Implementing Service Invocation Framework

This chapter covers the following topics:

Overview

To invoke all integration services from Oracle E-Business Suite, Oracle E-Business Suite Integrated SOA Gateway uses service invocation framework (SIF) that leverages Oracle Workflow Java Business Event System (JBES) and a seeded Java rule function to allow any SOAP service, described in WSDL, to be invoked.

By using this service invocation framework, developers or implementors can interact with SOAP services through WSDL descriptions. This approach lets developers or implementors use WSDL as a normalized description of disparate software, and it allows them to access this software in a manner that is independent of protocol or location.

Because this invocation framework allows updated implementations of a binding to be plugged into WSIF at runtime, it not only facilitates a stubless or completely dynamic web service invocation, but also allows the calling service to defer choosing a service binding until runtime. More importantly, this enhances the seamless business integration between loosely-coupled applications and accelerates service execution and consumption.

Note: WSIF is a simple Java API for invoking web services. It is supported by Oracle Application Server 10g Release 3 (10.1.3) which is shipped together with Oracle E-Business Suite Release 12. To upgrade your instance from Release 12, ensure that your system is upgraded to appropriate versions of Oracle Application Server 10g. See Installing Oracle E-Business Suite Integrated SOA Gateway, Release 12, My Oracle Support Knowledge Document 556540.1 for details.

Note that the service invocation framework discussed here only supports document-based web service invocation. Oracle E-Business Suite Integrated SOA Gateway does not support RPC (remote procedure call) style web service invocation through this invocation framework.

Note: The document-based web service typically uses the form of XML with commonly agreed upon schema between the service provider and consumer as a communication protocol. While RPC-based web service is to invoke a cross-platform remote procedure call using SOAP.

To have a better understanding on how the service invocation framework invokes web services, the following topics are described in this chapter:

Service Invocation Framework Architecture Overview

Oracle Workflow is the primary process management solution within Oracle E-Business Suite; Oracle Workflow Business Event System, an essential component within Oracle Workflow, provides event and subscription features that help identify integration points within Oracle E-Business Suite.

The Business Event System consists of an Event Manager and workflow process event activities. The Event Manager lets you register subscriptions to significant events; event activities representing business events within workflow processes let you model complex business flows or logics within workflow processes.

When an event occurs, the Event Manager executes subscription to the event. Subscription processing can include executing custom code on the event information, sending event information to a workflow process, and sending event information to other agents or systems.

For example, to invoke a Web service through Oracle Workflow JBES, the description of WSDL URL representing the Web service must be consumed through the event subscription definition so that Web service metadata can be parsed and stored as subscription parameters.

Note: By leveraging Oracle Workflow Java Business Event System (JBES), service invocation framework allows almost any forms of Web services representing in WSDL URLs to be invoked out from Oracle E-Business Suite.

At run time, when an invoker event is raised, the event and subscription parameters are used to invoke Web services.

Note: If event parameters are passed with the same names as the subscription parameters that have been parsed and stored, the event parameter values override the subscription parameters.

To better understand how the invocation process takes place and its relationship between Oracle Workflow components, the following architecture diagram provides the topology of various components that exchange information during the end-to-end service invocation from within Oracle Workflow process:

the picture is described in the document text

Oracle Workflow Business Event System is a workflow component that allows events to be raised from both PL/SQL and Java layers. Therefore, the service invocation from Oracle E-Business Suite can be from PL/SQL or Java.

  1. Service Invocation from PL/SQL

    1. Application raises a business event using PL/SQL API WF_EVENT.Raise.

      The event data can be passed to the Event Manger within the call to the WF_EVENT.Raise API, or the Event Manger can obtain the event data or message payload by calling the generate function for the event if the data or payload is required for a subscription.

      Note: See Oracle Workflow API Reference for information about WF_EVENT.Raise API.

    2. Oracle Workflow Business Event System (BES) identifies that the event has a subscription with Java Rule Function oracle.apps.fnd.wf.bes.WebServiceInvokerSubscription.

