Spectrum Technology Platform

 View Only
  • 1.  Spectrum WFS

    Posted 10-02-2020 09:18
      |   view attached
    Hello

    I am an entry level Spectrum user and I don't have IT education. My goal is to make public WFS service, where people can download our establishments (state institution) GIS vector maps. Using Spatal Manager--> Services--> WFS I put resources to WFS (picture "SpatialManager_WFS.png").  These resources are originally from PostgreSQL database (tables). Is it possible to make public WFS service from that Spectrum WFS service so, that only certain tables and certain columns (marked red in picture "SpatialManager_WFS.png") from Spectrum WFS service can be accessed by random person? Maybe some basic/general directions how to do it?

    I have been told, that proxy server on top of Spectrum WFS can do this? My IT department asks me more information how to solve this task and I don't know what to tell them anymore :).


    Thank you

    Asko Põder

    ------------------------------
    Asko Põder
    Knowledge Community Shared Account
    ------------------------------


  • 2.  RE: Spectrum WFS

    Posted 10-06-2020 11:54

    Hi Asko

    It is possible to set up the WFS in Spatial Manager using the WFS services page. You can add tables to the WFS service and choose which columns in these tables to expose. This would allow the service to be used internally. For example, if the server name was spectrum-server deployed on port 8080 this URL would return the capabilities

    http://spectrum-server:8080/rest/Spatial/WFS?SERVICE=WFS&REQUEST=GetCapabilities&VERSION=2.0.2

     

    However, there are two further considerations when exposing this publicly which use of a proxy server is needed to resolve.

    First – handling authentication for public access

     

    When accessing the WFS service Spectrum Spatial will prompt the user for a log-in. Any Spectrum user can be used to login, as all Spectrum users have permissions to access the OGC services. However, it is not possible to disable security for just the OGC services without disabling it for the whole of Spectrum Spatial

     

    A proxy server can be used to add the authentication header (basic authentication username/password) to the request made by end users/WFS client apps. The end user or client is then never prompted for the login. The client calls the proxy URL, the proxy adds the authentication and then redirects or calls the spectrum server

     

    Here is an example request where the header is U3BhdGlhbE9HQ1VzZXI6U3BhdGlhbE9HQ1Bhc3N3b3Jk

    (this is the user/password combination in base 64 encoding, which here is a user I created called SpatialOGCUser:SpatialOGCPassword)

     

    GET http:// spectrum-server:8080/rest/Spatial/WFS?SERVICE=WFS&REQUEST=GetCapabilities&VERSION=2.0.2 HTTP/1.1

    cache-control: no-cache

    Postman-Token: be4be5cb-2878-47ce-93e0-0b19b5607b9e

    Authorization: Basic U3BhdGlhbE9HQ1VzZXI6U3BhdGlhbE9HQ1Bhc3N3b3Jk

    User-Agent: PostmanRuntime/7.6.0

    Accept: */*

    Host: sky-7205785:8080

    accept-encoding: gzip, deflate

    Connection: keep-alive

     

    As this request is made behind the proxy, and is not seen by users, it could be a HTTP call rather than HTTPS.

     

    Second: Exposing a public facing URL in place of the internal server name

     

    You would normally want to expose a different public URL for the service than the internal server name

     

    For example the internal server name may be http://spectrum-server:8080/rest/Spatial/WFS

    The public URL you need to expose may be something like this (without the port, so it works on default port 80) http://publicWFS/rest/Spatial/WFS

    The proxy would therefore be exposed as publicWFS and would send requests to local-spectrum-server:8080 (as well as adding the authorization header)

     

    When changing the end point like this there is a need to consider the URL defined in the WFS configuration. The WFS returns the URL of the service for each of its supported operations when you make a get capabilities call. WFS clients use this to make further requests to describe and get features from tables. Below is a snippet from a get capabilities request showing the DescribeFeatureType operation, showing the internal URL returned.

    http://spectrum-server:8080/rest/Spatial/WFS?SERVICE=WFS&REQUEST=GetCapabilities&VERSION=2.0.2

     

    <ows:Operation name="DescribeFeatureType">

      <ows:DCP>

        <ows:HTTP>

          <ows:Get xlink:href="http://spectrum-server:8080/rest/Spatial/WFS?"/>

          <ows:Post xlink:href="http://spectrum-server:8080/rest/Spatial/WFS"/>

        </ows:HTTP>

      </ows:DCP>

      <ows:Parameter name="OutputFormat">

        <ows:AllowedValues>

          <ows:Value>application/gml+xml;version=3.2</ows:Value>

          <ows:Value>application/gml+xml;version=3.1.1</ows:Value>

          <ows:Value>application/gml+xml;version=2.1.2</ows:Value>

          <ows:Value>XMLSCHEMA</ows:Value>

        </ows:AllowedValues>

      </ows:Parameter>

    </ows:Operation>

     

    You would want the request to return the public URL.

