Hi James, et al:
The TDS currently uses Tomcat-based authentication/authorization. HTTP
basic, digest, form or HTTPS is supported. Unless you are using session
cookies, you have to authenticate every request. I think the standard
dods clients do not support session cookies ( I have a hacked version of
the java dods client that does).
Tomcat requires that you specify the restricted URLs in the web.xml
file. For simple cases, this is not too hard, but for complicated sites,
not a good solution. Id like to specify access control in the TDS
catalog, allowing it down to dataset granularity. I hope to get that
working soon, but im not sure how easy it will be.
Some of my uncertainty is about what dods clients can/should do. I think
the C client library will translate URLS with http://login:passwd@url
in them, or maybe thats being done at the server ?? But the java client
library doesnt handle that ?? Anyway, im confused about what the
constraints are from the dods clients.
Ethan Davis wrote:
Hi James,
Currently, the TDS doesn't do any authentication/authorization for
data access. But it is in the plans. John would have a better idea of
the time line for that than I. (Actually, I may be overstating this.
You may be able to set it up to do authentication/authorization for
data access but only on a server-wide level, or at least the user
would have to do all the mucking around with Tomcat. Sorry for the
flip-flopping. Now that I think about it more it turns out I'm just
not that sure. John would know better and should be around on Monday.)
The TDS does do authentication/authorization (a la Tomcat) for server
configuration and such. If you want more details, see the "Remote
Management" and "Security" links from our TDS docs page
http://motherlode.ucar.edu:8080/thredds/docs/.
Ethan
James Gallagher wrote:
Folks,
I'm hacking together a document of 'Best Practices' about DAP servers
and I was wondering what sort of username/password protection GDS,
FDS and TDS supply? I sort of know what a servlet engine like Tomcat
5.5 can do (although I'm nowhere near an expert on it).
There's sort of a short time line on this; I need to get my text to
Dan soon but I should have a chance to hack in some changes until
Tuesday.
Thanks,
James
--
James Gallagher jgallagher at opendap.org
OPeNDAP, Inc 406.723.8663
