The easy part of the Web services standards process is going pretty well.
The basic specs are well along. This spring, the W3C released working drafts of SOAP and WSDL 1.2, the protocols fundamental to Web services. And just last week, two more milestones were reached: The W3C published its Web services architecture usage scenarios and the UDDI directory specification, now in version 3, was officially submitted to the OASIS standards organization.
The ascendancy of OASIS in the Web services standards process is welcome, mainly because it signals that Microsoft and IBM have decided not to ignore all the fine work done by rivals. (The big breakthrough was the submission of the WS-Security specification to OASIS on June 27.)
But now that the three basic Web services protocols are more or less final, the tower of proposed standards for Web services authentication, business processes, and security is already teetering--and could topple. The major challenges include ensuring that authentication works across various contexts, managing long-running multiparty transactions, and figuring out the rules for sharing user profile information in a federated identity model.
Dozens of committees and working groups are hammering out specifications, among them:
When you look at this list--and realize that these are just some of the groups involved in shaping Web services standards--you see the problem: How can all this parallel activity possibly be coordinated?
The logical group to try would seem to be the Web Services Interoperability (WS-I) organization, the only industry-backed organization focused solely on Web services. Founded in February by IBM and Microsoft to "promote" Web services--and explicitly not to create standards--the WS-I has charged itself with developing sample Web services applications and ensuring tool compatibility. With only the basic Web services protocols to work with, the organization doesn't have a whole lot to do right now. But when such monster specifications as WS-Security make their debut--and have to be reconciled with other security specs--the WS-I should be working overtime.
But can the WS-I be effective? Under the organization's current bylaws, an unelected cadre of players sets the agenda. A source inside the WS-I told me he's skeptical that, as it stands, the organization can ensure that "standards get applied and are judged on an impartial basis." He believes the WS-I could be the place where working groups reconcile standards from various organizations, but that the WS-I's "closed nature may prevent this from being truly credible."
For corroboration of this view, look no further than the fact that, amazingly, the issue of Sun's membership in the WS-I remains unresolved. Sun could still clinch one of two elected seats, but at this point, it's doubtful that any elected seat will have the power or longevity of those held by the organization's founders.
Industry organizations don't need to be democratic, but they do need to be--to use my source's word--credible. IBM and Microsoft took a big step in the right direction when they invited OASIS into the standards process. Now, to ensure that interoperability testing isn't used as a means to favor certain vendors' software over others, the WS-I's founders need to open things up a bit.
The next phase of Web services standardization promises to be mind-numbingly complex. Unless everyone has a seat at the table, we could be left with yet another lofty stack of protocols that nobody uses.
Do you think the WS-I can effectively mediate the outcome of Web services standards? Or do the companies that have introduced the lion's share of Web services protocols deserve to hold sway? E-mail Eric or TalkBack below.
