InterConnect Best Practices for Migrating Business Processes to the Cloud. Bill Lawton, Program Director BPM on Cloud. Session 7333A 1 3/23/17

Transcription

1 Best Practices for Migrating Business es to the Cloud InterConnect 2017 Bill Lawton, Program Director BPM on Cloud Session 7333A 1

2 Session Summary: This session will cover best practices for taking existing business processes and moving them to IBM BPM on Cloud. Learn what not to do and what works, including examples of recent customer moves to the cloud. 2

3 Agenda Digital Automation and BPM on Cloud Configurations Security Connectivity and Integration Operations and Administration Application Migration 3

4 Digital Automation and BPM on Cloud IBM Corporation Page 4

5 Digital Automation is IBM s platform for rapidly creating business led process apps that deliver new levels of customer experience and digital self service Key attributes of the Digital Automation platform: Speed enabled by a platform for rapid delivery and iteration, led by the business Scale built on an extensible framework for innovation and insight Customer focus to deliver the end-to-end customer journey 5

6 Digital Automation capabilities Design, automate and govern business operations to deliver a scalable, consistent customer experience Business Automation Collaborative Discovery Digital Automation Define customer journeys and business operations to discover new opportunities for innovation Actionable Insights Analyze data and events to augment knowledge work and take the right action at the right time 6

7 What is IBM Business Manager? 7

8 BPM on Cloud Includes everything to develop - test - run processes Start new projects quickly Ready in 48 Hours or less Monthly Subscriptions User based Managed BPM environment 8

9 BPM on Cloud supports the spectrum of Types Compatibility with BPM Advanced and Standard Ordered Sequence of Activities Some Unordered (Ad-hoc) Activities Some Activities with Ordered Steps Unordered Set of Activities Model Next Step Determined By Knowledge Worker 9 Structured Business Objects Data Unstructured Documents

10 IBM Business Manager new updates! Business UX Hybrid Integration & Cognitive BPM on Cloud Salient SPARK UI toolkit available via reseller Enhanced coach UI framework and tooling leveraging SPARK technology Consume and publish services via REST APIs with Open API, API Connect, and API economy Watson Developer Cloud services for cognitive Product Insights on Bluemix (experimental) Express edition, hybrid entitlement, FedRAMP support, and new configuration options Enhanced self-service capabilities 10 Now provides complete end-to-end authoring of process apps via the web Designer Low Code Development New service flow web editors, new auto-save feature, and more Enhanced Dynamic Event Framework for highperformance business events enabling integration with Analytics 3rd party big data & analytics Open source Elasticseach/Kibana for business process analysis (experimental) BPM V8.5.7 CF Announcement developer.ibm.com/bpm

11 Need Help Developing? Monthly Consulting Subscriptions Access to deep BPM and ODM technical expertise Best practice recommendations, solution reviews, application design You ask for help with any aspect of your solution or method. Engage an expert for help at any time via online portal A globally distributed team of IBM experts means that your team gets help when you need it no matter where your team is Migration to Cloud monthly subscription. Expertise to help assess and assist in moving an existing to BPM on Cloud Submit a request with your question Arrange a call for application architecture advice a code sample for review 11

12 Configurations BPMoC Service Architecture BPMoC Configuration BPMoC Express Configuration Additional Environments Dedicated LDAP IBM Corporation Page 12

13 BPM on Cloud Service Architecture DMZ Gateway Authentication, Authorization, Policy Services Platform Services Monitoring, Audit Services Operations Services Global Directory Isolated Tenant VLAN Tenant Junction User Portal Development Environment Center Test Environment Server Run Environment Server Server Additional Environment(s ) Server BPM on Cloud Customer Instance in IBM Bluemix (SoftLayer) DB2 HADR 13

14 BPM on Cloud Instance An Instance contains three (3) environments with options for more Development ( Center) Test ( Server) Run (Production Server Cluster) BPM Database Tier (DB2 HADR cluster) User Portal Development Environment Test Environment Run Environment Additional Environment(s) Center Server Server Server Server BPM on Cloud Customer Instance in IBM Bluemix (SoftLayer) DB2 HADR Capacity of each environment is based on the number of Users or Authors purchased 14

