Is Liferay Right for Your Organization? Seven Things to Consider When Choosing a Portal Platform

Transcription

1 Is Liferay Right for Your Organization? Seven Things to Consider When Choosing a Portal Platform BY DAN LILIEDAHL, CTO, TANDEMSEVEN The outcome of your portal initiative and its success is directly related to the user experience it provides for your users. Many sites fail to provide good user experiences because they are built on a poor foundation... WHO SHOULD READ THIS CIO, CTO, Customer Experience Officer, Enterprise Architect, Technical Architect WHAT YOU WILL LEARN There are many choices when it comes to selecting an enterprise portal or Web platform. The proliferation of Rich Internet Applications (RIAs) and occasionally connected endpoint devices, such as mobile phones and tablets, is making the right platform choice more and more critical. Additionally, users expect intuitive, easy-to-use Web experiences and continue to force organizations to respond to their needs. This white paper answers seven important technical questions and provides practical tips and advice to consider when evaluating Web portal platforms. Furthermore, the paper highlights features and functionality of the Liferay Portal Platform and how it addresses each issue. 1. IS THE PLATFORM STANDARDS-BASED, AND IF SO, TO WHAT DEGREE ARE THE STANDARDS SUPPORTED? The portal platform you select should be based on modern technology standards rather than proprietary technology. There are several reasons this is important: Resources. Finding resources with experience on standards-based technology is typically easier than finding resources for a vendor solution requiring a high degree of proprietary domain knowledge to implement. Interoperability. Standards provide higher levels of interoperability. This is especially important for portal platforms that integrate numerous technologies. Portal life span. A solution based on standards has a higher chance of outliving the technology platform. It is not uncommon for proprietary technology platforms to fall by the wayside over the years. If the solution is standards-based there is more potential to move to another vendor platform while retaining the underlying code base. Here are some important technology standards to consider when making your selection: JSR 168, JSR 286 Java Portlet Standard JSR-170 Java Content Repository JSR 127, JSF 314 Java Server Faces OpenSearch Open Search WebDAV Web-based Distributed Authoring and Versioning

2 LDAP, Open ID Lightweight JAAS Java Authentication and Authorization Service The Liferay portal platform supports all the modern technology standards, as opposed to proprietary technology, saving time, money, increasing ease of interoperability and avoiding vendor lock in. The Liferay portal platform supports all the standards listed above. This level of support allows modern technology standards, as opposed to proprietary technology, to be utilized, saving money, increasing ease of interoperability and avoiding vendor lock in. 2. HOW WELL DOES THE PLATFORM INTEGRATE WITH IDENTITY MANAGEMENT SYSTEMS? The foundations for providing secure access to information and rich personalized experiences are based on authentication and permissions. Most organizations have existing personnel databases and related authentication mechanisms already in place. Two-factor authentication is very common in the financial sector. The portal platform must be able to integrate with these authentication environments. Some common identity management platforms that are supported by Liferay Enterprise Portal include: LDAP Authentication and Synchronization Oracle Access Manager CA SiteMinder Novell Identity Manager Sun Identify Manager/Open SSO Tivoli Tying any of the above identity management systems into Liferay is a matter of configuration rather than programming. If you have a non-standard identity management system, understanding the portal platform security architecture will be necessary. In the case of Liferay, there is a straightforward mechanism available for hooking into external authentication systems in a shim-like fashion. 3. DOES THE PLATFORM PROVIDE SUPPORT FOR FINE-GRAINED PERMISSIONS? The permission system works alongside the authentication system and is responsible for providing varying levels of entitlements to users in order to protect access to content and site functions. The JSR-286 (and JSR-168) portal specification provides information regarding on how portlets must specify access control. However, it only describes how portlets must define roles, and how those roles can be mapped to portal roles. Furthermore, the specification does not provide details on granularity of permissions. Some portal vendors do not provide support for granular permissions nor do they provide an easy way to extend portlet permissions. The portal platform you select should have a fine-grained permission system, allowing for very granular levels of access. Additionally, the permission system should be an integral component of the system. This is especially important when custom components are to be provided