    3. The Business Event System enqueues the event message to WF_JAVA_DEFERRED queue. The Java Deferred Agent Listener then dequeues and executes the subscription whose Java rule function invokes the Web service.

    4. If callback event and agent parameters are mentioned, the Web service response is communicated back to Oracle E-Business Suite using the callback information. The Java Deferred Agent Listener process that runs in Concurrent Manager (CM) tier invokes the Web service.

  2. Service Invocation from Java

    1. Java Application raises a business event using Java method oracle.apps.fnd.wf.bes.BusinessEvent.raise either from OA Framework page controller/AMImpl or Java code running on Concurrent Manager (CM) tier.

    2. Since the event is raised in Java where the subscription's seeded Java Rule Function oracle.apps.fnd.wf.bes.WebServiceInvokerSubscription is accessible, whether the rule function is executed inline or deferred is determined by the phase of the subscription.

      • If the invoker subscription is created with Phase >= 100, the event is enqueued to WF_JAVA_DEFERRED queue.

      • If the invoker subscription is created with Phase < 100, the event is dispatched inline.

        If the event is raised from OA Framework page, the dispatch logic executes (that uses WSIF to invoke the Web service) within OACORE OC4J container.

After an event is raised either using PL/SQL API or Java method, the raised event can be processed in the following ways:

While invoking the Web service, the seeded Java rule function first reads the Web service metadata created for the subscription.

If Web service input message requires transformation, the Java rule function performs XSL transformation on the request message generated during the event creation by using a PL/SQL API ECX_STANDARD.perform_xslt_transformation. Next, the Java rule function invokes the service.

Note: For detailed information on the XSL transformation PL/SQL API, see Execution Engine APIs, Oracle XML Gateway User's Guide.

If it is for the synchronous request - response operation, when the response message is available and XSL transformation is required on the Web service output message, XSL transformation on the output (response) message will be performed.

If callback information is provided, perform callback by either raising a business event or by enqueuing the event to a given workflow agent with the response message as payload.

Note: For the service invocation from Java code, if the Web service invoker subscription is synchronous with subscription phase < 100, then the Web service is invoked as soon as the event is raised, and if successful the response is available immediately by using method getResponseData() on the BusinessEvent object.

Service Invocation Framework Major Features

Service Invocation Framework includes the following features:

Implementing Service Invocation Framework

This section discusses the following topics:

Setup Tasks

Web services can be invoked from any one of following tiers:

Proxy Host and Port Setups

In most cases, the Web service resides outside the firewall and the executing host does not have direct access to the WSDL or the Web service endpoint to send the SOAP request. Therefore, administrators must set up and configure proxy host and port appropriately for the tiers that Web service invocations occur in order to perform following activities:

Setting Up Proxy Host and Port at OC4J Tier

For Web services invoked from OA Framework, the JBES seeded Java rule function would run within OACORE's OC4J container.

The oc4j.properties ($INST_TOP/ora/10.1.3/j2ee/oacore/oc4j.properties) should have the following properties or proxy values in order for it to work:

http.proxyHost=myproxyhost

http.proxyPort=80

To update the oc4j.properties file, you need to update AutoConfig context file with following entries and run AutoConfig:

<!-- proxy -->
                <proxyhost oa_var="s_proxyhost">myproxyhost</proxyhost>
   <proxyport oa_var="s_proxyport">80</proxyport>  
   <porxybypassdomain oa_var="s_proxybypassdomain">any domain that needs to be by-passed (such as *.example.com)</porxybypassdomain>

Setting Up Proxy Host and Port at Concurrent Manger (CM) Tier JVM

For Web services invoked from PL/SQL and Java using asynchronous subscriptions, the event is raised by the application code wherever it executes and then it is enqueued to WF_JAVA_DEFERRED queue by the Event Manager. The event subscription is executed from the CM tier by the Java Deferred Agent Listener.

