Open Geospatial Consortium |
|
Submission Date: 2018-05-17 |
|
Approval Date: 2018-08-28 |
|
Publication Date: 2019-01-28 |
|
External identifier of this OGC® document: http://www.opengis.net/doc/IS/security/1.0 |
|
URL for this OGC® document: http://docs.opengeospatial.org/is/17-007r1/17-007r1.html |
|
Please refer to the errata for this document. |
|
Internal reference number of this OGC® document: 17-007r1 |
|
Version: 1.0 |
|
Category: OGC® Implementation Standard |
|
Editor: Andreas Matheus |
OGC Web Services Security
*Copyright notice* |
||
Copyright © 2019 Open Geospatial Consortium |
||
To obtain additional rights of use, visit http://www.opengeospatial.org/legal/ |
*Warning* |
This document is an OGC Member approved international standard. This document is available on a royalty free, non-discriminatory basis. Recipients of this document are invited to submit, with their comments, notification of any relevant patent rights of which they are aware and to provide supporting documentation. |
Document type: OGC® Standard |
Document subtype: |
Document stage: Approved |
Document language: English |
License Agreement
Permission is hereby granted by the Open Geospatial Consortium, ("Licensor"), free of charge and subject to the terms set forth below, to any person obtaining a copy of this Intellectual Property and any associated documentation, to deal in the Intellectual Property without restriction (except as set forth below), including without limitation the rights to implement, use, copy, modify, merge, publish, distribute, and/or sublicense copies of the Intellectual Property, and to permit persons to whom the Intellectual Property is furnished to do so, provided that all copyright notices on the intellectual property are retained intact and that each person to whom the Intellectual Property is furnished agrees to the terms of this Agreement.
If you modify the Intellectual Property, all copies of the modified Intellectual Property must include, in addition to the above copyright notice, a notice that the Intellectual Property includes modifications that have not been approved or adopted by LICENSOR.
THIS LICENSE IS A COPYRIGHT LICENSE ONLY, AND DOES NOT CONVEY ANY RIGHTS UNDER ANY PATENTS THAT MAY BE IN FORCE ANYWHERE IN THE WORLD.
THE INTELLECTUAL PROPERTY IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE DO NOT WARRANT THAT THE FUNCTIONS CONTAINED IN THE INTELLECTUAL PROPERTY WILL MEET YOUR REQUIREMENTS OR THAT THE OPERATION OF THE INTELLECTUAL PROPERTY WILL BE UNINTERRUPTED OR ERROR FREE. ANY USE OF THE INTELLECTUAL PROPERTY SHALL BE MADE ENTIRELY AT THE USER’S OWN RISK. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR ANY CONTRIBUTOR OF INTELLECTUAL PROPERTY RIGHTS TO THE INTELLECTUAL PROPERTY BE LIABLE FOR ANY CLAIM, OR ANY DIRECT, SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM ANY ALLEGED INFRINGEMENT OR ANY LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR UNDER ANY OTHER LEGAL THEORY, ARISING OUT OF OR IN CONNECTION WITH THE IMPLEMENTATION, USE, COMMERCIALIZATION OR PERFORMANCE OF THIS INTELLECTUAL PROPERTY.
This license is effective until terminated. You may terminate it at any time by destroying the Intellectual Property together with all copies in any form. The license will also terminate if you fail to comply with any term or condition of this Agreement. Except as provided in the following sentence, no such termination of this license shall require the termination of any third party end-user sublicense to the Intellectual Property which is in force as of the date of notice of such termination. In addition, should the Intellectual Property, or the operation of the Intellectual Property, infringe, or in LICENSOR’s sole opinion be likely to infringe, any patent, copyright, trademark or other right of a third party, you agree that LICENSOR, in its sole discretion, may terminate this license without any compensation or liability to you, your licensees or any other party. You agree upon termination of any kind to destroy or cause to be destroyed the Intellectual Property together with all copies in any form, whether held by you or by any third party.
