Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 1 down vote favorite

My coworker is working on a project and decided to have the database subside entirely on the glassfish server with glassfish being the only thing that can directly access the database. He will then create web services and a library in Java to access this data.

To me that sounds like a horrible way to structure the architecture of one of the most important databases in the company (contains all the employee data). I've mentioned to him that it is a bad idea because it isn't possible to easily get data out currently, to which he said he would write a java library to wrap the REST web service. The problem is that I deal with .NET and I told him that. The web service doesn't work and there is no documentation and currently I have to export data from the database to Excel using PhpMyAdmin and then read it from there since it would take a long time for me to properly format the SQL to work with MS SQL Server.

My question is this: does my coworker have a decent design and I'm just suffering because it is in its infancy or am I correct and this design is awful. If it is an awful design, what are points I can bring up to help him see that it may be better to have a more open database?

share|improve this question
4  
the first thing you need to work out is picking a single technology stack and sticking with it. – Ryathal Mar 5 '12 at 20:18
2  
If the whole point is to access the web services, then hiding the ability to talk to the database directly is a good thing... it prevents folks from making a second data/business layer that accesses and modifies data in a different way than the "approved" access method. Sounds really like the problem is that you don't have the approved method of getting data yet, and you need it NOW. Separate problem. – PlayDeezGames Mar 5 '12 at 20:19
@Ryathal I'm not quite sure why there are two separate technology stacks (I've only been around here for less than 6 months) but it seems that it is moving to Java only to my dismay. – Jetti Mar 5 '12 at 20:32
@PlayDeezGames it is true that there are separate problems. I was also just curious to find out the better design because I was thinking that my coworker was wrong, but it turns out that I'm looking like the wrong one :) – Jetti Mar 5 '12 at 20:33
@Jetti: if it is a "glassfish server" then it's java from the start. Why did they hire you as a .NET dev if its a java shop? – gbjbaanb Mar 5 '12 at 22:20
show 3 more comments

3 Answers

up vote 8 down vote accepted

In practice, the cases where allowing remote access to a database are extremely rare.

By allowing a direct access to a database, you let, by default, anyone:

  • Access all the data in your database (so, in your case, all the employee data),
  • Change it, because it's funny,
  • Delete everything, because it's even funnier.

You can give remote access:

  • If you are 99,999% sure that your data is protected and only authorized people can read and change it,
  • And if the database accounts are protected against bruteforce,
  • And if there is an audit you're constantly monitoring in order to shut down the database in case of a risk of unauthorized access,
  • And if there are regular backups of your database, preventing the loss of data if something still goes wrong.

Is it your case?

Securing your database from the outside world and letting the users access the data only through web services is like closing doors and windows in your house when leaving for a holiday and letting only the mailbox open. Allowing the remote access to your database is like letting all the doors and windows opened in your house when leaving for a holiday, and expecting that the mailman would be the only one who will enter in your house.

share|improve this answer
you can't even trust mailman too. – Henley Chiu Mar 5 '12 at 20:32
Thanks for the response. We have our databases fairly locked down (to the best of my knowledge). The only difference is this one database would only be able to be accessed from that VM whereas that is not what we have been doing so far. – Jetti Mar 5 '12 at 20:34
I like your analogy about the house and the mailbox, but I would get violent if my mailman entered my house, I only want him entering my mailbox! ;) – maple_shaft♦ Mar 5 '12 at 20:34
2  
DBs have VERY sophisticated security! Do you really believe that relying on a custom written Data Accesses layer will be more secure than the DB's Internal security. This is insane...(-1) – Morons Mar 5 '12 at 21:01
i agree with @Morons not taking advantage of DB security is probably the worst security decision. – Ryathal Mar 5 '12 at 21:10
show 6 more comments
up vote 4 down vote

It seems that your Coworker decided to go with a Service Oriented Architecture (SOA)

SOAs have many advantages and are becoming increasingly common. I don’t know why exactly your chose this design, but you should ask him why before trying to convince him it’s wrong.

