How to implement access control for WFS-T updates?

Question

I'm implementing a system which has structure like in my question: Design question: what's the role of WFS-T in this kind of webapp?

There's spatial data which is updated through WFS-T and non-spatial data which is updated through traditional (Java) web application.

When user updates non-spatial data, it is easy to implement authorization rules such as

if current_user = sales_region.manager AND sales_region.status = ACTIVE then all spatial fields can be updated

But can I do the same for the WFS-T geometry updates?

if current_user = sales_region.manager AND sales_region.status = ACTIVE then sales_region.area geometry can be updated through WFS-T requests

Isn't the WFS-T interface just an open XML interface? Anyone who has http access to it can modify, add and remove geometries at will? How could I add business rules checks to protect the geometry updates?

I know I could protect the whole WFS-T interface so that only some users can access it altogether, but that's not what I am after. I need to allow or deny some updates based on the data and some defined business rules.

Are there any easy solutions for this?

Answer 1

I am starting to think there's no easy answer to this using only WFS-T.

I am considering a solution where database would have two sets of geometries: A which is for temporary use and editable to all users who have access to the wfs-t interface. And B, which stores the actual geometries and is not editable through the wfs-t interface at all.

When user tries to update sales_region.areaB:

1. application programmatically copies sales_region.areaB -> sales_region.areaA
2. user updates areaA geometry through the WFS-T interface
3. when user is finished, application programmatically copies areaA -> areaB (this is the only way areaB ever gets updated)

This still leaves open the hole where anyone with access to WFS-T interface can edit any geometry if someone happens to be at step 2 at that point. But it's a lot better than original solution, where anyone can edit or remove any geometries at any point.

Alternative solution would be to add some kind of intelligent proxy in front of the WFS-T interface. This proxy would then examine every request going to WFS-T interface and only let allowed ones pass. I dislike this option because parsing and understanding the WFS-T requests will be complex and slow.