15 BPM on Cloud Express User Portal Development + Test Environment Run Environment Get started with first BPM project Lower cost to get started Non-mission critical processes BPM Standard capabilities Small project with users Can add up to 24 Designers/Authors Seamless ability to grow up into full BPM on Cloud Move up to BPM on Cloud to add Test, Stage, HA environments Center Single Server Server Single Server Single Center + Server (no HA) Single DB2 database server (no HADR) 15

16 Start with Express and Expand to BPM on Cloud BPM on Cloud Express (Start with 10+ Users) User Portal Development Environment Center Run Environment Server DB2 Expands your instance in place BPM on Cloud User Portal Development Environment Test Environment Run Environment Additional Environment(s) Center Server Server Server Server DB2 HADR 16

17 Need Additional Environments? BPM on Cloud comes with three (3) environments by default. Add environments for: UAT testing Stage or pre-production that match the Run (Production environment) Performance testing Additional production environment to provide process app isolation User Portal Development Environment Test Environment Run Environment Additional Environment(s) Center Server Server Server 17

18 Two Flavors of Additional Environments Additional Test Environment Includes this new component: Server Additional Runtime Environment Includes these new components: Server DB2 HADR Server Can I add both a Test and Runtime environment to an instance? Yes Can I add multiple of either environments? Yes, you can add one or more of either type Is there a limit? IBM recommend up 4 additional environments per instance Can I add a Development ( Center) environment? No. If you need multiple Centers, IBM recommend you have multiple instances How many users do I need? It will depend on the use case. If you want an environment that matches the Production environment, you will need the same number of users as your instance. If you need a test environment that does not need to be of the same capacity, you will need the minimum size of 25 users 18

19 Instance specific LDAP for Migration cases Optional LDAP cluster available for migration cases Specific to an instance SCIM User Management REST API Supports non- based bpm user ids (e.g. User ids used as keys to other systems) Helps ease moving process applications that leverage LDAP users and groups User Portal Development Environment Test Environment Run Environment Center Server Server LDAP LDAP 19

20 Security Key Security Features Secure Connectivity User Management IBM Corporation Page 20

21 Key Security Features Isolated Environment Each client has their own environment. No sharing of databases, virtual machines, Software servers Data Encryption All BPMoC data at rest is encrypted to FIPS standards. Penetration Testing Annual penetration testing performed by a third party company. Executive summary available User Authentication Self-service user management for access, password management. Single Sign-on option via SAML. Operational Procedures The operational team follow standardized procedures to help ensure your environment is secure. OWASP, SSAE16 SOC, ISO Secure Connectivity All communication is encrypted to FIPS standards. IP Whitelisting. Includes VPN for secure outbound connection to Systems of Record running in your network 21

22 Secure Connectivity to and from Your BPM on Cloud Instance HTTPS Cloud based services or applications Business Users Designers Developers, Testers Administrators BPM on Cloud BPM REST APIs / HTTPS JDBC or HTTPS VPN Services or applications Applications calling deployed processes Systems of Record 22

23 Single Sign-On (SAML 2.0) IP Whitelisting X Your Corporate Network Single Sign-on (SAML) Identity Provider BPM on Cloud 23

24 User Authentication and Authorization BPMoC default BPMoC uses an Address and Password to uniquely identify users. 90 day passwords change policy Users create and manage their own passwords User information (name, address, access rights, etc) are stored in a global directory and synched to the BPM System TWUser.name returns a user s address User information can be set via the User Management Admin UI or REST API. The REST API can be used to automate the synch of User information from your corporate directory (LDAP, AD) to BPMoC Dedicated LDAP Synched to global directory; Leveraged for non- based user ids and LDAP groups BPMoC global directory does not support LDAP group hierarchy Single Sign-On IBM Operations team will coordinate with your network experts to configure the SAML connection Your Identity Provider controls the User Authentication process. BPMoC stores no passords User information must still be synched to BPMoC to authorized users in BPMoC and the BPM System 24

25 Self Service: User Management LDAP user directory is already integrated with BPM on Cloud as part of the security model REST API that enables on-demand provision and deprovision of users into the IBM BPM on Cloud service 25

