Integration / Middleware Services (ESB)
MiddlewareInternalIntegration Pattern

Integration Middleware Services (Internal)

David TirabassiUpdated

Problem

Internal backend workloads must exchange data and invoke services across systems using incompatible protocols and formats. Without a mediating layer, brittle point-to-point links proliferate, each forced to handle protocol translation, transformation, and orchestration, jeopardizing reliable near-real-time delivery.

Solution

Implement a centralized Integration Platform within the Private Subnet (Workloads) to facilitate seamless, decoupled communication between internal Backend Workloads. This platform acts as an intermediary, handling protocol mediation, data format transformations, routing logic, and ensuring reliable delivery for both synchronous (e.g., API calls) and asynchronous (e.g., event streaming) integration patterns.

Cloud Paradigm

  • Service-Oriented Architecture (SOA) / Microservices Architecture: Enabling interoperability between distinct internal services.
  • API-Led Connectivity: For exposing internal services as APIs to other internal consumers.
  • Event-Driven Architecture (EDA): For asynchronous, loosely coupled communication via message brokers or event streams.
  • Loose Coupling: Decoupling producers and consumers from direct dependencies.
  • Infrastructure as Code (IaC): Managing the Integration Platform configuration and deployments.

Solution Flow

Synchronous Integration Flow (Request-Reply):

  1. Consumer Backend Workload: An internal microservice initiates a synchronous request (e.g., RESTful API call) to access data or invoke a service from another Backend Workload.
  2. Integration Platform (API Proxy / Service Bus): The request is routed to the Integration Platform. This platform handles:
    • Authentication & Authorization: Validates the consumer's identity and permissions (e.g., mTLS, OAuth 2.0).
    • Protocol & Data Transformation: If necessary, translates the request protocol (e.g., from REST to SOAP) or data format (e.g., JSON to XML).
    • Routing: Directs the request to the appropriate Provider Backend Workload.
    • Traffic Management: Applies policies like rate limiting and throttling.
  3. Provider Backend Workload: The target internal microservice processes the request and returns a response.
  4. Integration Platform: Transforms the response if needed and forwards it back to the Consumer Backend Workload.
  5. Consumer Backend Workload: Receives the processed response.

Asynchronous Integration Flow (Event-Driven):

  1. Publisher Backend Workload: An internal microservice generates an event (e.g., "Order Placed," "Inventory Updated") and publishes it to the Integration Platform (e.g., a Message Broker or Event Stream).
  2. Integration Platform (Message Broker / Event Stream): The platform reliably receives the event, stores it, and makes it available to interested subscribers. It ensures:
    • Durability: Events are persisted until consumed.
    • Fan-out: Multiple subscribers can receive the same event.
    • Filtering: Events can be filtered based on content or metadata.
    • Quality of Service: Guarantees like at-least-once or exactly-once delivery.
  3. Subscriber Backend Workload(s): One or more internal microservices (consumers) subscribe to specific event types or topics. Upon receiving an event, they asynchronously process it, reacting to the business change.
  4. Acknowledgment: Subscribers acknowledge successful processing of an event to the Integration Platform.

When to Use

  • When multiple internal Backend Workloads speak different protocols or data formats (REST, SOAP, gRPC, AMQP) and you need a neutral bridge rather than pairwise adapters.
  • When you need both synchronous request-reply and asynchronous event-driven communication managed under one governed platform.
  • When decoupling producers from consumers matters — publishers should not know or care which services subscribe to their events.
  • When reliable delivery guarantees (at-least-once, exactly-once), durability, and fan-out are required for critical internal flows.
  • When centralized policy enforcement — authentication, rate limiting, routing, and canonical schema validation — is needed across many internal integrations.

When NOT to Use

  • For two stable services with matching protocols and formats, where a direct call or shared library adds far less latency and operational overhead.
  • When ultra-low-latency, high-throughput paths cannot tolerate an intermediary hop through a broker or proxy.
  • For external partner or public-facing integration, where an edge API gateway or B2B gateway in a DMZ is the correct pattern.
  • When your team lacks the capacity to operate, scale, and govern a highly-available platform — an under-resourced hub becomes a fragile single point of failure.
  • For simple one-way file or batch transfers, where scheduled ETL or a managed data pipeline is a better fit.

