As Frank Sinatra often crooned, "Love and marriage, love and marriage, go together like a horse and carriage." It's pretty much the same relationship between services-oriented architecture (SOA) and software as a service (SaaS), and as the song would have it, "you can't have one without the other."

From a SaaS delivery perspective, SOA is what separates the current generation of SaaS providers, epitomized by the likes of Salesforce.com and NetSuite.com, from the failed application service providers (ASPs) of the dot-com era. From a consumption perspective, you certainly don't require a SOA to use SaaS, but if you want to effectively mix and match external services with on-premise assets and services, SOA will make it possible to efficiently build, deploy and manage composite apps.

We explore the relationship between SaaS and SOA, two emerging approaches for delivering IT functionality, applications and end-to-end business processes. If you're thinking of using SaaS, look beyond the buzzwords and price points, and make sure there is the solid foundation of SOA; without it, there's little

chance that service will scale and flexibly change with your needs. And if you're building or considering SOA within your enterprise, keep in mind that SaaS offerings (and lower-level services) will be crucial ingredients that will help you quickly deliver composite applications without getting bogged down in development.

SAAS MINUS SOA EQUALS ASP

Like SOA, SaaS is one of those white-hot buzzwords getting what might seem to be an inordinate amount of attention. After all, SaaS accounted for only 5 percent of the business software market in 2005, according to Gartner. That growth has analysts, investors, CIOs and enterprise architects taking notice: by 2011, Gartner expects 25 percent of business software to be delivered SaaS style--a 500-percent increase.

Back when SaaS players were known as ASPs, they enjoyed a great deal of hype as well, but barriers to scalability, flexibility and, ultimately, profitability proved to be the undoing of many ASPs. "It boils down to whether you have a multitenant environment or not," says Philippe Vincent, a partner at Accenture who advises software vendors on the emerging SaaS market (see "Debriefing"). "The first-generation ASPs offered conventional software on demand in a single-tenant environment, and they didn't do too well. That's essentially outsourcing application management and maintenance and offering it on demand."

In contrast, SOA-enabled SaaS providers can serve thousands or even tens of thousands of customers out of the same instance of the application, and their architectures and best practices enable them to scale, flexibly change and version the software in a very efficient way (Salesforce.com, for example, boasts it has nearly 25,000 customers and more than 500,000 subscribers). Be warned, however, that many of the thousands of lesser-known vendors now hopping on the SaaS bandwagon aren't building on the foundation of SOA.

"SaaS vendors have to be able to offer something that is flexible enough to meet customer needs, but you can't do that efficiently without a very good SOA model," says Vincent. "If they don't have the flexibility to deliver the functionality you want, or if they can't integrate with you significantly faster than a classic on-premise piece of software could, odds are it's not real SaaS."

MAKE THE TRANSITION

By some estimates, top SaaS vendors including Salesforce, NetSuite and RightNow currently account for some 80 percent of the total market (in terms of revenue and customers). SaaS wannabes with few customers face little pressure to invest their time and money in SOA, as buyers are much more interested in the classic benefits of subscription-based software: reducing application deployment and ownership cost, and accelerating time-to-benefit. In the short term, these vendors can deliver, but that gets harder and harder as the customer ranks swell and demands for scalability and flexibility mount.

RiskMetrics Group is making the transition to SOA to better serve the more than 650 customers that subscribe to its financial-risk-analysis software. Its customers are typically large banks, insurance companies, asset managers and hedge funds that load portfolio information into the application to track exposure to defaults and market volatility.

"Once we have our SOA in place, we'll be creating many different configurations, both in the user interface and on the processing side, based on customer requirements," says Paul Schmitter, RiskMetrics' head of process management. "SOA will enable us to scale and put together different combinations of our services."

As a service provider, it's no coincidence that RiskMetrics is also a SaaS consumer. The company switched from conventional CRM software to Salesforce.com nearly three years ago, and Schmitter says the company's SOA will enable it to better integrate Salesforce with both its on-premise Epicor accounting system and customer-facing information systems (see "Field Report").

MASH IT UP

Delivering applications over the Internet is certainly nothing new. WebEx, for one, has offered its online meeting application since 1996, but over the years it has improved and expanded upon its core applications as infrastructure, bandwidth, browsers and Web development approaches have evolved. For years, WebEx has offered integrations that let users launch meetings from within CRM applications, Office documents and other applications using a standard service API. But customers also want to be able to do the reverse: start with Web-based collaboration but then tap into critical information within the enterprise.

Taking advantage of Web services, WebEx recently introduced WebEx Connect with an eye toward integrating internal resources into its collaborative applications. "What we're trying to do is create a new class of collaborative composite application," says David Knight, a vice president overseeing the new offering. "SOA is a key enabler in doing that because it lets us bring external data sources into our collaborative environment and build new business-to-business micro apps."

In a bid-and-proposal scenario, for example, a sales manager could connect with his sales team and partners, then tap into pertinent data and documents within the enterprise. To work on the pricing proposal, the manager could create a composite form that could pull in underlying cost information from SAP and list-price information from the CRM system. The manager could then play with the discount percentage, calculate the gross margin and automatically update the approval workflow based on rules on margin thresholds.

"We can dip into systems in a variety of ways through a browser-based form builder that operates on Web services interfaces [using WSDL]," Knight says. "Previously, I would have needed line-of-sight access to the databases and hand-coded SQL to retrieve the data, but now I can simply drag-and-drop those sources onto the form."

