One of more exciting parts of Java EE 5 specification is a heavy support for annotations that enable developers to cleanly expose already developed Java code as web services
through meta data without modifying code for classes or methods.
SAP NetWeaver Application Server Java EE 5 Edition is one of the first application servers in the market to achieve Java EE 5 compatibility (along with Glassfish and Tmaxsoft's JEUS). The preview release of its new Java EE 5 based Application Server
and its first to market strategy in adopting developer friendly specifications shows SAP's desire to appeal to a broader base of developers.
In this article, we share our experience in building a simple HelloWorld
web service using NetWeaver and testing its characteristics using our web services testing tool - SOAPSonar Enterprise Edition
. SOAPSonar is a web services testing product that provides comprehensive Web Services Testing across complex, dependent and distributed deployments.
The test results and conclusions are provided below. We encourage you to download and try SAP NetWeaver Application Server, Java EE 5 Edition. For full download, installation, and test setup instruction details, please see:
Functional Regression Testing
ensures that the web service operations function as advertised over time and that if the underlying code has changed in NetWeaver than such changes are identified and addressed. In our simple web services, the operation sayHello() behaved as expected and return a string value. SOAPSonar provides the ability to set base-line tests for sayHello() and schedule regression test to ensure that all desired pass/fail test conditions are met.
ensures that the web service operations perform as expected once latency and scalability characteristics are identified. Since the NetWeaver Application Server is a trial version, we did not expect it to perform under any significant load. After 10 concurrent connections, we started to see transfer errors indicating that the trial version is restricted for non commercial use and limited traffic. Even with 10 concurrent virtual clients, NetWeaver Application Server performed respectably well with greater than 170 Transactions per Second (TPS) with average of 47 ms response time.
Disclaimer: Our intention in sharing this information is not to provide real life production performance benchmarks of NetWeaver Application Server. Our intent is to share methods and techniques available to you in testing target servers using SOAPSonar as a comprehensive web services testing tool. Your performance mileage may vary based on a variety of factors such as network topology, host hardware and optimization effort!
ensures that the published web service operations interoperate across various platforms. The WSDL endpoint published by NetWeaver Application Server, Java EE 5 Edition is readily consumed by SOAPSonar a .Net-based web services client. SOAPSonar provides additional WS-I Basic Profile 1.1 design-time and run-time test to check for interoperability issues. The design-time interoperability tests passed with flying colors with No Failed Assertions Detected. This means that the WSDL generated by NetWeaver can be readily consumed by any WS-I Basic Profile compliant client regardless of application platform such as .NET, Java or LAMP.
SOAPSonar also provides the ability to execute stringent run-time test by sending auto generate edge case tests. The mutated tests are generated to check whether the endpoint is indeed honoring WS-I Basic Profiles even though the WSDL itself is WS-I compliant. SOAPSonar detected a number of violations where NetWeaver Application Server was accepting non-compliant SOAP requested generated by SOAPSonar.
ensures that the web service published operations are tested for edge cases and are not vulnerable to information leaks, Denial of Service, or other web services attacks. With such assessments, vulnerabilities introduced by poor application coding practices, such as lack of exception handling are quickly determined and remediation actions can be taken. The simple HelloWorldBean described in this article is poorly coded with and lacks exception handling try-catch type constructs. This resulted in a overall Risk Score of 26 with a few Medium Severity issues identified because of stack traces-based information leaks in the response messages.
Developing web services in NetWeaver DeveloperStudio is straight forward and intuitive. The biggest challenge that we faced was overcoming installation hurdles - SDN Forums came to the rescue. The WSDL generated by NetWeaver was interoperable with .NET-based SOAPSonar and we were sending SOAP messages between SOAPSonar and NetWeaver Application Sever seamlessly.
The overall Functional, Performance, Interoperability and Vulnerability profiles for our HelloWorld web service were positive with the not-so-stellar run time interoperability results being the only surprise. We recommend that SAP tighten up its SOAP handling stack in NetWeaver to actively enforce WS-I Basic Profile 1.1 compliance. Also, we expect that edge case or boundary-breaking "Mutant" SOAP messages should be handled elegantly to prevent information probing or inadvertent information leak holes left behind by sloppy developers.
We think SAP NetWeaver Application Server, Java EE 5 Edition is a step in the right direction and provides competitive web services functionality for sophisticated SOA deployments. Give it a try.
Mamoon Yunus is an Advisor for the Crosscheck Networks, CTO of Forum Systems and a pioneer of SOA Gateways & Firewalls. Prior to Forum, Mr. Yunus was at webMethods where he developed XML-based techology. Mamoon holds two Graduate Degrees in Engineering from MIT.
Editor's note: it bears repeating that Mr. Yunus has an association with Crosscheck Networks, who publishes SOAPSonar.