SOA Testing.ppt

SOA TestingAhamad Patan8th Sept 2009ahamad.patan@Agendaü SOA Overviewü SOA Testing – An End to End ApproachüTesting Web Service API’süAPI Testing StrategiesüExerciseüTesting Web Service Applicationsü SOA Testing Challengesü SOA Test Automation Approachü QA SessionSOA OverviewWhat is SOA?ØService-Oriented Architecture (SOA) is an architectural style. ØApplications built using an SOA style deliver functionality as services that can be used or reused when building applications.SOA Continued…ØSOA in other terms üA service-oriented architecture is essentially a collection of services üServices are based on heterogeneous technologies.üApplication functions are modularized and presented as services.üA service is an implementation of a well-defined business functionality.üService interface is independent of the implementation.SOA Continued…üServices are platform independent, self describing interfaces (XML)üMessages are formally defined üServices can be provided on any platformSOA and WebservicesnSOA is not Webservices, but web services are the preferred standards-based way to realize SOA .nWeb services are software systems designed to support interoperable machine-to-machine interaction over a network. This interoperability is gained through a set of XML-based open standards, such as WSDL, SOAP, and UDDI. These standards provide a common approach for defining, publishing, and using web services. SOA and Webservices continued…nInteroperability is the most important principle of SOA. This can be realized through the use of web services, as one of the key benefits of web services is interoperability, which allows different distributed web services to run on a variety of software platforms and hardware architectures.Webservices basicsWSDL Web Service(J2EE, PL/SQL,.NET,C/C++,Legacy …)Web ServiceClient(J2EE, .NET,PL/SQL …)Points to descriptionDescribesServiceFindsServiceSOAPPoints to serviceUDDI RegistrySOA TestingnTesting Web Service API’snTesting Web Service ApplicationsTesting Web Service API’sØFollowing types of testing needs to be performedüFunctionalityüPerformanceüRe-usabilityüSecurityüInteroperabilityüComplianceüBackward compatibilityTesting web service API’sFunctional￿TestingØAPI￿TestingØDetect￿errors￿at￿an￿early￿stage,￿right￿from￿the￿requirements￿level.ØEnsure￿that￿real-world￿test￿data￿is￿usedØAutomate￿test￿case￿execution￿to￿improve￿productivityTesting web service API’sPerformance￿TestingnWeb￿Services￿have￿high￿usage￿and￿high￿reuse￿opportunities.￿Example:￿A￿service￿has￿been￿identified￿as￿serving￿10000￿concurrent￿users￿with￿5￿sec￿of￿response￿time.￿Typically,￿services￿are￿server￿side￿components￿that￿do￿not￿have￿a￿front￿end.￿It￿is￿therefore￿useful￿to￿have￿a￿sample￿GUI￿interface￿that￿can￿be￿used￿to￿load￿test￿the￿service￿from￿a￿web￿client.Testing web service API’sReusability￿TestingØThe￿more￿a￿service￿gets￿reused,￿the￿greater￿the￿impact￿associated￿with￿its￿downtime￿will￿be.ØMake￿sure￿that￿the￿APIs￿would￿work￿in￿all￿possible￿business￿scenarios,￿thus￿ensuring￿consumability￿Testing web service API’sSecurity￿TestingØWeb￿Services￿are￿exposed￿to￿the￿outside￿world,￿this￿fact￿opens￿up￿a￿host￿of￿vulnerabilities,￿such￿as￿DOS￿(denial-of-service)￿attacks,￿penetration,￿high￿volumes￿of￿spam￿data,￿etc.￿Typical￿security￿policies￿have￿to￿be￿enforced￿at￿the￿network￿level￿to￿create￿bullet￿proof￿SOA.￿Specific￿test￿cases￿aimed￿at￿targeting￿these￿policies￿need￿to￿be￿designed￿to￿fully￿test￿SOA￿security.Testing web service API’sSecurity￿TestingØA￿denial-of-service￿attack￿(DoS￿attack)￿is￿an￿attempt￿to￿make￿a￿computer￿resource￿unavailable￿to￿its￿intended￿users.ØPrevent￿an￿Internet￿site￿or￿service￿from￿functioning￿efficiently,￿temporarily￿or￿indefinitely.￿ØConsumption￿of￿computational￿resources,￿such￿as￿bandwidth,￿disk￿space,￿or￿processor￿timeØCrash￿the￿operating￿system￿itself.