     

    There are two ways to do this

     

    • First you can modify the WFS configuration in Spectrum Spatial Manager to replace the URL used with the public URL. This method allows the WFS to work from the public URL, but won't work internally if you have WFS clients using the internal URL. The images below  show how to do this.

     




    • Second, you can have the proxy server modify the XML returned from Spectrum to replace the internal URL with the public one. This method allows the WFS to be used both from the proxy and internally, as the URL returned will be valid in both cases.

    I hope this provides enough information for your IT department to progress.

    ------------------------------
    Mustafa Ismail
    Product Architect
    Pitney Bowes
    London UK
    ------------------------------



  • 3.  RE: Spectrum WFS

    Posted 10-07-2020 01:55
    Hi Mr. Ismail. Thank you for your answer. One thing I didn't completely understand.

    "A proxy server can be used to add the authentication header (basic authentication username/password) to the request made by end users/WFS client apps. The end user or client is then never prompted for the login. The client calls the proxy URL, the proxy adds the authentication and then redirects or calls the spectrum server." Question: where this authentication (for example user/password combination in base 64 encoding) comes from when client is random person who has no previous user account in Spectrum Technology Platform.

    Asko Põder



    ------------------------------
    Asko Põder
    Knowledge Community Shared Account
    ------------------------------



  • 4.  RE: Spectrum WFS

    Posted 10-07-2020 04:14
    Hi Asko

    This will be one of the users you have configured in the Spectrum Platform in the Spectrum Management Console. The user should be given the role "user" as minimum. You do not need to give them any other roles. The proxy server would hard code this username and their password. Hence whoever accesses the WFS via the proxy would always have this user added to the authentication header the proxy sends.

    If you do not have any users created in Spectrum and are using just the built in admin user,  I would recommend creating a user for this purpose. Some customers of Spectrum, who have Spatial Analyst and have a guest access enabled, will use the guest user account and password. But any user can be used.

    Note that in Spectrum release 2018.2 and 2019.1 it is not necessary to grant any permissions to  the user on named tables, as the OGC services are open to any user. If you are on an older release such as Spectrum 12.2 or before, you would need to grant this user permissions on the named tables that are referenced in the WFS.




    ------------------------------
    Mustafa Ismail
    Product Architect
    Precisely
    London UK
    ------------------------------



  • 5.  RE: Spectrum WFS

    Posted 10-07-2020 09:13
    Thank you. Yet another question.

    "For example the internal server name may be http://spectrum-server:8080/rest/Spatial/WFS

    The public URL you need to expose may be something like this (without the port, so it works on default port 80) http://publicWFS/rest/Spatial/WFS

    The proxy would therefore be exposed as publicWFS and would send requests to local-spectrum-server:8080 (as well as adding the authorization header)".
    Can I understand correctly that via public URL all resource tables from Spatial Manager --> Services --> WFS are accessible for random person, i.e. I can't restrict access to some tables for public WFS users?



    ------------------------------
    Asko Põder
    Knowledge Community Shared Account
    ------------------------------



  • 6.  RE: Spectrum WFS

    Posted 10-07-2020 09:37
    Hi Asko

    Yes any table added to the WFS would be listed when you make a describeFeatureType request in the WFS, and WFS clients would be able to get the features from the WFS.

    You should therefore only add tables to the WFS that you are happy to make public, in this case.

    If a named table is not added to  the WFS then they would not be available via WFS. The other services in Spectrum are protected by permissions. This page here describes the way each service endpoint works
    https://docs.precisely.com/docs/sftw/spectrum/19.1/en/webhelp/Spatial/index.html#Spatial/source/Security/acl/acl_accessing_services_and_applications.html

    I presume internal users are using applications like Spatial  Analyst (which uses the REST mapping and feature services rather than OGC) and where access to tables, layers and maps is managed by permissions.

    To prevent public users attempting to access other APIs, the proxy could allow requests to be sent only to the WFS endpoint (and WMS and WMTS if needed) and not to forward requests to other APIs (such as the REST and SOAP mapping and feature services). Also the user you use for the WFS should not have any permissions on any named resources. That way they would not see any other data even if the API was accessible.





    ------------------------------
    Mustafa Ismail
    Product Architect
    Precisely
    London UK
    ------------------------------