OGC 11-086r1
Copyright © 2012 Open Geospatial Consortium
45
8 Techniques to implement the required types of rights in GeoXACML
This section explains how to generate adequate XACML ADRs based on intercepted WFS messages and how to implement the required types of the rights. For each type of
rights we present an XACML code fragment that demonstrates how to express authorization semantics of that kind.
All examples given in this section are not AIXM specific and intend to explain the concepts only. The application of these concepts to protect WFS instances that process
AIXM data will be shown in the upcoming section 9.
Note that the interested reader is recommended to have detailed knowledge on the language constructs provided by the XACML v3.0 specification, the GeoXACML
specification and the related profiles cp. 6.3.6.
8.1 XACML based implementation of the SSME evaluation context model
Section 6.3.4.1 has shown that evaluation context models must be specializations of the abstract SSME evaluation context model shown in Figure 9, to support the types of rights
required in the OWS use case. The sample XACML ADR presented under Listing 1 demonstrates how a SSME model conformant XACML evaluation context can look like.
The visualized ADR describes the following situation: A user with activated citizen; role, german citizenship and a current location within germany wants to interact with a
specific WFS running on a server with certain hardware and software characteristics.
Request ... Attributes Category=access-subject;
Attribute AttributeId=role; IncludeInResult=false AttributeValue DataType=string;citizen;AttributeValue
Attribute Attribute AttributeId=citizenship; IncludeInResult=false
AttributeValue DataType=string;germanAttributeValue Attribute
Attribute AttributeId=current-location; IncludeInResult=false AttributeValue DataType=geometry;gml:Point ...
...-- a place in Munich --gml:PointAttributeValue Attribute
Attributes Attributes Category=recipient-subject;
Attribute AttributeId=ip-adress; IncludeInResult=false AttributeValue DataType=string;123.123.123.123AttributeValue
Attribute Attribute AttributeId=os-recipient-host; IncludeInResult=false
AttributeValue DataType=string;windowsAttributeValue Attribute
Attribute AttributeId=mem-recipient-host; IncludeInResult=false AttributeValue DataType=integer;1.000.000.000AttributeValue
Attribute
46
Copyright © 2012 Open Geospatial Consortium
Attribute AttributeId=service-url; IncludeInResult=false AttributeValue
DataType=string;http:domainA.comwfsAttributeValue Attribute
Attribute AttributeId=service-type; IncludeInResult=false AttributeValue DataType=string;WFS-1.1;AttributeValue
Attribute Attributes
Attributes Category=message; ...-- a Content element or Attribute element set based representation
of the intercepted OWS message -- Attributes
Attributes Category=environment; Content
EnvironmentState disasters
disaster typefiretype
startTime2011-02-01T09:23startTime endTime2011-02-02 T11:16endTime
spatialExtend gml:Polygon xmlns:gml=http:www.opengis.netgml3.2
...-- area affected by disaster -- gml:Polygon
spatialExtend disaster
...-- further ongoing or previous disaster events-- disasters
EnvironmentState Content
Attribute AttributeId=current-dateTime; IncludeInResult=false AttributeValue DataType=dateTime;2011-02-04T12:28AttributeValue
Attribute Attributes
Request
Listing 1: SSME model conformant XACML v3.0 ADR
The intercepted OWS message can be included in the ADR in an XML encoded form below the Content element and or through a set of Attribute elements details see
[25]. To support the definition of very expressive authorization semantics it is necessary to use the Content based representation of OWS messages in XACML ADRs details
see [10][11]
8.2 XACML based implementation of rights referring to machines, services, subjects and