￿Testing web service API’sSecurity￿TestingØTesting￿-￿Simulate￿denial-of-service￿attacksØPopular￿denial-of-service￿mitigation￿products￿from￿Arbor￿NetworksTesting web service API’sInteroperability￿TestingØThe￿ability￿of￿two￿or￿more￿systems￿or￿components￿to￿exchange￿information￿and￿to￿use￿the￿information￿that￿has￿been￿exchanged.ØInvolves￿different￿technology￿platforms￿and￿development￿tools.￿Developers￿use￿many￿different￿tools￿to￿generate￿the￿contracts￿(WSDL)￿and￿modify￿them￿in￿the￿process.￿Testing web service API’sInteroperability￿TestingØTesting￿–￿should￿be￿tested￿on￿different￿technology￿platforms.￿Testing web service API’sCompliance￿TestingØTesting￿to￿determine￿whether￿we￿meet￿some￿specified￿standardsØValidating￿WSDL￿definitions￿ØValidating￿SOAP￿request/response￿messagesTesting web service API’sBackward￿Compatibility￿TestingAs businesses evolve, changes may required in the Web Services, but some consumers may want to continue the old services. The challenge is to make sure that old service consumers are still supported. SOA Testing – ChallengesSOA Testing ChallengesMajor Challenges:Ø No user interface for the Web ServicesØ Difficult to create Real time applications Ø Test Data should be close to the end user environment Ø Infinite consumers possible SOA Testing ChallengesØ Test Automationü Client Simulators (Message simulation)ü Service Simulators ü Automatic test data creation ü Choosing the right test automation toolØ Maintaining pool of testing resources with SOA domain knowledgeSOA Test Automation ApproachTraditional Testing Tools GUI Testing ApproachIn House Test Tools Web Service Testing ToolsSOA Test Automation ApproachTraditional Testing ToolsØ Web Services SOAP requests needs to be generated manually or using a supported third party vendor testing toolØ Integrating traditional functionality testing tool and other such third party tool is not feasible due to its nature and limitationsØ A mix of manual and automated process is an additional overheadØ It’s a time consuming and expensive effortSOA Test Automation ApproachGUI Testing ApproachØ Web Service is UI less application.Ø GUI application should be developedØ Web service interface changes demands often GUI changesØ Web Services security testing that requires encrypted & singed data is not possibleØ Overall cost involved is very high for testing,development & maintenance effortsSOA Test Automation ApproachIn House Test ToolsØ Focus is drawn towards developing & maintaining the test tools than the actual testingØ In-house test tool itself need to undergo testing to ensure it is coded to the specificationsØ Dependency on in-house tools will impact test schedules & quality of the deliverable in demanding situationsØ Time Consuming and expensive approach SOA Test Automation ApproachWeb Services Testing ToolsØ Provides robust, reliable, scalable and interoperable solutionØ Best fit for UI less testingØ Provides a solution for load testingØ Test data generation for any WSDL version is possible and easily maintainable. Ø Depending on existing legacy systems & back-end applications, web services test tools can be tweaked by developing / modifying test scripts to provide an E2E solution for backward compatibilityØ Unlike any other traditional testing tool, the cost involved is very minimal.ExamplenA Web Service maps user input IP addresses to countriesnString findCountry(String ip)ExampleTest PlanDescriptionInput ValueExpected ResultValid ip address10.177.223.253IndiaValid Ipv6 address3ffe:1900:4545:3:200:f8ff:fe21:67cfUSInvalid address12.54.12.32.77.88Error, Not a valid inputExample – Strategy 1Suppose this API belongs to the class IPHelper.IPHelper iph = new IPHelper();String result1 = Iph.findCountry(“10.177.223.253”);If (result1.equals(“India”))System.out.println(“Test1 Passed”);ElseSystem.out.println(“Test1 Failed”);Example – Strategy 2Store the data in a xml file10.177.223.253India3ffe:1900:4545:3:200:f8ff:fe21:67cf US12.54.12.32.77.88Invalid InputExample – Strategy 2Read the xml file as test data input.Parse the xml file into an Object(xmlObject)IPHelper iph = new IPHelper();For (int I =0; I