FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH L-16: deegree iGeosecurity - Access Control for OGC Web Services Hans Plum

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH ● Spin-Off University of Bonn, Nov ● SDI/OGC/ISO Competence + Free Software ● Consulting, Software development, Training ● deegree – Open Source implementation of several OGC/ISO-Standards ● Active OGC-Member ● Partner: Delphi IMM, EMPRISE, GDF, Intevation, map Topomatik lat/lon – short introduction

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Agenda ● Overview and Motivation ● Open SDIs & deegree – hands-on intro to deegree OWS and clients ● Secured SDIs & deegree – hands-on intro to deegree iGeoSecurity ● Questions & Comments

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Our Use Case ● John is allowed to see the entire WMS layer for endangered species ● Laura can just access the map layer for endangered species within a buffer of 20 km around the lake ● Hillary is allowed to insert new endangered species via the WFS; John and Laura are not allowed to.

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Architecture of a SDI Gazetteer OGC-Clients Catalogue WMS WCS WFS WMPS WTS/WPV S WFS-t

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH SDI for the Lab OGC-Clients WMS WFS WFS-t

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Inside deegree ● all applications are implemented as Java Servlets depending on the Java Servlet standard: – common directory structure and relevant files: ● WEB-INF/web.xml (Initialising web application) ● WEB-INF/classes/log4j.properties (Logging) ● WEB-INF/conf/[wms | igeoportal | security | wass] ● WEB-INF/lib (Java libraries)

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Inside deegree iGeoPortal std. edt. ● generator-based GUI creation: From enhanced OGC Web Map Context to HTML via XSLT ( webapps/igeoportal/WEB-INF/conf/igeoportal/wmc_start_utah.xml ) ● Arranging modules (functionality) in North, East, South, West, Central (next slide) ● Task: Switch modules of East to West and vv. ● Task: Make Layer „airports“ non-queryable

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH GUI structure

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Using OpenJUMP as WFS Client ● OpenJUMP with deegree WFSPlugIn supporting WFS (read) and WFS (read/write) access OpenJUMP WMS WFS WFS-t ShapeFiles WMS PostGIS DB

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH OGC interfaces in SDIs ● Interoperability of maps and vector data – everybody has access; no restrictions intended (Open Geospatial Consortium) ● but everybody could manipulate data through according OGC interfaces ● How to manage access control for OGC services?

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Managing Access Control OGC-Clients WMS WFS WFS-t iGeoSecurity:owsProxy

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH deegree owsProxy: Hiding OWS ● transparent facade in front of WMS, WFS, CSW ● supporting different authentication methods (Who?) ● supporting authorization (What?) static and user- dependent ● Task: Deploy owsProxy ● Task: Check WMS Capabilities for anonymous user, laura/laura and john/john manually ( ● Task: Login into iGeoPortal as john/john

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Inside deegree owsProxy ● OWS to hide: webapps/owsproxy/WEB-INF/web.xml ● Authorization: webapps/owsproxy/WEB- INF/conf/security/w?spolicy.xml ● Authentication: webapps/owsproxy/WEB- INF/conf/security/authentication.xml

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Authentication ● decoupling of creation and testing of credentials ● 3 rd parties/applications can use it ● developed from a SDI NRW standard; proposed at OGC ● Supporting operations GetSession/CloseSession – deegree DescribeUser ● Task: Deploy deegree-was and check according requests

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH owsProxy – Web Authentication S. OGC-Clients WMS WFS WFS-t iGeoSecurity:owsProxy WAS

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Authorization: Administration ● Defining: ● Users ● Groups (Aggregation of Users and Groups) ● Rights (GetMap on Layer A allowed?) ● Roles (Aggregation of Groups and Rights) ● Task: Deploy rights management deegree-u3r ● Task: Add user Paul and give him rights for layer endangered_species

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Authorization: User, Rights, Roles, Ressources (U3R) OGC-Clients WMS WFS WFS-t iGeoSecurity:owsProxy WAS Postgres DB ShapeFiles PostGIS DB U3R

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH iGeoPortal and owsProxy/WAS ● Task: Checkout the communication between iGeoPortal and owsProxy and WAS

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH WFS and owsProxy ● Task: Use OpenJUMP as WFS Client against featuretype endangered_species for user hillary/hillary

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Info Flow in enterprise SDI OGC-Clients WMS WFS WFS-t iGeoSecurity:owsProxy WAS Postgres DB ShapeFiles PostGIS DB U3R

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH Outlook ● Securing the communication via Web Security Service ● Securing communication via Inteproxy (a client-based tunnel application) ● Billing users via OSAAS

FOSS4G 2007, Victoria L-16 deegree iGeoSecurity gesellschaft für raumbezogene informationssysteme mbH L-16: deegree iGeosecurity - Access Control for OGC Web Services Hans Plum