The Sallie Mae Story

09/09/08

1

Who is Sallie Mae

Sallie Mae is commonly referred to as the nation's leading provider of student loans

…but our complete mission includes being the leading provider of saving for college as well.

2

Who Sallie Mae is not

• Just in case you’re wondering…

• These guys are in housing business

• There are no ties between us even though our names may imply it

3

The Story – CliffsNotes Version

Enterprise Architecture is established

IT Governance is established to govern strategic initiatives

4

Our Field Of Dreams Approach

• We wanted to introduce application development to the world of service development

• Application teams wanted to meet their deadlines

• In 2001/2002 we decided to build our own service bus

• Our goal was introduce good service principles through a product that provided the easiest way for application development to hit their dates

5

The Field Of Dreams Approach• It was built basically in a “garage” type atmosphere by a

very small talented team• We developed bus-like, message-based infrastructure• Developed a set of Client and Service APIs to abstract the

communication layer• We introduced the development community to the

following service principles:– Virtualization– Decoupling– Stateless– Services must be managed

“We’re not branding geniuses - we called it Application Integration Architecture (AIA)”

6

The Field Today

• AIA is institutionalized – it’s a natural part of development culture

• 45+ Clients

• 450+ Services– Majority are mainframe

7

The Field TodayEach peak season (July – September), we continue to break our daily volume record – now at 14.2M.

Busiest hour was 1,170,577 transactions – about 325 transactions per second

8

SOA Current State Issues• Inadequate Run-Time Policy Enforcement• Inadequate Service Quality Policy Enforcement

(Development/QA-Time)• Dependence on an aging, proprietary infrastructure (i.e.

AIA) in a rapidly advancing technical and business environment

• Lack of Service Discoverability and Documentation• Lack of Service Rationalization and Cohesiveness• Limited Ability of Systems, Services, and Infrastructure to

Adapt to Change• Cultural Resistance to Change

20072006

9

Future State SOA• Maximizing Enterprise Agility

– Services are Cataloged– Services are Rationalized– Services are Adaptable/Flexible– Services are Modular

• Protecting the Integrity of the Enterprise– Run-time Service Management– Service Quality Oversight

10

Dimensions of an Agile EnterpriseResourceful,CommittedPeople

Results-OrientedCulture

Governance(Policies, Processes,

Organizational Structure)That Enables,

Empowers, and Protects

Flexible, AdaptableSystems

(Business Systems & Models,Technology & Infrastructure)

Designed

Emergent

11

Enablers of Future State SOA

• GovernanceThe use of organizational authority to ensure that enterprise interests are protected

• Guidance & TrainingCommunication that encourages and instructs stakeholders to optimally leverage SOA

• InfrastructureTechnical foundation that enables SOA applications and governance

• SupportMaintenance of central SOA artifacts and technology

12

Our Approach…

SOA Governance

The DCR community

wants access to services

Application Development

is already starting to

deploy web services

If we weren’t careful, we’d have

same problems with just fancier technology

13

AIA toWeb

Service Adapter

AIA

AIA

Ser

vice

C

onfig

s

Web Service to

AIAAdapter

Consumer

Man

agem

ent

Man

agem

ent

Man

agem

ent

ServiceImpl

Registry/ Repository

ESB

Man

agem

ent

Man

agem

ent

Man

agem

ent

Legacy AIA

Consumer

AIA API

LegacyAIA

ServiceImpl.

AIA API

Pluggable Capabilities that Enable Agility (e.g Transformation,

Enhanced Routing)M

anag

emen

t

Man

agem

ent

AIA

Ser

vice

C

onfig

s

Man

agem

ent

Man

agem

ent

Man

agem

ent

…allows us to move in baby stepsWe no longer have to front Web Services with AIA, for we have an environment to safely manage the point-to-

point invocations

AIA Services can be exposed as Web Services

so that Consumers can retire the use of the AIA client and move to WS

invocations

One technology, two architectures – SOA and Event-driven Architecture

MainframeWeb

Services

MainframeWeb

Services

14

SOA Roadmap

15

Web Service Management Principles

• Allow point-to-point web services but do so under management

• Use the “play it as it lies” rule

• Implement web services adapter to leverage AIA legacy services

• Implement internal PKI to generate digital certificates for mutual SSL for authentication

