[Opendap-tech] OPeNDAP authentication

[Patrick West]

On Aug 28, 2009, at 11:06 AM, John Caron wrote:

> Patrick West wrote:
>> OPeNDAP/G (Gridded OPeNDAP) currently does not support X509  
>> certificates or authentication. The BES does currently support X509  
>> authentication during connection using SSL. And we are currently  
>> developing modifications in the BES to allow for secure connections  
>> and secure requests to be sent to the BES, allowing clients to pass  
>> along security certificates and store them in the BES to be used on  
>> behalf of the client for authorization purposes. This will be  
>> especially useful in a gridded environment or where the BES is  
>> working in paralellel with other BES processes to handle requests.  
>> A module can be written and dynamically loaded into the BES to  
>> handle authorization. There is no generic authorization in the BES.
>> I personally haven't tried it, but since the front-end of Hyrax is  
>> a tomcat servlet that you can utilize any authentication within  
>> tomcat, as is mentioned in another email.
>> To my knowledge, the only client of the BES that supports SSL  
>> authentication is the bescmdln (BES Command Line) client, which is  
>> mostly a testing client. We are developing a Globus module for the  
>> Earth System Grid project that will use the BES authentication.
>> The CEDAR project at UCAR developed a BES plugin to handle simple  
>> user authentication, as well as additional response types and a  
>> reporting mechanism for data usage tracking.
>> Patrick West
>> Rensselaer Polytechnic Institute
>> Tetherless World Constellation
>> http://tw.rpi.edu
>
> Hi Patrick:
>
> Could you explain the relationship of a "BES client" vs an "OPeNDAP  
> client" ? Is this the same?

An OPeNDAP client, in the typical example, sends a OPeNDAP URL to a  
OPeNDAP server. This is the case with the old Server 3 system (CGI) as  
well as the new Server 4 (Hyrax), where the OLFS acts as the front-end  
of the Hyrax server. A browser is a client of the OLFS, or the Matlab  
client, or idl-client, etc... These clients communicate with the OLFS  
using an OPeNDAP URL. The OLFS takes that URL and builds an XML  
request document that is then passed to the BES for processing. The  
OLFS is a client of the BES, in a sense.

A client of the BES communicates with the BES using a OPeNDAP XML  
request document instead of a OPeNDAP URL.

Patrick