26 Connectivity and Integration Inbound Outbound / VPN Database Network Latency IBM Corporation Page 26

27 Inbound Connectivity Browsers must connect with HTTP/TLS REST API calls Requires Basic User Authentication Header BPMoC is using different context prefixes for BPM URLs. This may need to be considered when moving a process application to BPMoC Optional IP Whitelisting can be leveraged, usually with SSO to restrict which IP ranges can access your BPMoC instance (e.g. force the user to be on your corporate network to access BPMoC) VPN is not supported for inbound Don t route traffic through a NTLM proxy 27

28 Outbound Connectivity BPMoC provides an optional IPSEC VPN for outbound communication from BPMoC to a external endpoint (e.g. Corporate network or cloud service) The IBM operational team will assist you with set up. Configuration on the BPM on Cloud side is a simple configuration step that is very quick Requires you have the capability for a VPN endpoint You will need access to your network experts to configure your side This can takes days to weeks Common pattern for process applications is to use secure protocols such as HTTP/TLS or JDBC/TLS BPM Datesources), regardless of whether it is via a VPN tunnel or not Leverage built in Certificate Admin to manage your certificates for services you connect to 28

29 Where do I store my business data? BPM Data Embedded within BPMoC Access the BPM databases through BPM REST API views. Access via data sources is possible, but not recommended Not used for storing client business data (note BPM on-premise licenses do not allow this either!) Business Data IBM BPM is not a System of Record (SOR) and therefore is not generally used for storage of business data Use the database of your choice and access them via the BPM data sources There are different approaches for storing Business Data: Connect to a database or other SOR hosted in your corporate network accessed by VPN Databases: DB2, Oracle, MS SQL DashDB for Transactions on Bluemix DB2 on Cloud Leverage IBM Cloudant - a native cloud based DBaaS (Database as a Service) 29 Host a database directly on IBM Cloud (SoftLayer)

30 Connect to Your Databases 30

31 Pick the Closest Data Center to Reduce Network Latency Dallas Amsterdam Singapore Hong Kong Houston London Melbourne Milan Paris Sao Paulo Tokyo Wash DC BPM BPM BPM Milan BPM BPM BPM/ODM on Cloud today New Data centers Data center and Point of Presence Network Point of Presence 31

32 Chatty Application Design and Co-Locations of Solution Components Matters Applications, Databases, or Systems of Record BPM on Cloud Your Corporate Network Databases and Systems of Record 32

33 Operations and Administration Managed BPM Environment IBM Responsibilities Customer Responsibilities Self Service Support Upgrades and Maintenance IBM Corporation Page 33

34 IBM Operates and Manages the BPM Environment IBM Operations manages: BPM Configuration Cloud Infrastructure 24/7 Support BPM Uptime Monitoring High Availability Automated Backup Disaster Recovery BPM Feature Updates Backward compatibility Scheduled Maintenance SSO, VPN Assisting where there is no self service capability 34

35 Customer Responsibilities Managing users - Self service UI for access, resetting password, and usage reports Developing your process applications - Web Designer, Designer, or Integration Designer. Debugging/Tuning your process application - Leveraging the design tools and self service admin features, such as the Web Designer, Log Viewer, Log Retrieval, Log Level, Environment Recovery Configuring connectivity- Databases (Datasources), Certificates Managing the health of your process applications / data - archiving and purging old process instances Testing your application - BPM feature upgrades Supporting your users with your solution 35

36 Restricted access to the infrastructure The IBM operational team monitors and manages the BPM infrastructure Virtual Machines Operating Systems Linux BPM and BPM Database configuration Client users do not have access to the infrastructure File system WAS console Direct access to the BPM databases via database tools BPM on Cloud provides alternatives Self service administration capabilities Access to temporary directory for files Access to BPM database via REST API (JDBC not recommended, but does work) What we do not yet have admin for, the operational team will assist you - E.g. Customize the Portal 36

37 Self Service: Operating Environment Management BPMoC only Connect to databases via the Datasources Manage certificates use for access external web services Access to Trace and Log information Access BPEL failed events Deploy and manage application EAR files created via Integration Designer Re-start the Server environment if your application runs wild 37

38 New Self Service Ability to manage the health of the environment for pruning old process data Deploy BPM Advanced applications assets Manage Failed Events Re-start ALL environments 38

