Copyright © 2013 Open Geospatial Consortium
18 Provide guidance on a common data structure format that PDP providers can
publish to PEPs to reduce or eliminate exposing internal data mapping schemes to PEP consumers
Expand the description of the Context Handler to introduce a translation service component that provides, among other things, message structure translation
capability, protocol translation services and syntax or semantics checking
5.7.1.2 Obligation Processing
Additional transformations were created to accommodate the use of obligations in the XACML PDP responses. These obligations were returned as Base64 encoded
strings containing OGC Filters. Base64 was used to simplify persistence options at the PDP. These transformations decoded the Base64 encoded obligation strings and
redacted the WFS POST request to contain the OGC filter XML segment.
5.7.2 con terra PEP with GEOAxIS PDP
√ One separate instance of a con terra PEP was set up to request AD’s from the
GEOAxIS PDP. The PEP was able to connect to the PDP, send ADR’s, and process the AD’s.
5.7.3 con terra PEP with Secure Dimensions PDP
√ One separate instance of a con terra PEP was set up to request AD’s from the
Secure Dimensions PDP working on the con terra created policy. The PEP was able to connect to the PDP, send ADR’s, and process the AD’s.
5.8 Functionality Test Results for PEP PDP
In terms of functionality, it is important that each possible PEP PDP pair enforces the identified access rights correctly. The following TIE matrix captures the test
results regarding the correct enforcement of the defined access rights.
PDP \ PEP GEOAxIS PEP
con terra PEP GEOAxIS PDP
× con terra PDP
√ Secure Dimensions PDP
∞ √
Table 3 — PDP PEP functional results
These symbols used in the matrix have the following meaning: √
: this combination of PEPPDP enforces the access rights as defined ×
: this combination of PEPPDP does not enforce the access rights as defined ∞
: this combination of PEPPDP was not tested
5.8.1 GEOAxIS PEP with con terra and Secure Dimensions PDP
The PEP and PDP communications testing was driven by the SilverLight client application. The application was hosted on a GEOAxIS server and protected by the
Copyright © 2013 Open Geospatial Consortium
19 GEOAxIS infrastructure. Users were challenged to authenticate and issued security
tokens and headers as described above. Once a user was authenticated, they would register the WFS using a widget on the
client. The user would input the URL of the target service, then search on that service. That search action would result in a GetCapabilities call to the target
service. The result on the client was a display of the available layers and features. The user would then select the desired features from the layer and enable them to
be visible. The selection of the feature resulted in a GetFeature POST call to the GEOAxIS infrastructure and routed accordingly. Additionally, the GET and POST
links in the GetCapabilities needed to be transformed on the response to the client to contain the GEOAxIS URL instead of the service provider URL.
The GEOAxIS proxy servers were configured to route traffic to different servers based upon URI. For example, the xsprojects URI would map Interactive
Instrument requests to an XML Firewall instance installed on GEOAxIS that routed PDP requests to Conterra. URI patterns for wfs would route Carbon Service PDP
requests to the GEOAxIS PDP. Changing routing to backends was simply a matter of reconfiguring the proxy server to hit the appropriate XML Firewall.
Additional XML Firewall configurations were enabled to demonstrate functionality that converted RESTful service calls to SOAP with SAML headers, responded to
XACML requests from Conterra, and called out to Secure Dimensions PDP.
5.8.2 con terra PEP with con terra PDP
√ The con terra PEP was able to enforce the PDP’s authorization decisions as
expected. This includes enforcement of access restrictions to single feature types as well as request rewriting application of Filter Encoding statements and request
filtering removing denied feature types from a capabilities document.
5.8.3 con terra PEP with GEOAxIS PDP
