Implementing Security for ArcGIS Server Java Solutions

Transcription

1 Implementing Security for ArcGIS Server Java Solutions Shreyas Shinde Jay Theodore ESRI Developer Summit

2 Schedule 75 minute session minute lecture minutes Q & A following the lecture Cell phones and pagers Please complete the session survey we take your feedback very seriously!

3 Introductions Who are we? Developers on the ArcGIS Java Server Team Who are you? New ArcGIS Server Developers? Current ArcGIS Server Developers? Web Developers? GIS Administrators?

4 Session agenda Securing ArcGIS Server components ArcGIS Managed Security Components & Model Demos Configuring security using Manager for Services & Applications Consuming secured services through JavaScript clients Extending the security infrastructure Q&A ESRI Developer Summit

5 Securing the Server Secure various components of the Server

6 Securing the Server Restrict access for managing Server Assign users to OS account agsadmin Usually small number of users

7 ArcGIS Server User Spaces Local Users agsadmin group administering the server agsusers group consuming services over DCOM Web Users Consuming services over HTTP

8 ArcGIS Server Site ArcGIS Server System Web Server Web Browser Web Mapping Applications GIS Services - Web Service Endpoints ArcGIS Explorer, ArcGIS Desktop, ArcGIS Web Applications other ArcGIS Servers Web Browser ArcCatalog Administrator Manager Web Application GIS Services - Server Objects GIS Server ArcGIS Server Security Zones HTTP Web Users Local Users ArcMap, ArcGlobe Content Author DCOM Geodatabases

9 New Features at 9.3 Secure services & applications using Manager Native JavaEE security can be configured ArcGIS Managed Security Secure services & applications for Web Users Role based access control Complements JavaEE security

10 Motivation for ArcGIS Managed Security at 9.3 At 9.2, Web Application Security Developer/Deployer experience Web Services Security Developer/Deployer experience No one-stop security configuration in Manager Support only for native Java platform security via HTTP Authentication JavaScript clients could not consume services with native Java security

11 Terms and Concepts Principal (User) Individual consuming published functionality Role Group of individuals with some privilege Permission Privilege to access certain resource Authentication Validating credentials of the individual and establishing identity Authorization Evaluating privileges of an individual based on permission

12 Role based Access Control ArcGIS Managed security provides role based access control What is Role based Access Control? Associate users with Roles Set privileges on Roles rather than individuals Authorization based on what roles you play How does it work? User requests a resource User authentication User-Role mapping Evaluate roles and authorize

13 New Components for Security in 9.3 Principal Store Data store of users and roles along with APIs to access them Permission Store Data store of privileges along with APIs to access them Token Service A service that generates a token based on user credentials used to access secure services Tokens are required to access a secured service in ArcGIS Managed security

14 ArcGIS Managed Security - Model Web / Desktop Applications Web Manage Principal Store Web Service Handler SOM Token Service Principal Store Manager Permission Store GIS Services

15 ArcGIS Managed Security - Model Web / Desktop Applications Web Manage Services Permissions on Services Enable Security Web Service Handler Token Service Principal Store SOM Manager Permission Store GIS Services

16 ArcGIS Managed Security - Model Web / Desktop Applications Web Web Service Handler Token Service Principal Store Client requesting Service SOM Manager Permission Store GIS Services

17 ArcGIS Managed Security - Model Web / Desktop Applications Web Service end-point returns error with URL of Token Service Web Service Handler SOM Token Service Principal Store Manager Permission Store GIS Services

18 ArcGIS Managed Security - Model Web / Desktop Applications Web Client provides user credentials to Token Service Web Service Handler Token Service Principal Store SOM Manager Permission Store GIS Services

19 ArcGIS Managed Security - Model Web / Desktop Applications Web Web Service Handler Token Service Principal Store Token Service authenticates the user SOM Manager Permission Store GIS Services

20 ArcGIS Managed Security - Model Web / Desktop Applications Web Web Service Handler Token Service Principal Store Client makes a request with the token SOM Manager Permission Store GIS Services

