Custom Persistence API implementation in Spring

Hello comunity,

I will need to keep my Orbeon database behind a firewall, which means I will
need to create a custom implementation of the Orbeon Persistance API. It
will probably be a Spring microservice. Is there an existing implementation
of Persistance API, preferably a Spring app? Because I couldn't find any.

Additionally, is there a (standardized) specification of Orbeon's RESTful
API somewhere? I am thinking Open API (Swagger), OData, WSDL... I know about
the  documentation page <https://doc.orbeon.com/form-runner/api/persistence>  
but ideally I wanted to generate my RESTful WS from f.e. a Swagger file.

If there is no such thing, what do you think about Orbeon itself maintaining
such a REST API specification, so it could be reused in the future? Or
creating an open source Spring RESTful WS interface project (interface
meaning it's just Java interfaces and no real implementation)?

Note: I am sticking to Spring as the most common Java framework, Orbeon
being built on JVM.


Best regards,
Adrian

--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/1611319804529-0.post%40n4.nabble.com.

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/5c48b1cb-990b-4ef7-b108-e8484d376951n%40googlegroups.com.

Hi Adrian,

First, I'm sorry but there is no "formal" description of the API, and there
is only the documentation you're pointing to. Now, however, keeping the
database accessed by Orbeon Forms behind a firewall seems like pretty usual
thing to do, and this doesn't require you to write your own implementation
of the persistence API, or is there something I am missing?

-Alex


-----
--
Follow Orbeon on Twitter: @orbeon
Follow me on Twitter: @avernet
--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/1611537274005-0.post%40n4.nabble.com.

Hi Bruno & Alex,

First of all, Alex, what do you think about curating such a formal
specification by Orbeon? Is it a good idea to open an issue on the Orbeon
repo for this?

Well, the WAF is restricted a lot and only very specific SOAP requests can
be allowed to pass through, so I think a custom solution is needed. Even if
it wasn't that custom, I don't really know how to pass a JDBC connection
through a FW, that seems to be hacky and mainly unsecure. Can you give me a
better idea?


And Bruno, thank you for that information & documentation, I hope it helps a
bit.


Best regards,
Adrian

--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/1611568461940-0.post%40n4.nabble.com.

Hi Adrian,


Hawk wrote
> First of all, Alex, what do you think about curating such a formal
> specification by Orbeon? Is it a good idea to open an issue on the Orbeon
> repo for this?

What form do you think such a formal specification should take? I'm not sure
that WSDL is a good choice (or even if it can be used) to document services
that don't use SOAP, and to express requirements about headers. The
persistence API isn't using OData, so that option is out. Could Swagger
work?


Hawk wrote
> Well, the WAF is restricted a lot and only very specific SOAP requests can
> be allowed to pass through, so I think a custom solution is needed. Even
> if
> it wasn't that custom, I don't really know how to pass a JDBC connection
> through a FW, that seems to be hacky and mainly unsecure. Can you give me
> a
> better idea?

What is "the WAF"? And shouldn't or couldn't Orbeon Forms be deployed behind
the firewall, with a reverse proxy only routing HTTP(S) requests to it? And
if you have a requirement to have the services deployed separately behind
the firewall, you could deploy there an Orbeon Forms and use its persistence
API. Would something like this work?

<http://discuss.orbeon.com/file/t119778/Orbeon_Forms_persistence_behind_a_firewall.png>


-Alex


-----
--
Follow Orbeon on Twitter: @orbeon
Follow me on Twitter: @avernet
--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/1611618366163-0.post%40n4.nabble.com.

Alessandro  Vernet wrote
> What form do you think such a formal specification should take? I'm not
> sure
> that WSDL is a good choice (or even if it can be used) to document
> services
> that don't use SOAP, and to express requirements about headers. The
> persistence API isn't using OData, so that option is out. Could Swagger
> work?

I think OpenAPI Specification (formerly Swagger Specification) would be the
best choice, as it's probably the most popular and most used specification.
Also a lot of supportive tooling exists for it (not only from Swagger, but
f.e. Swagger Editor for creating a specification; Swagger UI for displaying
an interactive specification or some codegen tools).

Is it viable to create a GitHub issue for a REST API Specification for
Orbeon? Would anybody take care of it?

------


Alessandro  Vernet wrote
> What is "the WAF"?

Web application firewal

------


Alessandro  Vernet wrote
> And shouldn't or couldn't Orbeon Forms be deployed behind
> the firewall, with a reverse proxy only routing HTTP(S) requests to it?

Sadly it is not a viable option, as the customer requested FW is very strict
in only allowing specific SOAP requests. Additionally, getting another
server approved behind the FW is also not viable.

------


Alessandro  Vernet wrote
> And
> if you have a requirement to have the services deployed separately behind
> the firewall, you could deploy there an Orbeon Forms and use its
> persistence
> API. Would something like this work?
>
> &lt;http://discuss.orbeon.com/file/t119778/Orbeon_Forms_persistence_behind_a_firewall.png
> &gt;

So having 2 instances of Orbeon deployed? Interesting idea! However, it's
basically still limited by the strict policies. Also, we will be probably
using the PE version, so that would be a significant double investment for
the licenses.

-----

Thanks for all the advice! I hope we can at least figure out the OpenAPI
spec to ease my (and other future) custom Orbeon Persistence implementations
:)

Best regards,
Adrian

--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/1611783590791-0.post%40n4.nabble.com.

Hi Adrián,


Hawk wrote
 Got it, and thank you for the suggestion. However, at this point, given our
other priorities and existing commitments, it is very unlikely that we would
take that one up unless this work was sponsored by a customer.


Hawk wrote
> So having 2 instances of Orbeon deployed? Interesting idea! However, it's
> basically still limited by the strict policies. Also, we will be probably
> using the PE version, so that would be a significant double investment for
> the licenses.

 Correct. Then of course that additional licensing cost would have to be
weighted against the cost, time, and risk involved in developing your own
implementation of the persistence API :). A policy that allows you to have a
set up with two instances of Orbeon, one behind the firewall and one in
front of the firewall, but wouldn't allow you to just have one instance
seems a bit silly to me, but of course I don't have all the details about
your particular situation to be a good judge of that. On the flip side,
seeing an actual cost associated to that policy could maybe help make the
powers at be reconsider it. ;)

-Alex



-----
--
Follow Orbeon on Twitter: @orbeon
Follow me on Twitter: @avernet
--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/orbeon/1611859920020-0.post%40n4.nabble.com.