The most common reason to choose SOA is Code mobility, you can have a common codebase to be consumed my many clients. (iPhone, Android, Web App, Remote Clients ect..) Here are a few more..

On a Side note, SOA is a VERY marketable skill right now, I would not be surprised if your coworker decided to go this route just to develop those skills. Putting the ethical considerations aside, it may not be a bad idea for you to close your eyes and follow his lead.

share|improve this answer
Thank you for your answer @Morons. As I've stated before in the comments, I already asked why he did this and he said it was to prevent somebody outside of IT from being able to access the database, so it stems more from a political issue and not a technical one. That is one of the reasons why I think it is a bad design, it is added complexity and more work to code for something that is out of our control anyways. He already knows that he will be moving over most of the data on an hourly basis to our SQL Server for the analytics team anyways. – Jetti Mar 5 '12 at 21:53
@jetti, It may very well be political issue, if it is, no technical argument will convince him, only a political one. – Morons Mar 5 '12 at 21:59
I guess since I'm hearing that it is considered good design anyways, I'll go along with it and just deal with exporting the excel files until he finishes his part. Thanks for your help! – Jetti Mar 5 '12 at 22:06
IT security is a technical issue, not political. Of course there are alternative ways to achieve the same result, but totally preventing external access to the DB is the safest. – gbjbaanb Mar 5 '12 at 22:15
up vote 3 down vote

The problem is that I deal with .NET

Web services, whether REST or SOAP, are not a Java standard. Both Java and .NET have a number of tools for interfacing with, and generating proxy classes for web services. This is somewhat of a universal standard. See the Wikipedia reference for more information on Web Services. http://en.wikipedia.org/wiki/Web_services

The web service doesn't work and there is no documentation

The WSDL is your most fundamental form of documentation but more is always better. Typically web services are to support componentization as well as data securtity. As a consumer of his web services you are not supposed to worry about the underlying data store. The interface for your web service is your contract, that lays out what functionality is available, and what you need to know about the data structures. This helps in componentization because you should be able to assume that the web service will predictably return certain results which can be easily mocked against in unit testing.

Perhaps your colleague simply designed the web services poorly and this is causing you confusion? Perhaps you just are not familiar working with component based software before and you are confused? Perhaps both.

He will then create web services and a library in Java to access this data.

If he creates Web Services then you do not need a Java library to access them. You can just as easily write a .NET library, and I know that recent versions of Visual Studio have tools that can automatically create web service proxy classes for you based on a WSDL. There is also support for REST based web services as well.

To me that sounds like a horrible way to structure the architecture of one of the most important databases in the company (contains all the employee data).

It is actually very good. I wouldn't want inexperienced junior programmers accessing sensitive employee data that they are not authorized to view. Only individuals with access to this server should be able to access the production database directly.

I've mentioned to him that it is a bad idea because it isn't possible to easily get data out currently

Typically your friend will give you an interface for his web service early so that you can begin development of your own components. It doesn't matter if these web services do not exist yet, because you can mock these web service calls until the services become available.

does my coworker have a decent design

Without seeing his design documents and performing a full design review I cannot say for certain, but it sounds like he has a good idea.

share|improve this answer
OH I know that I could use the web service from .NET. The problem is that he doesn't have it working properly (read: at all). My problem is more of a short term one that would need to be done before the rest of his stuff would be done, which is why I would need access to the data. – Jetti Mar 5 '12 at 20:39
"I wouldn't want inexperienced junior programmers accessing sensitive employee data that they are not authorized to view." if that was the true case then nothing would ever get done here as we are both juniors (and the only programmers as well) :( But in all seriousness, I definitely understand your point and get why I was wrong! – Jetti Mar 5 '12 at 20:40
1  
@Jetti You should ask your coworker to provide you a webservice interface and a data model. With this you can make test data and use a mocking framework in your unit tests to emulate the web service calls. This way you can both work at the same time, have fully unit tested code and integrate when you are both complete. – maple_shaft♦ Mar 5 '12 at 20:46
I'll definitely do that, thanks for the advice! – Jetti Mar 5 '12 at 21:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.