Trade-offs

  • Loose coupling and protocol/format neutrality vs the operational burden of running, scaling, and versioning a central platform.
  • Centralized security, routing, and traffic policy vs added latency from the extra network hop and transformation processing.
  • Reliable, durable, fan-out delivery for events vs the complexity of managing schemas, offsets, and exactly-once semantics.
  • End-to-end observability and governance vs the discipline required to keep contracts, canonical models, and configuration-as-code in sync.
  • A single integration control point vs the risk it becomes a bottleneck or single point of failure without robust HA design.

Real-World Example

Consider a retail bank whose account-opening microservice must inform fraud-screening, card-issuance, and customer-notification workloads the moment a current account is approved. Instead of wiring four point-to-point calls, the account service publishes an "Account Opened" event to the central Integration Platform's message broker inside the private workload subnet. The platform persists the event, fans it out to each subscriber, and filters so card-issuance only handles debit-eligible products. Separately, the fraud service still needs a synchronous credit check against a legacy SOAP-based core banking system; the same platform proxies that REST call, translates JSON to XML, enforces mTLS and OAuth 2.0, and applies rate limiting before returning the reply. Canonical schemas and AsyncAPI contracts keep both styles governed, so neither workload needs to know the other's protocol.

Additional Details

  • Integration Platform Components: The Integration Platform may comprise various components such as API Management gateways (for internal API exposure), Enterprise Service Bus (ESB) capabilities for complex orchestrations, message brokers (e.g., Kafka, RabbitMQ) for event streaming, and lightweight service proxies.
  • Protocol & Format Neutrality: The Integration Platform must support a wide range of protocols (e.g., HTTPS, AMQP, gRPC, proprietary protocols) and data formats (e.g., JSON, XML, Protobuf, Avro) to bridge diverse internal Backend Workloads without requiring direct compatibility.
  • Data Models & Schemas: Enforce the use of canonical data models and well-defined schemas (e.g., JSON Schema, Avro Schema) for data exchanged through the platform to ensure consistency and facilitate validation.
  • API/Event Design & Documentation: All integration interfaces, whether synchronous APIs or asynchronous event contracts, must be thoroughly documented using industry-standard specifications (e.g., OpenAPI Specification, AsyncAPI Specification).
  • Observability: Implement comprehensive logging, metrics collection (e.g., request volume, latency, error rates, message throughput), and distributed tracing (e.g., OpenTelemetry) across the entire Integration Platform to gain end-to-end visibility into internal communication flows.
  • Resilience & Scalability: The Integration Platform itself must be designed for high availability, fault tolerance, and horizontal scalability to prevent it from becoming a single point of failure or performance bottleneck for critical internal communications.
  • Governance: Establish strong governance policies for defining, implementing, and managing integration interfaces and data contracts within the enterprise.
  • Configuration as Code: Treat all Integration Platform configurations (e.g., routes, transformations, security policies, topic definitions) as code, managed through version control and deployed via automated CI/CD pipelines.

Security Controls

  • Transport Security: Enforce strict Transport Layer Security (TLS 1.2 or higher) on all interfaces of the Integration Platform, between the platform and consumer workloads, and between the platform and provider workloads.
  • Authentication & Authorisation:
    • For system-to-system integrations, authenticate internal consumer Backend Workloads using OAuth 2.0 (Client Credentials Grant) or Mutual TLS (mTLS).
    • Implement granular role-based access controls (RBAC) to define which Backend Workloads can access specific integration endpoints or topics.
  • Network Segmentation: Deploy the Integration Platform within a dedicated, isolated private subnet or network segment, protected by internal network access controls (e.g., Security Groups, Network ACLs) to restrict traffic only to authorized internal Backend Workloads.
  • Traffic Management: Apply rate limiting, throttling, and circuit breakers within the Integration Platform to protect downstream provider Backend Workloads from overload due to traffic surges from internal consumers.
  • Data in Transit Protection: Ensure sensitive data passing through the Integration Platform is encrypted end-to-end, and consider tokenization or masking for highly sensitive fields where appropriate.

Related Patterns