Except as contained in this notice, the name of LICENSOR or of any other holder of a copyright in all or part of the Intellectual Property shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Intellectual Property without prior written authorization of LICENSOR or such copyright holder. LICENSOR is and shall at all times be the sole entity that may authorize you or any third party to use certification marks, trademarks or other special designations to indicate compliance with any LICENSOR standards or specifications. This Agreement is governed by the laws of the Commonwealth of Massachusetts. The application to this Agreement of the United Nations Convention on Contracts for the International Sale of Goods is hereby expressly excluded. In the event any provision of this Agreement shall be deemed unenforceable, void or invalid, such provision shall be modified so as to make it valid and enforceable, and as so modified the entire Agreement shall remain in full force and effect. No decision, action or inaction by LICENSOR shall be construed to be a waiver of any rights or remedies available to it.
- OGC Web Services Security
- 1. Scope (informative)
- 2. References
- 3. Terms and Definitions
- 4. Conventions
- 5. Use Cases (informative)
- 5.1. Use Case 0: Public Service / Public Data / Public Catalogue / Public Communication
- 5.2. Use Case I: Authenticated Public Service / Public Data / Public Catalogue / Secure Communication
- 5.3. Use Case II: Protected Service / Open Data / Public Catalogue / Secure Communication
- 5.4. Use Case III: Protected Service / Private Data / Public Catalogue
- 5.5. Use Case IV: Protected Service / Private Data / Protected Catalogue / Secure Communication
- 5.6. Use Case V: Use of cached Capabilities instance documents
- 5.7. Use Case VI: Use of Capabilities instance documents hosted on a Web Server
- 6. Conformance
- 7. Conformance for a Service Implementation
- 7.1. Requirements Class HTTPS
- 7.2. Requirements Class Identifiers
- 7.3. Requirements Class HTTP Methods
- 7.4. Requirements Class W3C CORS
- 7.5. Requirements Class HTTP Exception Handling
- 7.6. Requirements Class HTTP POST Content-Type
- 7.7. Requirements Class Authorization
- 7.8. Requirements Class WS-Policy
- 7.9. Requirements Class OpenAPI
- 7.10. Requirements Class Authentication
- 7.11. Requirements Class SAML2
- 7.12. Requirements Class OpenID Connect
- 8. Conformance for a Client Implementation
- 9. OGC Conformance
- 10. Security Considerations (informative)
- Annex A: Conformance Tests for the Service (normative)
- A.1. Conformance Classes
- A.2. Conformance Class Test – Concrete Realization
- A.3. Testing Optional Requirements Classes
- A.4. Test Activity Diagram for Optional Requirements Classes
- A.4.1. Validate Requirements Class “HTTP Methods”
- A.4.2. Validate Requirements Class “HTTP Exception Handling”
- A.4.3. Validate Requirements Class “W3C CORS”
- A.4.4. Validate Requirements Class “Authentication”
- A.4.5. Validate Requirements Class “SAML2”
- A.4.6. Validate Requirements Class “OpenID Connect”
- A.4.7. Validate Requirements Class “OpenAPI”
- A.4.8. Validate Requirements Class “Authorization”
- A.4.9. Validate Requirements Class “WS-Policy”
- A.4.10. Validate Requirements Class “HTTP Content-Type”
- Annex B: Conformance Tests for the Client (normative)
- Annex C: Conformance Tests for the Authentication Code Resolver (normative)
- Annex D: Initial Authentication Codelist (informative)
- Annex E: Using Authentication Codelist in ISO Metadata (informative)
- Annex F: Revision History
- Annex G: Bibliography
i. Abstract
Information Assurance (IA)[1] Controls for OGC Web Services (OWS) have been implemented for years. However, these implementations break interoperability, as they are not standardized by OGC Web Service standards. Interoperability between secured OGC Web Services and clients is limited to systems custom built to work with an IA implementation.
The goal of the OWS Common Security Standard is to allow the implementation of IA controls and to advertise their existence in an interoperable way with minimal impact to existing implementations using a backwards-compatible approach. That goal is being pursued in two ways:
-
Identify and document IA Controls for supporting authentication in a register maintained through the OGC.