3 to other systems as remote services. A good portal platform will allow for end-user portlets to extend the permission system that is provided by the base platform, allowing portlets to provide and protect new content and features using the same mechanisms that the portal provides. Equally important is ensuring that access control is built into the platform at the service layer. This is key for solutions that want to provide rich user interactions, where data and feature access should not be managed on the client side. A good portal platform will police access at the server. Problems will arise if the portal security architecture does not support the various ways that information needs to be segmented. For example, does the platform support segmenting users into communities or groups? Are hierarchical levels supported? Can these segments overlap each other? Finally, fully understanding the various means in which your portal will present and segment information to your user audience is critical. Specifically, you must understand the portal security architecture and its limitations. Problems will arise if the portal security architecture does not support the various ways that information needs to be segmented. For example, does the platform support segmenting users into communities or groups? Are hierarchical levels supported? Can these segments overlap each other? In choosing the right platform you should look for a permission system that is as flexible and fine-grained as possible. Liferay provides fine-grained permissions, and supports defining and managing the permissions from within the portal. Consider the scenario of a portlet that needs to provide access to a library of documents. Each document has a required access level based on three different subscription levels. In Liferay, a role could be used to control access to these documents. Only users with sufficient access would be able to view or download the documents. Furthermore, the portlet could provide a teaser view that shows the title of higher access level documents, but does not allow download. Within Liferay, an administrator could apply the appropriate roles to users, or it could be done programmatically when a user purchases a subscription. Another important aspect is ensuring that a search operation only returns the correct level of documents. Understanding how security and permissions are part of the architecture is important in making sure that these types of scenarios are supported and can be implemented in a secure and scalable fashion. 4. CAN THE PLATFORM EASILY SUPPORT THE TYPES OF RICH INTERACTIONS AND WEB USER EXPERIENCES THAT ARE EXPECTED BY TODAY S SAVVY USERS? Web 2.0 is an overused buzz term that can mean many different things. One common characteristic of a Web 2.0 application is a good user experience. From a UI perspective, this often means reducing page transitions by relying on AJAX calls or creating an experience that performs more like that of a desktop application. Supporting this type of user experience requires a back-end foundation that is secure, scalable and easy to maintain and manage.

4 Liferay s internal Service Oriented Architecture (SOA) allows for the portal to provide access to its services using SOAP and REST-based protocols. Although writing code to support these protocols on top of the portal platform is possible, it is better if the platform supports it directly. Liferay s internal Service Oriented Architecture (SOA) allows for the portal to provide access to its services using SOAP and REST-based protocols. Although writing code to support these protocols on top of the portal platform is possible, it is better if the platform supports it directly. In supporting the protocols, not only should the base portal services be provided, but there should also be support for user-written business logic to be created and exposed in the same manner. This provides a clean architecture that keeps the business logic tier on the server side and away from the client side. Applications taking advantage of this approach are also immediately able to contribute as service providers on an Enterprise Service Bus (ESB). Related to this is security, which is very important when providing services to AJAX clients. A good portal platform will provide security for these calls from a foundational perspective, making it less burdensome for your code to support them. The Liferay platform provides security enforcement at the service and business object model level. 5. DOES THE PORTAL PLATFORM SUPPORT MULTIPLE RIA CLIENT FRAMEWORKS FROM AN ARCHITECTURAL PERSPECTIVE? Technology supporting RIAs has been around for several years and numerous frameworks exist to support them. Some of the more prevalent platforms are listed below: jquery A popular JavaScript framework that provides rich support for creating client side browser applications. YUI Another popular JavaScript framework, Yahoo UI Library is a highperformance and flexible framework used in highly interactive sites such as the Yahoo homepage and Yahoo mail. AUI Alloy UI is an emerging framework from Liferay that enhances YUI. It provides an additional library of user interface components built on top of YUI and provided with Liferay out-of-the-box. GWT Google Web Toolkit is a rich JavaScript client library that powers sites such as Google Mail and Google Maps. Vaadin A Java server-side client framework, Vaadin provides user interface objects using a component model, similar to how Java AWT or Swing works. Others: (ext-js, dojo, etc) The RIA flavor you choose to develop your application is an important decision, but it is equally important to consider how the selected portal platform supports and integrates with the chosen RIA technology. Because the RIA framework is an integral part of the portlets you develop, it is important that the framework is provided from a foundational level of the portal. In other words, the application needs to be viewed systemically rather than looking at individual portlets, especially from a performance standpoint. This becomes more critical if your application needs to scale.