16

Sallie Mae Vision for WSM

17

WSM Lessons Learned

The “Good”• Flexible• Implemented “clustering”• Used Opsware for

deployments• Rolled out console to

application development for visibility into their services

• WSM component solved major client-side performance issue for one customer

• External gateway provides virtualization and management of outbound eternal WS calls

The “Bad” that comes along• Interdependent

“management” resources• Initially, every deployment

looked different – different containers, different experience of development team, WCF vs .Net

• Application development needed education on certificates

• Our deployments got slightly ahead of our guidance

18

IT Governance Model

19

SOA Governance MissionFocus1. Realizing the SOA Strategy2. Setting necessary policy3. Encouraging reuse and agility4. Measuring and monitoring5. Guiding, training, and coaching

Strategy1. Execute the SOA Strategy that aligns with business priorities2. Define and maintain common-sense governance policies for the entire service lifecycle, automating

where possible3. Encourage, enforce, and monitor adherence to defined strategies and policies4. Develop and implement measurements of KPIs to monitor the effectiveness and scope of SOA

implementations5. Evangelize SOA concepts and benefits so that adherence becomes the status quo for IT and

business partners6. Perform service portfolio planning and rationalization7. Develop, publish, and maintain appropriate guidance8. Provide needed training for IT and business partners

MissionEnable the agility and cost-reduction promise of Service-Oriented Architecture by setting strategy, creating policies, and by defining processes, measures, and management to govern the SOA lifecycle across the enterprise. Protect the enterprise by enforcing appropriate security measures and service management.

20

SOA Governance Organization Structure

SOA Governance OrganizationSOA Governance Executive Sponsors

Applications

Systems

Data (future)

Business Process (future)

SOA Strategy

SOA Governance Council

(Work Group Leads)

SOA Governance Office

Work Groups

Administration and Operational Support

21

EAs Transformation Role

Enterprise Architecture

22

EA Engagement ModelsEngagement using Defined Architectural Guidance“Following EA direction” engagement model

Emerging Phase:• Management Only

R&D Phase:• Team Architecture

Enabling Projects Phase:• No App/Dev involvement• Centralized Delivery Teams

Delivery Phase:• Full App/Dev • SDLC Process• EA Website / Architects

Example Projects:• Process Architecture• Rules Engine• Any new strategies

Example Projects:• Orchestration• Eventing• Segmentation

EA Only Example Projects:• Enterprise Data Definition• Enterprise Data Governance• Enterprise Corresp Engine

Example Projects:• .NET (numerous systems)• PDF R&M (orig and servicing)• ESI (all critical facing apps)

Evolution of

Architecture Strategies

Emerging R&D Enabling Architecture Delivery

Engagement during Architecture Evolution – Opportunistic Deployment“We build it together” engagement modelEmerging Phase:• Management Only

R&D Phase:• Team Architects

Enabling Projects Phase:• App/Dev collaboration on projects, technology and architecture deliverables• Centralized Delivery Teams

N/A. There is no delivery phase for Opportunistic Deployment. Would move to Defined Architectural Guidance above.

Example Projects:• Process Architecture• Rules Engine• Any new strategies

Example Projects:• Orchestration• Eventing• Segmentation

EA/App Dev Example Projects:• Borrower Retention• CARES• ERBP

N/A. There is no delivery phase for Opportunistic Deployment. Would move to Defined Architectural Guidance above.

Mat

urat

ion

Scal

eM

atur

atio

n Sc

ale

23

Technology EvolutionContextCore

MissionCritical

Non-MissionCritical

AIA is here

With people I’d like to move to C/MC

Goal: move AIA here

The trick is keeping people in the correct quadrant

24

Broader Lessons Learned• Pilot “season” should end so that you can ramp up

infrastructure, resources and education for wide-spread adoption

• Education is more about web services policies, standards, education than it is about WSM technology

• Whistle while you work, but with adequate doses of “discipline”

• SOA needs to be run as a program• Don’t miss out on opportunities to share the wealth• Need effective resourcing model to cover technology

evolution