Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

In a project the customer wants the images of the WMS to be secured against unauthorized access. What are the common solutions to realize that? Are they compatible with the OGC-standards?

share|improve this question

7 Answers 7

up vote 14 down vote accepted

The OGC spec only mandates the use of http. If it is compliant http it should be okay.

Some possible methods:

  • HTTP Basic Authentication (password sent as plain text, may have limited client support)
  • HTTP Digest Authentication (more secure, may have limited client support)
  • Filter IP address of client (easy to implement but not particularly secure).
  • Secret URL. Use a GUID to generate an un-guessable URL. Assumes that clients will keep URL secret. Much simpler for user to use than password entry. Guaranteed client support.
share|improve this answer

This OGC post from 2005 says:

There are no specific security aspects that are part of the OGC WMS/WFS/WCS Interface Specifications. Instead, security and authentication is best handled at another layer in the processing stack.

share|improve this answer

You can require that users connect to the WMS over HTTP secured by a VPN. It puts the security layer on the level of the IP network, but certainly adds complexity.

share|improve this answer

If security through obscurity is enough for your purposes you might configure a false extend for the layer :

Just use coordinates on the other side of the Earth. The layer will still appears in the layer list, requests will still be possible but if a user simply select it in a GIS software and choose "zoom to layer" he will not see anything and might think that this layer is simply empty or does not work. An application knowing the correct extend of the layer should still be able to access it.

I have already seen this solution applied on some WMS sites, but it is probably not completly conform to OGC-standards as the server returns an incorrect extend.

share|improve this answer

There are also specialized frameworks like SecureOWS by CampToCamp : http://www.secureows.org/trac/secureows

share|improve this answer

http://52north.org/communities/security/general/user_guide.html http://geoprisma.org/site/index.php

http://www.opengeospatial.org/projects/groups/geormwg

src:http://www.delicious.com/based2/bundle:comp.infosystems.gis

share|improve this answer

Assuming you have the following:

You could create a api_keys table with access_token and expires_at columns. Then add a querystring parameter &api_key=my_unique_key. Your Mapfile for the tileindex (see example) would be configured something like this:

DATA "geom FROM (
  SELECT
   my_table.geom,
   my_table.gid,
  api_keys.access_token
  FROM my_table
  CROSS JOIN api_keys
  WHERE ST_Intersects(geom, !BOX!) and api_keys.expires_at > now()
) AS subquery USING UNIQUE gid USING SRID=4326"
FILTER "access_token = '%api_key%'
VALIDATION
  'api_key' '^[a-zA-Z0-9\_\-]{33}$'
  'default_api_key' ''
END

The idea is your separate application which authenticates users to the database would update the api_keys table, setting access_token to an md5 hash and keep the expires_at column updated to some point in the future.

Alternatively, you can proxy traffic to a separate framework which handles WMS/OWS authentication and proxies authorized users to the internal Mapserver. Here is a list obtained from a post to the mapserver-users mailing list, which is an expanded/summarized list of what others have answered to this question.

If you ever decide to use Geoserver, take a look at the AuthKey module.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.