OGC 11-086r1
Copyright © 2012 Open Geospatial Consortium
73
10 Implementation of the Access Control System Components
The Access Control System consists of three major components: 1 The PEP
2 The Context Handler including the PIP 3 The GeoPDP
The PEP is implemented as an Apache 2 Web Server configured as a Reverse Proxy. As such, it intercepts HTTP requests for a given URI e.g. serviceWFS and forwards the
request to the appropriate Apache 2 Module.
The Context Handler is implemented as an Apache 2 Module which is loaded at Apache startup and executed if the Apache intercepts a WFS request on a given URI. In
correspondence with the XACML information flow, the Context Handler creates the XACML Authorization Decision Request which is sent to the GeoPDP.
The GeoPDP is a Web Service that returns XACML Authorization Decisions upon an XACML Authorization Decision Request.
10.1.1 PEP
The Policy Enforcement Point basically is an Apache 2 Web Server configured to run as a Reverse Proxy. The following configuration snippet illustrates this:
Location serviceWFSComsoft Order
deny, allow Allow
from all Reverse Proxy Settings
ProxyPass http:...cadas-aimdbwfs
location
Listing 17: Reverse Proxy configuration for the Comsoft WFS-T
In order to forward intercepted requests to the Context Handler, implemented as an Apache 2 Module, the module must be loaded and activated for the given URI. Loading
can be achieved by the LoadModule directive:
LoadModule authz_wfs_module ...apachemodulesmod_authz_wfs.so
Listing 18: Loading the WFS-T Context Handler
Activation for a particular WFS URI can be achieved by the following lines
Location serviceWFSComsoft ...
Context Handler activation
74
Copyright © 2012 Open Geospatial Consortium
OWSType WFS
GeoPDP on
GeoPDPURL http:...GeoPDPserviceOWS-8
Location
Listing 19: Configuration for activating the Context Handler
10.1.2 Context Handler
The Context Handler implements the duties as described in the XACML specification. Therefore, the main task is to interpret the intercepted WFS request and create an
XACML conformant Authorization Decision Request.
For a GET request, it analysis the HTTP query string and creates an XACML AttributeValue representation. For a POST request, it inserts the POSTed request into the
XACML ADR under the ResourceContent element. How this is done in detail is described in the XACML v2.0 OWS Profile specification within the following
Requirement Classes:
Requirements Classes
{xop;RC1.2, xop;RC1.3WFS: 2.0;, xop;RC1.4WFS:2.0;, xop;RC1.9WFS:2.0;, xop;RC1.11WFS:2.0; }
Listing 20: Requirements Classes used by the Context Handler to construct the XACML ADR
For any Authorization Decision that indicates “Missing Attributes” the Context Handler instructs the PIP to fetch them. For OWS-8, the Context Handler and the PIP are an