21 ArcGIS Managed Security - Model Web / Desktop Applications Web Web Service Handler Token Service Principal Store Service end-point decrypts the token and gets all the roles for the user Permission Store SOM GIS Services Manager

22 ArcGIS Managed Security - Model Web / Desktop Applications Web Web Service Handler Token Service Principal Store Permission Store authorizes user request SOM Manager Permission Store GIS Services

23 Demo Configure Principal Store using Manager

24 Configure Principal Store using Manager Choose data store Default (internal database) Relational Database LDAP Active Directory Configure data store Add users Add roles Assign roles to users

25 Principal Store Options U S E R S ROLES

26 Security for GIS Services - Overview Role based security model Supports permissions on folders and individual services Allows services to inherit permissions from their containing folder Securing a gis service secures access to it via all supported web interfaces : SOAP, REST, OGC, KML Uniform security model across ArcGIS Server for.net and for Java Services Explorer automatically respects configured service permissions. Desktop, Javascript and Web ADF Applications can consume secure services UC 2007 Tech Sessions 26

27 Authentication Schemes Services Java EE Managed HTTP Basic HTTP Digest ArcGIS Managed Token based

28 Demo Securing Services

29 Securing Services using Manager Apply permissions on Services Choose authentication mechanism (ArcGIS or JavaEE) Enable Security

30 GIS Service Permissions Details for Server Object Extension Developers Permissions of Roles on GIS Services are stored in the SOMs configuration store Permissions are automatically retrieved and applied by the Web Service S Handlers The IPermissionsManager interface on the SOM can be used to check k the permission of a Role on a Resource (GIS Service / Server Object) See the section on Role Based Security for GIS Server connections s in the library overview for the core Server library [Library Reference section of the SDK]. S The identity and role of the web user on behalf of whom the GIS Service request is being processed is pushed into the Server Context This identity is available to SOE developers See the section on Role Based Security for Server Object Extensions in the library overview for the core Server library [Library Reference section of the SDK]. S UC 2007 Tech Sessions 30

31 Demo Consuming secured services

32 Consuming Secured Services Web application consuming secured services Provide user credentials while connecting to the Server over HTTP Using desktop clients like ArcCatalog Desktop clients are capable of consuming secured services Existing workflows have not changed!

33 Authentication Schemes Web Applications Java EE Managed Forms HTTP Basic HTTP Digest ArcGIS Managed Login control

34 Demo Securing Web Applications

35 Securing Web Applications using Manager Apply permissions on Web Applications Choose authentication mechanism (ArcGIS or JavaEE) Deploy Export Web Applications with security configuration

36 Demo Working with secured services for JavaScript applications

37 How to work with Tokens? Access a token service Fetch a token Lock down a token with IP or HTTP Referrer Use the token in the application

38 Extending Principal Store API Why extend? To connect/consume data from a data store which we don t support When you have user/role data in some proprietary format Where do I start? Start with the documentation in Manager Can I use the Manager to setup my extension? Manager should simplify the task of providing configuration properties for your extension Not available at Beta DEMO

39 Future Plans No out-of-the box solution to secure services to finer granularity Requires you to write custom servlet filters Post 9.3 effort No out-of-the box solution to use user/role data from your existing database tables Requires you to write extension code at 9.3 Post 9.3 effort You don t know what you do until you know what you don t do - Raymond Chen

40 Summary Security using Manager Security can be configured by the GIS Administrator Various authentication schemes New ArcGIS Managed Security at 9.3 Enables JavaScript clients to consume secured services Interoperable solution between.net and Java

41 Questions?

42 In Conclusion Other recommended sessions and meetings Building Mashups Using the ArcGIS JavaScript APIs Implementing Security for ArcGIS Server.NET Solutions All sessions are recorded and will be available on EDN Slides and code will also be available Please fill out session surveys! Still have questions? 1.Tech talk, Demo Theatres, Meet the Team 2. Ask a Developer link on web page ESRI Developer Summit