If a Web service is invoked by the Java Deferred Agent Listener, then the code would run within a concurrent manager tier Java service's JVM. If the Web service resides outside the firewall, it requires updating the following Service Parameters for Workflow Agent Listener Service from Oracle Workflow Manager available through Oracle Applications Manager:

For detailed information, see Editing Service Parameters for a Container, Oracle Workflow Administrator's Guide.

Setting Up Proxy Host and Port When Using Standalone Java Class

You must set the following entries:

java -Dhttp.proxyHost=myproxyhost -Dhttp.proxyPort=80 class name

Setup Tasks for Invoking SSL-based Web Services over HTTPS

Service Invocation Framework supports SSL-based Web service invocation using Server Authentication method. When a client connects to a Web server securely via HTTPS, the server sends back its server certificate to the client for verification. Once verified, the client sends the data, encrypted, to the server. Server Authentication allows the client to identify the server. Before invoking a Web service from a server over HTTPS (HTTP protocol over TLS/SSL), some manual setup tasks need to be performed properly to read SSL-based WSDLs and invoke SSL service endpoints.

A client may receive one of following two types of server certificates to verify:

Following two setups are required for the service invocation framework to invoke a SSL-based Web service:

Importing Server SSL Certificate into SIF's JVM Certificate Store

Public Certificate Issued by a Certification Authority (CA)

If server certificate is a public certificate and issued by a public CA such as VeriSign, then it is most likely available in a SIF's JVM's certificate store or in a trusted certificate list.

Self-signed Certificate or Certificate is not in Trusted Certificate List

Complete the following tasks to import the server's SSL certificate into a SIF's JVM's certificate store or add it to a trusted certificate list:

  1. Export the server certificate using either one of the following methods:

    • Use openssl Utility:

      Use openssl utility to connect to the destination server with the following syntax:

      $ openssl s_client -connect <server>:<port> -showcerts

      Important: If there is no port in destination, default HTTPS port 443 should be used.

      For example: $ openssl s_client -connect host.example.com:443 -showcerts

      Copy the certificate content from BEGIN CERTIFICATE to END CERTIFICATE (including BEGIN CERTIFICATE and END CERTIFICATE lines as shown in the sample certificate) into a file and save the file (such as my_cert.cer).

      A sample output of above openssl command can be like:

