Securing WMS against unauthorized access?

Question

In a project the customer wants the images of the WMS to be secured against unauthorized access.

What are the common solutions to realize that?

Are they compatible with the OGC-standards?

Answer 1

The OGC spec only mandates the use of http. If it is compliant http it should be okay.

Some possible methods:

• HTTP Basic Authentication (password sent as plain text, may have limited client support)
• HTTP Digest Authentication (more secure, may have limited client support)
• Filter IP address of client (easy to implement but not particularly secure).
• Secret URL. Use a GUID to generate an un-guessable URL. Assumes that clients will keep URL secret. Much simpler for user to use than password entry. Guaranteed client support.

Answer 2

This OGC post from 2005 says:

There are no specific security aspects that are part of the OGC WMS/WFS/WCS Interface Specifications. Instead, security and authentication is best handled at another layer in the processing stack.

Answer 3

If security through obscurity is enough for your purposes you might configure a false extend for the layer :

Just use coordinates on the other side of the Earth. The layer will still appears in the layer list, requests will still be possible but if a user simply select it in a GIS software and choose "zoom to layer" he will not see anything and might think that this layer is simply empty or does not work. An application knowing the correct extend of the layer should still be able to access it.

I have already seen this solution applied on some WMS sites, but it is probably not completly conform to OGC-standards as the server returns an incorrect extend.

Answer 4

Assuming you have the following:

• Mapserver is rendering data via a Postgis database
• You have a separate application which can authenticate users and update said database.
• Your WMS LAYER uses a WFS tileindex as documented on Example of WMS-T with PostGIS Tile Index for Raster Imagery

You could create a api_keys table with access_token and expires_at columns. Then add a querystring parameter &api_key=my_unique_key. Your Mapfile for the tileindex (see example) would be configured something like this:

DATA "geom FROM (
  SELECT
   my_table.geom,
   my_table.gid,
  api_keys.access_token
  FROM my_table
  CROSS JOIN api_keys
  WHERE ST_Intersects(geom, !BOX!) and api_keys.expires_at > now()
) AS subquery USING UNIQUE gid USING SRID=4326"
FILTER "access_token = '%api_key%'
VALIDATION
  'api_key' '^[a-zA-Z0-9\_\-]{33}$'
  'default_api_key' ''
END

The idea is your separate application which authenticates users to the database would update the api_keys table, setting access_token to an md5 hash and keep the expires_at column updated to some point in the future.

Alternatively, you can proxy traffic to a separate framework which handles WMS/OWS authentication and proxies authorized users to the internal Mapserver. Here is a list obtained from a post to the mapserver-users mailing list, which is an expanded/summarized list of what others have answered to this question.

• Mapbender - been around a long long time and has a wonderful amount of OWS functionality
• Geoprisma
• secureOWS
• GeoShield

If you ever decide to use Geoserver, take a look at the AuthKey module.

Answer 5

You can require that users connect to the WMS over HTTP secured by a VPN. It puts the security layer on the level of the IP network, but certainly adds complexity.

Answer 6

There are also specialized frameworks like SecureOWS by CampToCamp : http://www.secureows.org/trac/secureows

Answer 7

http://52north.org/communities/security/general/user_guide.html http://geoprisma.org/site/index.php

http://www.opengeospatial.org/projects/groups/geormwg

src:http://www.delicious.com/based2/bundle:comp.infosystems.gis