Contents
See Also
While OSDB can use an unprotected HTTP SPARQL endpoint for the Registry, some protection of the Registry might be desirable. To this end, OSDB can use SPARQL over HTTPS. The configuration described below limits access to the SPARQL endpoint, but does not restrict access to the Registry graphs themselves. Any authenticated user granted access to the SPARQL endpoint will have access to these graphs. The graphs remain public within the Virtuoso quad store.
Controlling access to an HTTPS SPARQL endpoint relies on the Virtuoso Authentication Layer (VAL) and its support for WebID and WTD (WebID + TLS + Delegation). The VAL What Why How Guide provides a detailed discussion of VAL and how to configure it. The essential requirements from the perspective of OSDB are:
If, for example, OSDB is started with the command
NODE_ENV=osdb node bin/osdb_server -r https://linkeddata.uriburner.com/sparql
OSDB looks for configuration settings in the file {osdb_root}/config/osdb.json.
In the extract from osdb.json below
{
"serverURL": "https://osdb.openlinksw.com/",
"serverKey": "myServerKey.pem",
"serverCertificate": "myServerCert.pem",
...
"registryHostRdfViewerTemplate" : "/describe/(?url)",
"registryHostRdfViewerWithLoadTemplate" : "/describe/(?url)&sponger:get=add&sr=clean",
"registryCredentials": {
"https://linkeddata.uriburner.com/sparql" : {
"registryLoginKey" : "config/osdb-key.pem",
"registryLoginCertificate" : "config/osdb-crt.pem",
"registryLoginCACertificate" : "",
"registryLoginOnBehalfOf" : ""
}
}
}
the registryCredentials
property holds an object which in turn has one property for each OSDB Registry which may be used with this OSDB Server. In this example, the server was started using registry https://linkeddata.uriburner.com/sparql
. The corresponding entry points to an object with properties:
registryLoginCertificate
will authenticate. (optional - required only if WebID delegation is being used).Because the OSDB Server is the only agent requiring access to the OSDB-related graphs, WebID delegation should not be needed. The directory {osdb_root}/config should contain the identified PEMs.
The certificate identified by registryLoginCertificate
must contain the WebID of the OSDB Server in the certificate’s SAN slot. The WebID must identify a WebID profile document containing the OSDB Server’s public key, as specified by the WebID specification.
A minimal example profile document is listed below:
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
@prefix cert: <http://www.w3.org/ns/auth/cert#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix xml: <http://www.w3.org/2001/XMLSchema#> .
<http://ods-qa.openlinksw.com:8896/DAV/home/nobody/osdb_ex_webid_170727.ttl>
a foaf:PersonalProfileDocument ;
foaf:primaryTopic <http://ods-qa.openlinksw.com:8896/DAV/home/nobody/osdb_ex_webid_170727.ttl#identity> .
<http://ods-qa.openlinksw.com:8896/DAV/home/nobody/osdb_ex_webid_170727.ttl#identity>
a foaf:Agent ;
foaf:name "OSDB Server" ;
cert:key <#keyOSDB> .
<#keyOSDB>
a cert:RSAPublicKey ;
rdfs:label "A self-signed key" ;
cert:exponent "65537"^^xml:integer ;
cert:modulus
"aeb762c..."^^xml:hexBinary .
The last step needed to give the OSDB Server access to the protected registry is to create a suitable VAL ACL rule on the registry server.
SPARQL
PREFIX oplacl: <http://www.openlinksw.com/ontology/acl#>
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
WITH <http://linkeddata.uriburner.com/acl/graph/rules/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm>
INSERT
{
<#OSDBSparql>
a acl:Authorization ;
foaf:maker <http://linkeddata.uriburner.com/dataspace/person/dba#this> ;
oplacl:hasAccessMode oplacl:Read , oplacl:Write ;
acl:accessTo <urn:virtuoso:access:sparql> ;
acl:agent <http://ods-qa.openlinksw.com:8896/DAV/home/nobody/osdb_ex_webid_170727.ttl#identity> ;
oplacl:hasScope oplacl:Query ;
oplacl:hasRealm oplacl:DefaultRealm .
};
The above rule <#OSDBSparql>
grants SPARQL UPDATE access to the OSDB server WebID identified by acl:agent
. Assuming that the Registry server’s VAL configuration has been set up to limit access on http://{OSDB registry host}/sparql
to ‘read only’, SPARQL UPDATE access will be restricted to specific authenticated agents. While public graphs may be readable by all (or not at all, depending on the VAL settings); the ability to create, update or delete public graphs graphs is limited to these agents. These public graphs include the OSDB graphs <http://www.openlinksw.com/osdb/services>
and <http://www.openlinksw.com/osdb/services/{service ID}>
. An attempt by an unauthenticated user to update these graphs results in the user being forced to authenticate.
For more information on how to control access to SPARQL, refer to the VAL guide SPARQL ACLs in Virtuoso.
Further protection of the Registry graphs is potentially possible by making them private. This would require creation of a Virtuoso service, for use by the OSDB server, to make a service description graph private and set its ownership whenever a new service is registered with OSDB.