5 Portlets are designed to be self-contained, with all of their supporting resources meant to be included. When developing an entire application however, looking at the portlets as a system can result in positive performance outcomes. Consider three portlets that utilize jquery for their user interactions. These three portlets would normally include the jquery JavaScript libraries individually. If all three of them are placed on the same page, the libraries will be downloaded three separate times. This design will have serious performance implications. A good portal platform will make it easy to coalesce the portlets into a single library, while providing the ability for it to be cached. When looking at the portal systemically, good questions to ask include: Does the portal platform provide the ability to combine all the RIA libraries into a single resource to minimize the HTTP requests needed for a single page? Is the portal platform smart enough to combine requests across portlets using the same resources into a single resource request, rather than making individual requests? Does the portal platform provide the ability to minify JavaScript resources served in order to decrease the payload size of the served resources? Does the portal platform provide the ability to cache the resource requests on the server side and eliminate re-serving those resources by using a server response such as HTTP 304? Liferay Enterprise Portal supports all of these requirements. Good portal platforms not only have their own content management system, but are able to integrate with external CMS platforms. 6. DOES THE PORTAL PROVIDE A CONTENT MANAGEMENT SYSTEM; CAN IT INTEGRATE WITH OTHER CONTENT MANAGEMENT SYSTEMS? Most portals and Rich Internet Applications combine functionality with content, usually a mix of HTML, documents, images or video. Earlier portal platforms relied on external Content Management Systems (CMS) to achieve this functionality. However, the convergence of CMS and portals is becoming more prevalent. Good portal platforms not only have their own content management system, but are able to integrate with external CMS platforms. A native CMS within a portal platform should minimally support the ability to: Import content from existing repositories into its own repository. (E.g., via import utilities that programmatically use an API) Manage and edit unstructured HTML content using a modern WYSIWYG editing interface Define and use workflows that are based on the jbpm standard Define and use structured content types. The CMS should provide: The ability to define new structured content types without having to restart the server

6 The ability to create display templates for the structured content types An easy to use interface for editing the structured content types Preview content and publish it to staging and production environments Automatically create versions when changes are made Support automatic expiration of content based on a date attribute. The Liferay portal platform provides strong CMS capabilities, and was recently named the most popular Java-based CMS system in Water & Stone s 2010 Open Source CMS Market Share Report. As mentioned above, good portal platforms can also easily integrate with externally managed content. Since moving a significant amount of content from an existing CMS can be cost prohibitive, it makes more sense to manage, access, and serve the content directly from the external CMS. Ideally, the portal platform will support the external system through a native interface protocol. Alternatively, external content should be able to be accessed using the standard Content Management Interoperability Services (CMIS) protocol. Liferay Enterprise Portal is an example of a platform that provides out-of-the-box connectivity using native protocols for integration with SharePoint and WebDAVbased repositories. Other repositories, such as Alfresco, are supported directly using the CMIS protocol. (Earlier versions of Liferay simply used Alfresco as a repository with the intent of using the native Liferay user interface to manage content. However, the latest release supports bi-directional editing capabilities where the same repository hierarchy is reflected in both platforms, making it easy to edit the content from within either environment.) 7. DOES THE PORTAL PLATFORM PROVIDE INTEGRATION WITH SOCIAL NETWORKS AND GADGETS? Social Networking is becoming an important feature to leverage in providing user experiences that return real business value. Leading online retailers are using social networking sites such as YouTube, Twitter and Facebook to create powerful customer experiences that increase site traffic and business. Additionally, there is a plethora of third party gadgets that have large user bases. Rather than write these applications and gadgets yourself, it is more efficient to use third-party gadgets directly inside your portal. A great example of this is the Google Maps gadget. If your portal wishes to provide location lookup information, the Google Maps gadget is a quick solution. The Liferay portal platform fully supports the use and configuration of gadgets to provide mash-up capabilities that ultimately benefit your applications users.

7 CONCLUSION The outcome of your portal initiative and its success is directly related to the user experience it provides for your users. Many sites fail to provide good user experiences because they are built on a poor foundation unable to support the types of rich interactions that are needed and expected by today s savvy users. These questions should help form a better understanding of the technology issues that need consideration when selecting a portal platform. ABOUT THE AUTHOR As TandemSeven s CTO, Dan Liliedahl leverages over 20 years of experience as an entrepreneur and veteran consultant specializing in commercial and open source content management, portal, and collaboration platforms for large-scale enterprise customers. He is responsible for bolstering the company s technology offerings, developing and leading strategic technology alliances, and working closely with clients. TandemSeven designs, architects and builds world-class business applications and portals. We specialize in making business interactions easy and intuitive. A Liferay Silver Service Partner, TandemSeven delivers great user experiences for our clients using leading portal and collaboration platforms. Our clients include Flowers, Bank of America Merrill Lynch, Bloomberg L.P., Campbell Soup Company, Experian, Orbitz and Thomson CompuMark. Visit for more information