      $ openssl s_client -connect host.example.com:443 -showcerts

... 
Server certificate
-----BEGIN CERTIFICATE-----
MIIFVjCCBD6gAwIBAgIQBVWzfUyIcCa5LtuV+f9WvjANBgkqhkiG9w0BAQUFADCB
sDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNTEqMCgGA1UEAxMh
VmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBMB4XDTA5MDQyMTAwMDAw
MFoXDTEwMDUwNTIzNTk1OVowgckxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxp
Zm9ybmlhMRcwFQYDVQQHFA5SZWR3b29kIFNob3JlczEbMBkGA1UEChQST3JhY2xl
IENvcnBvcmF0aW9uMR8wHQYDVQQLFBZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MTMw
MQYDVQQLFCpUZXJtcyBvZiB1c2UgYXQgd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMp
MDUxGTAXBgNVBAMUECoub3JhY2xlY29ycC5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAL/EBxxt2keWTuJbo4SogWmiaJxThYDMvy8nWkpvKIp3s7OCQW0G
t17sAirfBkUirbGRlcWi5fi0RReruGXgYxFnf12fBNAimRWVo3mjeQo8BpRBm27n
3YcTZUlaIE77FvB3913jzD9c4sbjIe2fGpVmx+X9PZmDKSY9KPGjDbFNAgMBAAGj
ggHTMIIBzzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIFoDBEBgNVHR8EPTA7MDmgN6A1
hjNodHRwOi8vU1ZSU2VjdXJlLWNybC52ZXJpc2lnbi5jb20vU1ZSU2VjdXJlMjAw
NS5jcmwwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcXAzAqMCgGCCsGAQUFBwIBFhxo
dHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMB0GA1UdJQQWMBQGCCsGAQUFBwMB
BggrBgEFBQcDAjAfBgNVHSMEGDAWgBRv7K+g3Yqk7/UqEGctP1WCvNfvJTB5Bggr
BgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNv
bTBDBggrBgEFBQcwAoY3aHR0cDovL1NWUlNlY3VyZS1haWEudmVyaXNpZ24uY29t
L1NWUlNlY3VyZTIwMDUtYWlhLmNlcjBuBggrBgEFBQcBDARiMGChXqBcMFowWDBW
FglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBRLa7kolgYMu9BSOJsprEsHiyEFGDAm
FiRodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvMS5naWYwDQYJKoZIhvcN
AQEFBQADggEBADBi9NfljQLuD2Tnol3pmQl717rc8kKmpLYEO6u5MxIK0+L2MslV
4NE1qbNx1dfIoW68HHXtpsF5KtKFLYk9EoOkBd7oMp7fFv31RANV3LpdAHZC9EaK
CA/oKB2RrSu7ZmaUvoRb+3v5FdhAmgtoY6Wljk0yxMvXVf/TOeXqKl8C/r1gSzyC
s/jVmy6N81Oeleqtozzt/aJNGu7xu/MdtP13eyu7RSEBRGJwEwTXH+rTUKK8mle0
Kz15DgJ6ByK2XZmD4Z+O8DTUhUhIHR1OhuLR7zjGp9W7wQuCizUcTvuKEGzVf5D/
y7orhV0U+AoXnl/5wntVMZc/Tmqr/Fkb8+g=
-----END CERTIFICATE-----

...

    • Use Web Browser:

      Access the WSDL file available through HTTPS URL (such as https://<hostname>:<port>/webservices/SOAProvider/xmlgateway/ont__poi/?wsdl) through a Web browser.

      1. After the WSDL file is successfully loaded in a browser, double click on the Lock icon on the bottom right hand corner of the browser and export the certificate.

        For example, in Internet Explorer, double click on the Lock icon > Details > Copy to File.

        In Mozilla Firefox, double click on the Lock icon > Security > View Certificate > Details > Export.

      2. You can also use browser menu to access the certificate. For example, in Internet Explorer, select Internet Options from the Tools drop-down menu to open the Internet Options pop-up window. Select the Content tab, click Certificates and then select the Personal (or Other People) tab to select your certificate and click Export.

      3. You can export or save certificate either in DER encoded binary X.509 (.CER) or in Base 64 encoded.

        Note: Different browser versions may have different steps to Export SSL certificates.

  2. Import the server's SSL certificate into an appropriate SIF JVM's certificate store to add it to the list of trusted certificates.

    Important: Information about where Web services are invoked through the service invocation framework is described in the Setup Tasks.

    There are many utilities available to import a certificate. For example, you can use keytool, a key and certificate management utility that stores the keys and certificates in a keystore. This management utility is available by default with JDK to manage a keystore (database) of cryptographic keys, X.509 certificate chains, and trusted certificates.

    The keytool commands can have the following syntax:

    keytool -import -trustcacerts -keystore <key store location> -storepass <certificate store password> -alias <alias name> -file <exported certificate file>

    For example:

    keytool -import -trustcacerts -keystore "$AF_JRE_TOP/jre/lib/security/cacerts" -storepass password -alias xabbott_bugdbcert -file my_cert.cer

    Note: This must be typed as a single line.

    The file (-file) is the exported certificate file, for example my_cert.cer.

Setting Up SSL Proxy Host and Port

If the SSL-based Web service resides outside the firewall, the JVM that invokes the Web service has to communicate through SSL proxy. Following setup tasks are required in all appropriate tiers to use SSL proxy.

Setting Up Proxy Host and Port at OC4J Tier

For Web services invoked from OA Framework, the JBES seeded Java rule function would run within OACORE's OC4J container.