-
Specify how a service can advertise their IA controls through the Service Capabilities Document.
This OGC standard applies to OWS deployed on HTTPS. It specifies how conformant OWS Services shall advertise their IA Controls and additional security features. The advertisement uses XML elements that are already part of the Capabilities document structure. This ensures that existing client implementations will not break.
The standard also describes the governance process for the IA Control registers, examples of register contents, and descriptions on how this information should be used.
Next, this standard defines conformance classes and requirements classes to be used for reaching compliance and their validation via conformance tests.
Finally, this standard defines client behavior to ensure interoperable processing of advertised security controls.
ii. Keywords
The following are keywords to be used by search engines and document catalogues.
ogcdoc, OGC document, Security, OWS Common, OWS Common Security, OGC Web Services Security, OAuth2, OpenID Connect, SAML2, HTTPS, WS-Security, WS-Policy, SOAP, WMS, WFS, WCS, WMTS, XACML, GeoXACML, Authentication, Access Control
iii. Preface
This is version 1.0 of the OGC Web Services Security standard submitted to the Technical Committee by the OWS Common – Security Standards Working Group.
This document standardizes an annotation mechanism for Capabilities documents or responses to the GetCapabilities request, ensuring interoperability between a secured OGC Web Service instance deployed on HTTPS and a client application. It further overrides existing HTTP protocol limitations and exception handling for existing OGC Web Services standards for the purpose of achieving interoperability with main stream IT security standards and their implementations. To achieve this, no changes to existing OGC Abstract specifications and OGC Web Services standards are required.
This standard has no direct precursor document but can be seen as the result of previous OGC Testbeds, documented in different Testbed Engineering Reports (see bibliography).
The annotation approach and the service behavior regarding security is standardized in a backwards compatible way to ensure it can be applied to existing OGC Web Services with no change to the deployments.
The implication to be compliant with this standard is that some requirements from existing OGC standards are superseded. Because this standard defines the compliance, it is not required to incorporate the requirements into the existing standards. Therefore no change requests to the existing OGC standards are required!
Uptake of the standardized approach by new OGC Web Services standards will ensure security interoperability.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. The Open Geospatial Consortium shall not be held responsible for identifying any or all such patent rights.
Recipients of this document are requested to submit, with their comments, notification of any relevant patent claims or other intellectual property rights of which they may be aware that might be infringed by any implementation of the standard set forth in this document, and to provide supporting documentation.
iv. Submitting organizations
The following organizations submitted this Document to the Open Geospatial Consortium (OGC):
Organization name(s)
-
University of the Bundeswehr
-
NGA
-
Geonovum
-
WiSC
-
DigitalGlobe
v. Submitters
All questions regarding this submission should be directed to the editor or the submitters:
Name |
Affiliation |
Andreas Matheus |
University of the Bundeswehr |
Dave Wesloh |
NGA |
Frank Terpstra |
Geonovum |
Chuck Heazel |
WiSC |
Michael Leedahl |
DigitalGlobe |
1. Scope (informative)
This standard applies to a deployed OGC Web Service instance for which the protocol scheme of all operation endpoint URLs, exposed in the Capabilities document, is ‘https’ as defined in RFC 7230, section 2.7.2.
A security-annotated Capabilities document is one which uses the <Constraint> element(s) to express the existence of security controls on the operation of the service instance or support for a particular security feature. Applying the tests as defined in the Annexes can validate compliance for a service, the client and the OGC management process. Basically, a service can be described by a Capabilities document that includes security annotations as defined in this standard. A client loading these Capabilities and parse for the <Constraint> element(s) can determine the security controls implemented for each operation of the service instance. The string value of this element’s name attribute contains the identifier of the implemented requirements class.
How the client obtains the security-annotated capabilities is out of scope for this standard.
This standard defines one common abstract Requirements Class and three Capabilities document structure specific Requirements Classes. The structure specific classes address how the requirements are implemented for WMS 1.1.1, WMS 1.3 and OWS Common based service Capabilities documents.