39 New BPM Advanced Application Management BPMoC only 39

40 New BPM Advanced Application Management BPMoC only 40

41 BPM Health Management Self Service On premise BPM Administrators use a variety of wsadmin commands to manage the heath of BPM Servers (e.g. delete completed instances or prune PDW database) Previously, BPMoC Administrators were required to open service ticket to perform this maintenance tasks Five (5) wsadmin commands are exposed in Admin Console Three (3) of them also exposed as REST API IBM Corporation Page 41

42 BPM Health Management Self Service 42

43 Self Service: Usage Reports Monitor usage for the last 90 days 43

44 Support Business-hours support Leverage the Client Success Portal to access the Knowledge Base and open tickets: Support is available during normal business hours: 8:00 AM - 5:00 PM Eastern Standard Time (EST), Monday through Friday (excluding US) 8:00 AM - 5:00 PM Central European Time (CET), Monday through Friday (excluding German holidays) After-hours support Critical business impact/service down Open a Severity 1 ticket through the IBM Service Request site 44

45 Scheduled Maintenance and BPM Feature Upgrades Scheduled Maintenance Proactive patches - up to once a month Security, feature patches 72 hour advanced notification Target < 2 hours window Upgrades Key Imperative: Keep the cloud service on the latest version of IBM BPM 30 days advanced notification Shared responsibility: IBM works with customers on the timing for major version upgrades IBM handles the BPM infrastructure upgrade Customers are responsible for testing and any updates required in their process application 45

46 Scheduled Maintenance IBM proactively maintains the cloud service with the latest security and functional patches. Includes: system patches and updates; BPM individual fixes (ifixes), Fixpacks, and Cumulative Features (CF s). Patches are applied as a rolling updates, one node at a time, minimizing production downtime in those cases. Usually once a quarter for proactive patching. Can be as frequent as once a month. 72-hour notification sent to Account Administrators prior to maintenance. Notifications can be controlled under each user profile Most scheduled maintenance is 2 hours or less in duration and scheduled during non-peak times (for example, during evenings). 46

47 BPM Feature Upgrades Latest IBM BPM version: V8.5.7 CF Key Imperative: Keep the cloud service on the latest version of IBM BPM. The cloud service generally follows major IBM BPM updates. Shared responsibility: IBM works with customers on the timing for major version upgrades IBM handles the BPM infrastructure upgrade Customers are responsible for testing and any updates required in their process application IBM works with customers to facilitate major version upgrades to minimize impact to Customers. Each customer environment is eventually upgraded, usually within 30 to 90 days of a new version being available within IBM BPM on Cloud IBM handles version upgrades in three steps: IBM upgrades the IBM BPM on Cloud Test Environment (or Development Environment in the case of BPMoC Express) Customer verifies that the deployed processes continues to function properly IBM then upgrades the rest of the environments including the Runtime Environment If the Customer verification step encounters issues, IBM can restore the upgraded environment back to the original version until the issues can be resolved. 47

48 Release to Release Continuity From To Version EOS BPM BPM BPM BPM BPM BPM BPM 751x 800x 801x 850x BPM /2016 Upgrade Yes Yes Yes Yes Yes Yes BPM /2016 Upgrade Yes Yes Yes Yes Yes Yes BPM /2017 Upgrade Upgrade Yes Yes Yes Yes BPM /2017 Upgrade Yes Yes Yes Yes BPM 850 No earlier than 09/2018 Upgrade Upgrade Upgrade Upgrade migration upgrade 48

49 Continuous Delivery Strategy for IBM BPM Federation Server IBM BPM on Cloud Case & Content Integration Web-based authoring Responsive Portal and UX Federation Server REST and Open API Spring 2013 BPM Spring 2014 BPM Spring 2015 BPM Spring 2016 BPM Q16 3Q16 4Q16 49