The oc4j.properties ($INST_TOP/ora/10.1.3/j2ee/oacore/config/oc4j.properties) should have the following properties in order for it to work:

AutoConfig does not support properties https.proxyHost and https.proxyPortcurrently. If the above properties are added to oc4j.properties manually, subsequent AutoConfig run will remove these two properties. In order to make sure the above properties are retained during AutoConfig run, the context file could be customized to add these two properties.

How to customize AutoConfig-managed configurations, see Using AutoConfig to Manage System Configurations in Oracle E-Business Suite Release 12, My Oracle Support Knowledge Document 387859.1 for details.

Setting Up Proxy Host and Port at Concurrent Manger (CM) Tier JVM

For Web services invoked from PL/SQL and Java using asynchronous subscriptions, the event is raised by the application code wherever it executes and then it is enqueued to WF_JAVA_DEFERRED queue by the Event Manager. The event subscription is executed from the CM tier by the Java Deferred Agent Listener.

If a Web service is invoked by the Java Deferred Agent Listener, then the code would run within a concurrent manager tier Java service's JVM. Workflow Agent Listener Service does not currently support Service Parameters to set SSL proxy. The SSL proxy could be set up directly to Concurrent Manager's JVM system properties in $APPL_TOP/admin/adovars.env using AutoConfig.

<oa_environment type="adovars">
 <oa_env_file type="adovars" oa_var="s_adovars_file" osd="unix”>
  $APPL_TOP/admin/adovars.env</oa_env_file>
...
 <APPSJREOPTS oa_var="s_appsjreopts">="-Dhttps.proxyHost=[proxyhost] 
  -Dhttps.proxyPort=[sslproxyport]</APPSJREOPTS>
...
</oa_environment>

Setting Up Proxy Host and Port When Using Standalone Java Class

You must set the following entries:

java -Dhttps.proxyHost=[proxyhost] -Dhttps.proxyPort=[sslproxyport] 
<class name>

Performing Additional Setup Tasks

Additionally, performing the following tasks to invoke services with TLS 1.2 only and TLS 1.2 with backward compatibility:

  1. Apply Patch 22612527 with prerequisite Patch 13866584 to the FMW home (FMW_HOME).

  2. Update the 32-bit JDK 7 under $OA_JRE_TOP with the Java Cryptography Extension (JCE) updates from the following page: https://www.oracle.com/java/technologies/javase-jce7-downloads.html

  3. Update the 64-bit JDK 7 under the directory referenced by the s_fmw_jdktop context variable with the Java Cryptography Extension (JCE) updates.

  4. Update the Oracle E-Business Suite context variables using Oracle Applications Manager.

    1. Log in to Oracle E-Business Suite as a user who has the Workflow Administrator Web Applications responsibility.

    2. Select the Oracle Applications Manager link from the Navigator, and then select AutoConfig.

    3. Select the application tier context file, and choose Edit Parameters.

    4. Update the following context variables:

      • s_afjsmarg = -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 or -Dhttps.protocols=TLSv1.2

        • To enable TLS 1.2 with backward compatibility, add the following:

          s_afjsmarg = -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2

        • To enable TLS 1.2 only, add the following:

          s_afjsmarg = -Dhttps.protocols=TLSv1.2

      • s_proxyhost = fully qualified host.domain name

      • s_proxyport = port value

      • s_proxybypassdomain = domain name (For example, example.com)

      • s_nonproxyhosts = wildcard domain name (For example, *.example.com)

  5. Run AutoConfig using the adautocfg.sh script in the application tier $ADMIN_SCRIPTS_HOME directory.

  6. Run the adstpall.sh script and the adstrtal.sh script in the same $ADMIN_SCRIPTS_HOME directory to stop and restart all services.

For more information about enabling TLS in Oracle E-Business Suite Release 12.1, see My Oracle Support Knowledge Document 376700.1.

