A seminar session at the IDM Conference, held at the Russell Square Hotel in London on 6 November 2013. I presented it with Rick Gay of Axway, whose API Server XML Gateway (XMLG) Three uses.
The session described how Three used the XML Gateway to secure partner and cloud access to APIs and backend services. The business driver was to centralise transactions with retail channels and MVNOs (mobile virtual network operators), so that new customers could be onboarded faster and more securely, and so that Three would be easier to do business with.
The session covered:
- MVNO partner integration and the automation of customer provisioning via APIs
- Mobile top-ups via ATMs, and online store access to backend APIs
- Partner authentication and authorisation
- Protecting backend systems from spikes in request volumes, using service quotas over short and long time windows
- Threat detection, including SQL injection, plus header augmentation, endpoint routing and monitoring of downstream performance
- Integration with TIBCO, and a physical deployment across two geographic sites with load balancing
Key learnings:
- Agree early where ownership of the platform should sit. Business sponsorship for middleware is hard to secure.
- Decide the service authorisation model early, per method or per service set, because it shapes the whole policy structure.
- Reporting is not centralised when several gateway clusters are deployed.
- Partner migration is hard to sell to the business, so it helps to piggy-back on a business project.
- Plan for partner accreditation and integration test environments, and for a partner management portal.
- An XML gateway is not just a transparent proxy.
Looking ahead, the aims were to use the XMLG for REST and mobile device access, multi-channel services, internal API management and the governance of cloud service consumption.