3 and endpoint name endpoint3 (hence it will match exactly one endpoint).

Provider Domain A

For the provider domain, it is necessary to both define a Consumes SU and a transport listener at the component level.

Consumes SU

The Consumes SU deployed on the Domain A is as follow:

<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi version="1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jbi="http://java.sun.com/xml/ns/jbi"
   xmlns:cdk="http://petals.ow2.org/components/extensions/version-5" xmlns:g="http://petals.ow2.org/components/petals-bc-gateway/version-1.0"
   xmlns:test="http://test/">

   <jbi:services binding-component="true">

      <jbi:consumes interface-name="test:Interface1">
         
         <!-- CDK specific elements -->
         <cdk:mep xsi:nil="true" />

         <!-- Component specific elements -->
         <g:consumer domain="domainB" />

      </jbi:consumes>

      <jbi:consumes interface-name="test:Interface2" service-name="test:Service2">
         
         <!-- CDK specific elements -->
         <cdk:mep xsi:nil="true" />

         <!-- Component specific elements -->
         <g:consumer domain="domainB" />

      </jbi:consumes>

      <jbi:consumes interface-name="test:Interface3" service-name="test:Service3" endpoint-name="endpoint3">
         
         <!-- CDK specific elements -->
         <cdk:mep xsi:nil="true" />

         <!-- Component specific elements -->
         <g:consumer domain="domainB" />

      </jbi:consumes>

      <g:consumer-domain id="domainB" transport="transport1">
         <g:auth-name>UniquelySharedBetweenA&B</g:auth-name>
      </g:consumer-domain>

   </jbi:services>
</jbi:jbi>

Here we see we chose to use the authentication name UniquelySharedBetweenA&B and the consumer domain will need to know this information.

The authentication name is NOT meant to introduce security in the use of the Gateway BC: for that it is necessary to use SSL!

Component's Transport Listener

As we can see the Consumes SU relies on the existence of a transport called transport1.
By default there is no pre-configured transport listener on the Gateway BC but there is multiple ways to define them statically (see component-configuration below) or dynamically with Petals CLI (see Petals BC Gateway tooling).

For example, we can use the following CLI command to create the transport listener before deploying the Consumes SU:

> bc-gateway.add-transport-listener -i transport1 -p 7500

Here we chose the port 7500 and the consumer domain will need to know this information.

Consumer Domain B

For the consumer domain, it is only necessary to define a Provides SU based on the previously gathered information (authentication name, port) and hostname of the provider domain BC Gateway.
The Provides SU deployed on the Domain B is as follow:

<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi version="1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jbi="http://java.sun.com/xml/ns/jbi"
   xmlns:cdk="http://petals.ow2.org/components/extensions/version-5" xmlns:g="http://petals.ow2.org/components/petals-bc-gateway/version-1.0">

   <jbi:services binding-component="true">
      
      <g:provider-domain id="domainA">
         <g:remote-ip>domainA-hostname</g:remote-ip>
         <g:remote-port>7500</g:remote-port>
         <g:remote-auth-name>UniquelySharedBetweenA&B</g:remote-auth-name>
      </g:provider-domain>

   </jbi:services>
</jbi:jbi>

Examples of Service Propagations

If we start with one container for A and one container for B without anything on them and after:

• deploying the Gateway BC on each of the container of A and B.
• adding the transport listener on the Gateway BC of A.
• deploying the Consumes SU on the Gateway BC of A and the Provides SU on the Gateway BC of B.

The order of deployment is not very important as by default, the Provides SU will try to reconnect until it succeeds.

We can see that no endpoints have been deployed on B: this is expected because A will only propagate existing endpoints.

Now if we deploy some endpoints on domain A:

• InterfaceX:ServiceX:endpointX, then no endpoint will be activated on B.
• Interface1:Service1a:endpoint1a, then Interface1:Service1a:xxx will be activated on B.
• Interface1:Service1a:endpoint1a and Interface1:Service1a:endpoint1b, then Interface1:Service1a:xxx will be activated on B.
• Interface1:Service1a:endpoint1a and Interface1:Service1b:endpoint1b, then Interface1:Service1a:xxx and Interface1:Service1b:xxx will be activated on B.
• Interface2:Service2:endpoint2a and Interface1:Service2b:endpoint2b, then only Interface1:Service2:xxx will be activated on B.
• Interface3:Service3:endpoint3, then Interface3:Service3:xxx will be activated on B.
• Etc.

We can notice that the endpoint name is never propagated because it is considered that the endpoint is only a technical information to locate an endpoint in a domain.

We can also notice that what matters is always the pair interface and service name, and in case no service name is specified in the Consumes SU, then each existing service in the provider domain will be propagated as its own service.

Using SSL to authenticate and encrypt exchanges between domains

In order to secure connections between provider and consumer domain, it is possible to rely on SSL.
SSL itself takes care of the encryption, but it is necessary for the provider domain, and optionally for the consumer domain, to have a certificate shared between parties to authenticate them.
There can't thus be encryption without authentication of at least the provider domain and ideally also of the consumer domain!

Authenticating only the Provider Domain

For a provider domain, using SSL means to define a certificate that consumer domains that connect to it can use to authenticate it.
The certificate is a public information and the provider domain owns also a private key that it can use to answers authentication challenges from the consumer domain.

Provider Domain A

On the provider side, the consumer-domain element must be updated with the following parameters:

<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...>

   <jbi:services binding-component="true">
      ...

      <g:consumer-domain id="domainB" transport="transport1">
         <g:auth-name>UniquelySharedBetweenA&B</g:auth-name>
         <g:certificate>path/to/a/certificate+provider.crt</g:certificate>
         <g:key>path/to/the/key.pem</g:key>
         <g:passphrase>secret-to-unlock-the-key<g:passphrase>
      </g:consumer-domain>

   </jbi:services>
</jbi:jbi>

Note that this means that setting up SSL is done per consumer domain that will connect to this SU, but nothing prevent us to configure the same certificate for multiple consumer domains of course!