Implementing Service Invocation Framework

As mentioned earlier, service invocation framework, leveraging Oracle Workflow Business Event System and a seeded Java rule function, oracle.apps.fnd.wf.bes.WebServiceInvokerSubscription, enables the invocation of Web services from Oracle E-Business Suite. Therefore, the invocation of Web services using service invocation framework involves the following steps:

Defining Invocation Metadata and Invoking Web Services Through the Business Event System

By using Oracle Workflow Business Event System to create events and event subscriptions, Web service invocation metadata can be defined. When a triggering event occurs, a Web service can be invoked through an appropriate event subscription.

Before invoking Web services, the following Web service invocation metadata must be defined first through the Business Event System:

To create an event, log on to Oracle Workflow with the Workflow Administrator Web Applications responsibility and select the Business Event link and click Create.

To access the business event subscription page, log on to Oracle Workflow with the same Workflow Administrator Web Applications responsibility and select the Business Event link > Subscriptions. Click Create Subscription to access the event subscription page.

For detailed instructions on how to create business events and event subscriptions to invoke Web services, see Oracle E-Business Suite Integrated SOA Gateway Developer's Guide.

Calling Back to Oracle E-Business Suite With Web Service Response

As mentioned earlier, if a Web service has an output or a response message to communicate or callback to Oracle E-Business Suite, then a receive event and the local subscription to the receive event must be created first in the Business Event System.

To accomplish this (synchronous request - response) process, the service invocation framework uses the callback mechanism to communicate the response back to Oracle E-Business Suite through the Business Event System. As a result, a new or waiting workflow process can be started or executed. The following callback subscription parameters are used to support the callback mechanism:

If event parameters are passed with the same names as the subscription parameters that have been parsed and stored, the event parameter values take precedence over subscription parameters. For example, the event parameters are passed as follows:

To process Web service responses from inbound workflow agent, make sure you have agent listener set up properly.

Detailed information about these callback subscription parameters, see Oracle E-Busines Suite Integrated SOA Gateway Developer's Guide.

Managing Errors

If there is a run-time exception when invoking the Web service by raising the Invoker event with synchronous subscription (phase <100), the exception thrown to the calling application. It is the responsibility of the calling application to manage the exception.

If there is a run-time exception when the Workflow Java Deferred Agent Listener executes event subscription to invoke the Web service, the event is enqueued to WF_JAVA_ERROR queue. If the event has an Error subscription defined to launch Error workflow process WFERROR:DEFAULT_EVENT_ERROR2, the Workflow Java Error Agent Listener executes the error subscription which sends a notification to SYSADMIN with Web service definition, error details and event details. SYSADMIN can correct the error and then invoke the Web service again from the notification if necessary

For more information on error handling during Web service invocation, see Oracle E-Busines Suite Integrated SOA Gateway Developer's Guide.

Testing Web Service Invocations

To validate whether Web services can be successfully invoked from concurrent manager and OACORE OC4J, integration developers can run a test case through Oracle Workflow Test Business Event page. Use this test to check the basic operation of Business Event System by raising a test event from Java or from PL/SQL and executing synchronous and asynchronous subscriptions to that event.

By using Raise in Java option to raise the Invoker event with synchronous subscription (phase <100), Web service invocation within OACORE OC4J can be tested. If there is a run-time exception when invoking the Web service using synchronous subscription, the exception message is shown on the Test Business Event page.

The following event parameters may be specified when raising the event from the Test Business Event page to invoke a Web service:

Detailed information on how to test Web service invocations, see Oracle E-Business Suite Integrated SOA Gateway Developer's Guide.

Extending Web Service Invocation

Oracle E-Business Suite Integrated SOA Gateway allows developers to extend the invoker subscription seeded rule function oracle.apps.fnd.wf.bes.WebServiceInvokerSubscription using Java coding standards for more specialized processing.

Developers could extend the seeded rule function to override following methods for custom processing:

For more information on these methods, see Oracle E-Business Suite Integrated SOA Gateway Developer's Guide.

Implementation Limitation and Consideration

While implementing the service invocation framework, consider the following limitations: