Copyright © 2016 Open Geospatial Consortium.
25
Figure 10 - User Attribute Categories for the test and demonstration users
4.5.1.2.1 Authentication Methods
The method of security authentication that a client performs was the first criteria for access control. If a client uses no authentication ie a web browser with no login, the
access to all capabilities and features from the protected WFS was denied [ deny all ].
Should the client use HTTP Basic Authentication to the PEP and that user is validated against the OGC Attribute Store, the access to all capabilities from the protected WFS
was allowed [ allow all ]. Features from the protected WFS were filtered based on the filtering rules.
Clients with HTTP Basic Authentication over TLS to the PEP, and validated against the OGC Attribute Store, should be given the access to all capabilities from the protected
WFS [ allow all ]. Features from the protected WFS should be filtered based on the filtering rules.
4.5.1.2.2 Clearance maps to classification and filtering
Trusted Data Objects TDO were added to the NIEM IEPs for this project, along with geospatial feature geometries for testing. Each document included an “ism:classification”
attribute in the TDO headers, as well as, nested in various tags throughout the rest of the document. Generally, the TDO header information in the tdf:HandlingAssertion tags
should be unclassified, meaning all viewers of the document can see those portions. Any tag in the document payload or tdf:StructuredPayload, and all of its children tags
26
Copyright © 2016 Open Geospatial Consortium.
should be filtered from being sent to the client based upon the “ism:classification” attribute for that tag.
The most restrictive classification was TS Top Secret, followed in order by, S Secret, C Confidential, and followed lastly with the least restrictive classification of Clearance
being: U Unclassified.
An example of a tdf:StructuredPayload is shown below. Notice that the classification attribute in the mda:noticeofarrival tag is equal to C line 9. This is the roll-up from
the entire payload. Any Classification markings anywhere below this tag lines 12 and on should be identified and filtered based upon the user attributes. If the user is
Unclassified, lines 26 through 36 should be stripped, but line 37 would remain.
4.5.1.2.3 ism:classification=TS