Consumer Domain B

On the consumer side, the consumer-domain element must be updated with the following parameters:

<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...">

   <jbi:services binding-component="true">
      
      <g:provider-domain id="domainA">
         <g:remote-ip>domainA-hostname</g:remote-ip>
         <g:remote-port>7500</g:remote-port>
         <g:remote-auth-name>UniquelySharedBetweenA&B</g:remote-auth-name>
         <g:remote-certificate>path/to/the/certificate-provider.crt</g:remote-certificate>
      </g:provider-domain>

   </jbi:services>
</jbi:jbi>

Authenticating both the Provider and Consumer domains

Optionally, it is also possible to superpose on this basic SSL setup the use of a certificate that the provider domain will use to authenticate the consumer domain.
The later will also own a private key then.

Provider Domain A

On the provider side, the consumer-domain element must be updated with the following parameters:

<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...>

   <jbi:services binding-component="true">
      ...

      <g:consumer-domain id="domainB" transport="transport1">
         <g:auth-name>UniquelySharedBetweenA&B</g:auth-name>
         <g:certificate>path/to/a/certificate-provider.crt</g:certificate>
         <g:key>path/to/the/key.pem</g:key>
         <g:passphrase>secret-to-unlock-the-key<g:passphrase>
         <g:remote-certificate>path/to/the/certificate-consumer.crt
      </g:consumer-domain>

   </jbi:services>
</jbi:jbi>

This means that even if multiple Provides SUs connects to this provider domain, they all must use the same certificate as it is a mean to authenticate a consumer domain and not an individual node of this domain.

Consumer Domain B

On the consumer side, the consumer-domain element must be updated with the following parameters:

<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...">

   <jbi:services binding-component="true">
      
      <g:provider-domain id="domainA">
         <g:remote-ip>domainA-hostname</g:remote-ip>
         <g:remote-port>7500</g:remote-port>
         <g:remote-auth-name>UniquelySharedBetweenA&B</g:remote-auth-name>
         <g:remote-certificate>path/to/the/certificate-provider.crt</g:remote-certificate>
         <g:certificate>path/to/a/certificate-consumer.crt</g:certificate>
         <g:key>path/to/the/key.pem</g:key>
         <g:passphrase>secret-to-unlock-the-key<g:passphrase>
      </g:provider-domain>

   </jbi:services>
</jbi:jbi>

Service Rewriting

Service Unit Configuration

Consumes SU

In a Consumes SU, one must declare at least one consumer-domain and some consumes element to determine the services to be propagated to one or several of these consumer domains.

The consumes element can't override each other for the same consumer-domain:

• If there is a consumes of type Interface:Service:endpoint, then there can't be another consumes of type Interface:Service:endpoint, Interface:Service: or Interface:: defined for the same consumer-domain.
• If there is a consumes of type Interface:Service:, then there can't be another consumes of type Interface:Service: or Interface:: defined for the same consumer-domain.
• If there is a consumes of type Interface::, then there can't be another consumes of type Interface:: defined for the same consumer-domain.

Consumer Domain Element

The elements defined inside consumer-domain in an SU accept placeholder values.

Consumes Element

Note that in consumes elements for the Gateway BC, it has no meaning to specify a mep or an operation: they will be ignored, thus it is recommended to always set the mep to nil (because it is required to specify it):

<cdk:mep xsi:nil="true" />

Provides SU

In a Provides SU, one must declare at least one provider-domain and optionally some provides element to determine how the services are being propagated from one of the provider domain.

The provides element must have a provider element and these can't override each other for the same provider-domain:

• If there is a provides with a provider of type Interface:Service:endpoint, then there can't be another provides with a provider of type Interface:Service:endpoint or Interface:Service: defined for the same provider-domain.
• If there is a provides with a provider of type Interface:Service:, then there can't be another provides with a provider of type Interface:Service: defined for the same provider-domain.

Provider Domain Element

The elements defined inside provider-domain in an SU accept placeholder values.

Provides Element

Component Configuration

The component configuration includes the configuration of the CDK. The following parameters correspond to the CDK configuration.

Note that the parameters processor-pool-size and processor-max-pool-size defaults respectively to 1 and 6 in the Gateway BC.

Definition of CDK parameter scope :

• Installation: The parameter can be set during the installation of the component, by using the installation MBean (see JBI specifications for details about the installation sequence). If the parameter is optional and has not been defined during the development of the component, it is not available at installation time.
• Runtime: The paramater can be set during the installation of the component and during runtime. The runtime configuration can be changed using the CDK custom MBean named RuntimeConfiguration. If the parameter is optional and has not been defined during the development of the component, it is not available at installation and runtime times.

Logging

The traces of Apache Netty itself can be activated through the logging configuration file of Petals ESB. The root logger for Netty is io.netty:

...
io.netty.level=INFO
...

Monitoring the component

Using metrics

Several probes providing metrics are included in the component, and are available through the JMX MBean 'org.ow2.petals:type=custom,name=monitoring_<component-id>', where <component-id> is the unique JBI identifier of the component.

Common metrics

The following metrics are provided through the Petals CDK, and are common to all components:

Dedicated metrics

No dedicated metric is available.

Receiving alerts

Several alerts are notified by the component through notification of the JMX MBean 'org.ow2.petals:type=custom,name=monitoring_<component-id>', where <component-id> is the unique JBI identifier of the component.

To integrate these alerts with Nagios, see Receiving Petals ESB defects in Nagios.

Common alerts

Dedicated alerts

No dedicated alert is available.