[mapserver-dev] MS RFC 90: Enable/Disable Layers in OGC Web Services by IP Lists - Call For Vote

[thomas bonfort]

Hi all,

First of all, I'm sorry for not bringing this up earlier. I was
offline for some time, but given my reluctance on the question should
have responded before the voting period.

I am very reluctant in bringing in an authorization/authentication
layer into mapserver proper, as this is not the role of a mapping
server, and is a sufficiently complicated and important subject to be
left to specialized services that have been designed from the ground
up to handle these kinds of tasks. Following is an unordered list of
reasons that motivate my opinion:

- ip based authentication is notoriously insecure and can be
worked-around, albeit with a bit of effort. c.f.
http://en.wikipedia.org/wiki/IP_address_spoofing

- the proposed solution of providing ip addresses in a file is simple,
but opens up the need to support other providers in the future
(database, ldap, etc...). In the long run this means duplicating the
entire authentication/authorization middleware in mapserver, which is
something that we are not competent at.

- I believe there is an overlap with the exisiting ows_enable_request
mechanism, and it is not clear which should take precedence given that
the two mechanisms are distinct.

- This is nitpicking, but performance wise these checks will be run
for each rendered layer, and will affect all mapserver users, whereby
the vast majority of these users has no need for such a feature.

- I believe that similar functionality can be obtained in a much
cleaner and modular fashion by relying on the webserver
authentication/authorization, using plain mapfile includes and apache
configuration, namely:

mapfile-pub.map:
map
 ...
 include "layers-pub.inc"
end

mapfile-private.map
map
 ...
 include "layers-pub.inc"
 include "my-super-secret-layers.inc"
end

and in apache you use the existing, featurefull and secure options to
set MS_MAPFILE to mapfile-pub or mapfile-private depending on ip
addresses, authentication, time-of-day, etc...
This also alleviates the need to implement ms_enable_modes as the
private layers are completely absent from the configuration for an
unauthorized client.

Given the arguments I have presented, I am -0 on this RFC. I am
however +1 on ms_enable_modes, as this has valid usages outside of
authentication/authorization.

best regards,
Thomas



On 27 February 2013 21:29, Tamas Szekeres <szekerest at gmail.com> wrote:
> Dear PSC,
>
> MS RFC 90 has been updated by taking all reasonable suggestions into
> account.
>
> I've also provided a suggested implementation for this feature at:
> https://github.com/szekerest/mapserver/commit/5d7ec08292e4b790d219082f7ea6ced83fc5c336
>
> Since I got no further additions to the concept in the recent days, I hereby
> call for a vote on MS RFC 90
>
> Starting with my +1.
>
>
> Best regards,
>
> Tamas
>
> _______________________________________________
> mapserver-dev mailing list
> mapserver-dev at lists.osgeo.org
> http://lists.osgeo.org/mailman/listinfo/mapserver-dev
>