Web services have helped SaaS vendors solve the problems of integrating with on-premise systems and data sources. The challenges will get a bit more complicated, however, as oraganizations build "enterprise mashups" that will mix and match a variety of on-premise and on-demand services.

"It's a challenge just doing composite apps inside the firewall," says Gartner analyst Robert Desisto. "When you bring SaaS into the picture, if I have five different service providers, that's five different points where I'll have to worry about uptime; I'll have five separate service level agreements, and I won't necessarily have control over releases and versioning."

While the question for today for many enterprises is whether or not to use SaaS, Desisto says many firms will be "pushing the envelope" of composite deployment within three to five years.

GET GRANULAR

SaaS providers won't be the only ones contributing services to the composite apps mix. Online service marketplaces such as StrikeIron.com already offer rich catalogs of discrete services-based mini apps such as currency converters, credit checks, IP address lookups and the like. And StrikeIron won't be alone. Amazon, for one, has unbundled its rich store of e-commerce capabilities to offer Amazon Business Services, and Google, Yahoo and Microsoft are sure to enter the market as well.

"These Web services marketplaces are going to have a larger impact than SaaS," says SOA consultant David Linthicum. "I can get CRM from Salesforce, but I also need risk analytics, human resource management and payroll calculation services. Instead of building it myself, I can link my directory out to an Internet directory, find what I need and bring them into my application for a few pennies a day."

This approach will get organizations out of the business of developing code that others have mastered and that couldn't possibly contribute to the competitive advantage of the enterprise. SaaS vendors, too, are jumping on this bandwagon, letting customers use bits, pieces and extensions of core SaaS offerings--as many customers do with Salesforce.com's Sforce integration platform.

"The value of those services shouldn't be macro services, they would be little things such as check inventory, update customer, delete customer and credit check," Linthicum says. "They would become services that I can orchestrate and make part of my process. That gives you agility, and that's really where the money is made in SOA because you're getting out of rats-nest architectures."

BUILD A FOUNDATION

It's a simple matter to expose functionality and applications using Web services, but standards such as UDDI and WSDL will only go so far in ensuring interoperability. Behind those API-level mashups, a great deal of work needs to be done in the enterprise to develop the SOA and settle on the models, security provisions and governance regimes (see "SOA Metamodel" diagram, right).

"Even if you have great SOA environments on both sides, you need to have agreement on the data, the definitions and protocols used when going back and forth," Desisto says. "Without agreement, SOA is a good technology, but it's not going to get you where you want to be on integration."

The key to building reliable infrastructure is good governance, good service management and good security. And when bringing in services from outside the firewall, "test to make sure they live up to expectations," Linthicum says. "Make sure they're not too fine-grained or course-grained, that they're reliable, and that they work and play well in composites."

Even among enterprises that have wholeheartedly embraced the trend, few SOAs have the kind of maturity required to deploy, manage and govern composite apps--let alone ones invoking mixes of internal and external services. Among more conservative organizations, just the idea of working with a single SaaS vendor may be controversial, as it requires that you share data outside the firewall and depend on that vendor's uptime performance.

Despite the headline-making service outages Salesforce.com suffered in early 2006, SaaS advocates argue that these vendors offer reliability and security that far exceeds that of most conventional IT shops. "In response to those incidents, Salesforce beefed up its redundancy and started publishing its outages on its Web site," points out Vincent of Accenture (an integration partner with Salesforce.com). "How many IT organizations do you know of that have that kind of transparency? I work with a lot of IT organizations and few can claim to have very satisfied customers. If you take a look at the SaaS vendor satisfaction scores, you'll see they have a lot of happy customers."

If the predictions come true and 25 percent of business software is actually delivered SaaS style by 2011, it will be because the issues will have been resolved, and that will require solid SOA on both sides of the service. "If enterprises have their SOA right and they select the right services, then security, scalability and customizability shouldn't be issues," Linthicum says.

In other words, as Sinatra would put it, "the best is yet to come, and babe, won't it be fine." In this model of a services-oriented architecture, data sources and legacy apps (bottom tier) are wrapped in services and exposed along with original, new services. The data abstraction layer ensures consistent, virtual access to any data source. The enterprise services bus addresses data services/ messaging. SaaS and more granular Internet-based services join the services layer and may be orchestrated as part of larger composite apps.

You described SaaS as a disruptor in the Accenture report "The Future of Software." In what areas will SaaS disrupt most quickly? A lot of the applications that were born in the client-server model are going to be good candidates for SaaS because they were built with the same paradigm in mind; they were designed to be available to many, many end users.

The whole CRM space is obviously quite attractive for the SaaS model, whether it is sales force automation, customer service automation or marketing automation. Big, cross- enterprise, transaction-intensive applications like ERP are not as well-suited to the approach. On the other hand, a close adjunct to ERP is the HR management world, and you can do a great deal of that in a SaaS model. It's notable that ADP recently announced its intention to buy Employease, [an on-demand HR systems and benefits administration vendor].

You encourage would-be SaaS vendors to embrace SOA, but what's your advice to enterprises? We are recommending very strongly that enterprises take the same view and use SOA to take IT to the next level. SOA is not about sexy new applications. The difference is in the way you produce applications and the speed in which you produce them. It's not a product innovation; it's production innovation. It's the blueprint for a new production paradigm for applications, and that blueprint was first adopted by the leading SaaS vendors.

Application Management