Requirements Class Common Security: This abstract class ensures that the service instance is implementing HTTPS as specified by the IETF RFCs [e.g. RFC 7230]. This is the minimum capability required to be interoperable with mainstream IT security technology. Common Security bundles mandatory requirements classes that address issues which inhibit operating an OGC compliant web service over HTTPS. This Requirements Class also provides a method for the client to use either the service exception handling compliant with OWS Common (for the OWS layer) or exception handling compliant with the HTTP specification for the security layer. This method ensures the elimination of unnecessary limitations regarding the HTTP protocol and exception handling from OWS Common and other OGC Web Service standards. This standard also defines other optional requirements classes that address the description of further IAs to be able to convey as much information on existing security controls as possible.
The following Requirements Classes are concerned with how to apply the actual security annotations to the Capabilities document that is associated with a service endpoint. There are three different Requirements Classes because the way to insert security annotations into the Capabilities document differs based on the underlying XML schema or DTD.
Requirements Class OWS Common: This class defines how the security metadata is to be inserted into the OGC Web Service Capabilities document for any service instance based on OWS Common XML schema.
Requirements Class WMS 1.1.1: This class defines how the security metadata is to be inserted into the OGC Web Service Capabilities document for a WMS 1.1.0 service instance based on the WMS 1.1.1 DTD.
Requirements Class WMS 1.3.0: This class defines how the security metadata is to be inserted into the OGC Web Service Capabilities document for a WMS 1.3.0 service instance based on the WMS 1.3.0 XML schema.
The implication to be compliant with this standard is that some requirements from existing OGC standards are superseded. Because this standard defines the compliance, it is not required to incorporate the requirements into the existing standards. Therefore no change requests to the existing OGC standards are required!
The following OGC standards are directly affected:
-
OWS Common 1.1.0, OGC 06-121r3 OGC Web Services Common Specification, OGC® Implementation Standard
-
OWS Common 2.0.0, OGC 06-121r9 OGC Web Services Common Specification, OGC® Implementation Standard
-
WMS 1.1.1, OGC 01-068r3 Web Map Service Implementation Specification
-
WMS 1.3.0, OGC 06-042 OpenGIS Web Map Service (WMS) Implementation Specification
The following OGC standards are impacted because they inherit from OWS Common.
-
WFS 1.1.0, OGC 04-094 OpenGIS Web Feature Service (WFS) Implementation Specification
-
WFS 2.0, OGC 09-025r1 OpenGIS Web Feature Service 2.0 Interface Standard (also ISO 19142)
-
WFS 2.0.2, OGC 09-025r2 OGC® Web Feature Service 2.0 Interface Standard – With Corrigendum
-
WCS 2.0, OGC 09-147r3 OGC® WCS Interface Standard - KVP Protocol Binding Extension, version 1.0.1
-
WCS 2.0, OGC 09-148r1 OGC® WCS - XML/POST Protocol Binding Extension, version 1.0.0
-
WCS 2.0, OGC 09-149r1 OGC® Web Coverage Service 2.0 Interface Standard - XML/SOAP Protocol Binding Extension, version 1.0.0
-
WMTS 1.0, OGC 07-057r7 OpenGIS Web Map Tile Service Implementation Standard
-
WPS 1.0.0, OGC 05-007r7 Web Processing Service
-
WPS 2.0, OGC 14-065 OGC® WPS 2.0 Interface Standard
-
SOS 2.0, OGC 12-006 OGC® Sensor Observation Service Interface Standard
-
SPS 2.0, OGC 09-000 OGC® Sensor Planning Service Implementation Standard
-
CSW 2.0.2, OGC 07-006r1 OpenGIS Catalogue Service Implementation Specification
-
CSW 3.0, OGC 12-176r7 OGC® Catalogue Services 3.0 Specification - HTTP Protocol Binding
One typical way to realize compliance without modifying the existing service implementations is via a security gateway or proxy. This proxy would have the duty to implement the compliance by injecting security annotations into the GetCapabilities response, operate the service endpoint on HTTPS but also support all HTTP methods and correct the OWS Common error code handling. Testbed 12 ER OGC16-048 describes a practical approach of a security proxy.