Better Software - March 2009 - (Page 36) Figure 1: First page of a WS-I profile conformance report Ideally, Web services testing should be performed directly, accessing its API, and not through a GUI that may filter or mask data. However, if you do create (or purchase) a tool that supplies a GUI, you now have the option of using automation test tools as you would with any other GUI application. Compliance and Interoperability Testing One of the promises of SOAP and Web services is interoperability, and this is key to the success of Web services. After functionality testing, we know that the Sell Your Junk Web service works by itself, but now we need to verify that it works with the BillMe Web service developed by another group. Web services rely on standards for SOAP, the WSDL, and security. See the StickyNotes for links to some of the common standards used in Web services. Some of the interoperability challenges in testing Web services include understanding the impact of change and the increased number of communication paths caused by the increased number of APIs (one for each service). To mitigate the effect of these challenges, you must test the application and multiple Web services end to end, service by service, and interface by interface. Interoperability testing is performed by testing all valid and invalid multiservice scenarios, 36 BETTER SOFTWARE MARCH 2009 as well as WSDL standards compliance. End-to-end, service-by-service, and interface-by-interface testing can be performed using the same tools used for functional testing; however, this time, the test connects Web services to other Web services completing the process. So we now may enter information into the Sell Your Junk Web service and check the output of the BillEm Web service, which is a database entry. This ensures complete, end-to-end testing. One of the strengths of Web services is platform independence, meaning that the application can be .NET, Java, or any other language and still function properly. The way to verify this compatibility is by testing the WSDL to ensure that it is both .NET and Java compliant. WSDL validation is performed using a WSDL WS-I validation tool that is included as a part of most test tools. These tools analyze a WSDL to check that it conforms to WS-I standards. Use the Interoperability Testing Tools 1.1 from the Web services Interoperability Organization Web site (www.ws-i.org), and run the test using the instructions provided with your tool. In most cases, you give the tool the location of the WSDL, the location of the interoperability testing tool file, and the type of assertions you want to show (e.g., all assertions, only passed, or only failed) and then execute. Figure 1 shows the first page of a WS-I profile conformance report. www.StickyMinds.com This report shows whether each assertion in the WSDL is compliant with WS-I standards. Repeat this test for both .NET and Java to ensure that the WSDL is WS-I compatible with both. You are not required to test the WSDL for compatibility, and it does not need to be .NET and Java compatible to be a functioning Web service. However, if you are going to grow your architecture and move to SOA or hope to interface with other Web services in the future, it would be a best practice to start early with an agreed-upon architecture to take full advantage of the power of Web services. Security Testing Is the Web service safe? Can the Sell Your Junk Web service control who accesses it? The benefits of Web services also create the biggest security challenges: • Loosely coupled services • A collection of independent collaborating services • Web services that may each require different authentication and enforce different security policies • Web services that do not define how to do security, but rely on other mechanisms layered on top As with SOAP and the WSDL, Web services have standards for security including the WS Security profile. A Web http://www.ws-i.org http://www.StickyMinds.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.