50 Application Migration IBM Corporation Page 50

51 Aspects that may need to be refactored No use of custom tables in BPMoC BPM databases (not recommended for BPM in general) Use of hard-coded SQL queries and URLs (not recommended) BPMoC uses customized context root for environment URL s i.e. /Portal becomes /bpm/dev/portal /bpm/test/portal /bpm/run/portal References to attachments, files, and data stored by processes must not use internal IDs (user_id, group_id, etc.) Use of BPM document attachments and the ECM (may have to be adjusted for BPMoC) Use of shared libraries is supported (by the BPMoC Operations Team) Access to the local file system is only supported for TEMP directories; may affect the migration of custom logging to the local file system IBM Corporation Page 51

52 Application Artifact Migration Upgrade to the latest version of BPM V8.5.7 before moving to BPMoC Best approach is to move the application artifacts from existing environment to BPMoC and test Federation Server cannot be used to federate the task lists from BPMoC and BPM on premises during migration; Some Partner solutions that may be able to help on this aspect IBM Lab Services has some tooling to assist with migrations of BPMN style processes IBM Corporation Page 52

53 30 Day Trial and Weekly Public Demo Sign up at - Immediate access to trial Weekly live demo webinar - Tuesdays 12pm EST 53

54 Check out these Sessions: InterConnect A - Customer Feedback Roundtable on Business Cloud, Mandalay Bay North, Level 0 - Coral B, Wed, 22-Mar 3:15 PM - 4:00 PM In-Booth Engagement Theater Sessions - Best Practices for Migrating Business es on the Cloud, Tues 21-Mar 2:00 PM - 2:20 PM 5597A - Meet the Business Cloud Experts, Concourse, Bayside B, Level 1, Forum #2, Wed 22-Mar 9:00AM - 9:45AM 5644B - Customer Feedback Roundtable on Business Cloud, Mandalay Bay North, Level 0 - Coral B, Wed, 22-Mar 10:15 AM - 11:00 AM In-Booth Engagement Theater Sessions - Best Practices for Migrating Business es on the Cloud, Wed 22-Mar 12:00 PM - 12:20 PM 5722A - Optimize Your Business es in the Cloud, Mandalay Bay South, Level 2 - Mandalay Bay Ballroom L, Wed 22-Mar 02:00 PM - 02:45 PM 7333A - Best Practices for Migrating Business es to the Cloud, Mandalay Bay South, Level 2 - Mandalay Bay Ballroom J, Thu 23-Mar 10:30 AM - 11:15 AM 54

55 Notices and disclaimers continued Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the ability of any such third-party products to interoperate with IBM s products. IBM expressly disclaims all warranties, expressed or implied, including but not limited to, the implied warranties of merchantability and fitness for a particular, purpose. The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual property right. IBM, the IBM logo, ibm.com, Aspera, Bluemix, Blueworks Live, CICS, Clearcase, Cognos, DOORS, Emptoris, Enterprise Document Management System, FASP, FileNet, Global Business Services, Global Technology Services, IBM ExperienceOne, IBM SmartCloud, IBM Social Business, Information on Demand, ILOG, Maximo, MQIntegrator, MQSeries, Netcool, OMEGAMON, OpenPower, PureAnalytics, PureApplication, purecluster, PureCoverage, PureData, PureExperience, PureFlex, purequery, purescale, PureSystems, QRadar, Rational, Rhapsody, Smarter Commerce, SoDA, SPSS, Sterling Commerce, StoredIQ, Tealeaf, Tivoli Trusteer, Unica, urban{code}, Watson, WebSphere, Worklight, X-Force and System z Z/OS, are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at: 55

56 Notices and disclaimers Copyright 2017 by International Business Machines Corporation (IBM). No part of this document may be reproduced or transmitted in any form without written permission from IBM. U.S. Government Users Restricted Rights use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM. Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. This document is distributed as is without any warranty, either express or implied. In no event shall IBM be liable for any damage arising from the use of this information, including but not limited to, loss of data, business interruption, loss of profit or loss of opportunity. IBM products and services are warranted according to the terms and conditions of the agreements under which they are provided. IBM products are manufactured from new parts or new and used parts. In some cases, a product may not be new and may have been previously installed. Regardless, our warranty terms apply. the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or their specific situation. It is the customer s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulatory requirements that may affect the customer s business and any actions the customer may need to take to comply with such laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer is in compliance with any law. Any statements regarding IBM's future direction, intent or product plans are subject to change or withdrawal without notice. Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers have used IBM products and 56