OWASP Hartford: February 2009

The next meeting of the Hartford CT chapter of OWASP will occur on February 10th and will feature Mary Ruddy of Project Higgins along with Ramesh Nagappan of Sun.

OWASP events are 100% free to attend. Help spread the word...

What Craig Randall isn't telling you about Documentum CMIS

Craig Randall of Documentum outlines what it takes to Consume CMIS WSDL in Visual Studio but intentionally leaves out many important details...



For example, his quote:

you will likely want to take a more secure approach to managing user credentials.

Doesn't talk about what service-based interfaces exist to manage user credentials within Documentum or more importantly, how to not manage user credentials across various implementations of CMIS. So, if you want to integrate Filenet and Documentum, do you have to store users in multiple places? If the answer is yes, then is this a good architecture?

Likewise, his comment:

There are other ways to "wire" WS-Security header creation and passing into applications. This particular sample takes a more subtle (less in-your-face) approach to accomplish this concern. Regardless, implicit SOAP headers in a contract require extra coding on the part of a consumer.

doesn't mention how the Documentum server can consume WS-Security messages. For example, how do I configure Documentum Server to accept SAML 2.0 messages and integrate with other technologies such as Oracle OIF, PingIdentity or OpenSSO.

Not that I expect Craig Randall to provide a response, but I do hope that he will share more details on how things should work at a deeper level...

Enterprise Architecture: Best Practices in Asking Questions...

There is a right and wrong way to ask questions...



When you ask a question, you are asking people to do you a favor. People have no reason to help you. I wonder if I had asked Craig Randall in a nicer way why DFS is designed the way it is or James Robertson why he believes Smalltalk as a great language is on the decline, I would have gotten different responses.

The hardest demographic to ask questions is of the crowd that reads into vs simply reading as you are also required to think about how others may interpret (or get it twisted). This is a skill that enterprise architects need to master in order to truly understand the strategic intent of the business.

Sometimes questions on the surface appear dumb and it is our job to peel back the onion. It may sound something like: what is the difference between X and Y. Sometimes your mind may immediately jump to substituting X for ass and Y for a hole in the ground, but that would rob you and others from truly allowing insight to emerge.

Of course, I don't follow my own advice. When I was starting to learn Java after getting frustrated when coming from an MS-centric MFC point of view, "Microsoft does better than Java" or "Java is bad because it can't do ". Every time I did this, I was flooded with solutions... unless I was right. The same behavior patterns occur in the blogosphere in that if I post something inaccurate, I will get flooded but if I share accurate opinions on blog entries on Indian Outsourcing, SOA, BPM, ECM or whatever other topic, no one ever responds.

My preferred approach can certainly be considered hostile and to beg the question of whether it is necessary, to which I can soundly say No. Of course this would also require acknowledgement that my approach is efficient which should be another goal of enterprise architecture...