Summary

This tutorial will guide you to set up and configure the necessary access control service to protect an OGC Web Map Service and load it into an OGC WMS client.

You will install the 52°North WSS. For demonstration purposes, the "protected" WMS will be the famous Demis WMS. The uDig client will be used to visualize the results.

Security issues

For the sake of simplicity this tutorial omits the configuration of some important security-relevant feature like:

• using HTTPS instead of plain HTTP for service communication
• sealing off the protected service, so that only the WSS has access to it

Architecture Overview

Requirements

1. General
   • Internet connection
2. Software

   The following software has to be installed on your system, to walk through this tutorial:

   • Java SDK 1.5+
   • uDig 1.1 RC11 or later
   • Text editor, eg. Notepad++
   • Internet Browser
   • 52°North Web Security Service (WSS) bundled with Jetty Web Server + GeoServer WMS
     • Download the bundle from http://52north.org/downloads/Security%20and%20GeoRM/Special/FOSS4G2009/wss-geoserver-jetty_bundle.zip
     • Unpack the downloaded bundle into a local directory. This folder will be referenced as [SERVER_HOME] during the tutorial

Basic Installation of the 52°North Application

Task 0: Check Installation: Access protected service with uDig

• Start the Jetty Web Server
  • In the command shell, switch enter cd [SERVER_HOME].
  • Run java -jar start.jar (Press Ctrl-C to shutdown the server if necessary)
• Start uDig and create an empty map

  File > New > New Map

• Rename map to "Alice's Map" or alike
• Add the protected WMS to the map

  > [right-click "Alice's Map"] > Add... > Web Map Server

  > [paste URL http://localhost:8080/wss/httpauth/demiswms/] > Next > [log in as alice/alice]

  > [select all layers] > Finish

• Rearrange the layers to get a reasonable map until you are satisfied :-).

  You should at least be able to see country borders and airports (large scale!)

• Zoom down to Sydney, Australia (somewhere in the lower right corner of the world....), click the info button (i), and query information about the Countries layer, to see in which country we are. You might need to authenticate again. Try to identify Sydney's International Airport.

As you can see, for Alice everything works as if she had loaded the WMS directly.

Task 1: Add another user with less permissions

Summary

Within this task we will create a new user "Bob" who just has access to a selection of layers. Bob shall only be allowed to query feature information on the Countries layer.

• Create the new user "Bob"
  • Open the file [SERVER_HOME]/webapps/wss/WEB-INF/classes/users.xml with a text editor.
  • Add the following XML element to the <UserRepository> element

      <User  username="bob" password="bob" realname="Bob">
            <Role name="bob"/>
            <Role name="main"/>
      </User>
    

  • Save the file
• Create permissions for Bob
  • Open the file [SERVER_HOME]/webapps/wss/WEB-INF/classes/permissions.xml with a text editor
  • Add the following XML elements to the <PermissionSet name="Demis WMS Permissions"> element, right below the existing <Permission> element.

    <!--  Users of role 'bob' can view Cities, Builtup areas, Hillshading, Borders, Countries, Airports
            GetFeatureInfo only on Contries  -->
    <Permission name="most_GetMap_GetCaps">
        <Resource value="layers/Cities" />
        <Resource value="layers/Builtup%20areas" />
        <Resource value="layers/Hillshading" />
        <Resource value="layers/Borders" />
        <Resource value="layers/Countries" />
        <Resource value="layers/Airports" />
        <Action value="operations/GetCapabilities" />
        <Action value="operations/GetMap" />
        <Subject value="bob" />
    </Permission>
    <Permission name="bob_Countries_GetFeatureInfo">
        <Resource value="layers/Countries" />
        <Action value="operations/GetFeatureInfo" />
        <Subject value="bob" />
    </Permission>
    

  • Save the file and reload the WSS (stop-start Jetty Web Server)
• Delete Alice's map in uDig and restart uDig (otherwise you cannot access the proteced service as another user) .
• Add a new map named "Bob's Map" to the uDig project and add the WMS http://localhost:8080/wss/httpauth/demiswms/.
• This time log in as bob/bob
• Again, rearrange the layers to get a fancy map with airports and borders
• When you try to identify Sydney Intl. Airport, you should not get any information but the message "No rights".

Task 2: Add guest user with spatial constraints

Summary

Within this task we will create a new user "Guest" who just has access to a selection of layers. Guest shall only be allowed to query feature information on the Countries layer in the area of the American Continent.

• Create a new user "Guest" with username/password/role guest/guest/guest in the users.xml file of the WSS.
• In the permissions.xml file, add a second <Subject> element to the Permission with name="most_GetMap_GetCaps" to allow users with role guest to view the same layers as role bob:

      <Subject value="guest" />
  

• In the permissions.xml file, add the following XML elements to the <PermissionSet name="Demis WMS Permissions"> element, right below last <Permission> element.

  <!--  users with role guest can request GetFeatureInfo on Countries only within american continent -->
  <Permission name="guest_countries_GetFeatureInfo_obliged">
      <Resource value="layers/Countries" />
      <Action value="operations/GetFeatureInfo" />
      <Subject value="guest" />
      <Obligation name="obligation:wms:extent:boundingbox">
          <Attribute name="srs">EPSG:4326</Attribute>
          <Attribute name="box">-170,-56,-36,83</Attribute>
      </Obligation>
  </Permission>
  

• Save the file and reload the WSS (stop-start Jetty Web Server)
• Delete Bob's map in uDig and restart uDig (otherwise you cannot access the proteced service as another user) .
• Add a new map named "Guest's Map" to the uDig project and add the WMS http://localhost:8080/wss/httpauth/demiswms/.
• Again, rearrange the layers to get a fancy map
• Try to identify Countries inside and outside the Americas. You should not get information but the message "no rights" outside the Americas.

Advanced: Create new Enforcement Point for a local GeoServer WMS

Go to the advanced Tutorial...