Support for API keys via query

[heidivanparys]

The test suite does not seem to take into account that the API may have implemented security by means of an API key via a query.

E.g. the Oceanographic Observation API by the Danish Meteorological Institute:

• landing page: https://dmigw.govcloud.dk/v2/oceanObs/
• service description: https://confluence.govcloud.dk/pages/viewpage.action?pageId=41716220
• see https://confluence.govcloud.dk/pages/viewpage.action?pageId=26476690 for how to create a user and get an API key

When testing this API, it says that no conformance classes could be found, although they are present. It seems to be a matter of:

• constructing the path correct (query parameter always at the end)
• updating the "matching" functionality, so query parameters are not taken into account

[dstenger]

When I construct the path manually https://dmigw.govcloud.dk/v2/oceanObs/conformance, I get a 403 status code as response.
Thus, it seems that the API key is missing.

Currently, this test suite/ TEAM Engine are not supporting an API key.
If I understand you correctly, there must be an user input field to pass a valid API key to the test suite?

[heidivanparys]

If I understand you correctly, there must be an user input field to pass a valid API key to the test suite?

I don't know what the best way to handle this would be. And I don't know how many other security schemes the ETS is reasonably should be able to handle (@cportele is that a discussion for the SWG?).

What I did so far, is supply the API key as part of the IUT:

So in the same way as I do in QGIS (3.16 or higher, see qgis/QGIS#38436 and qgis/QGIS#38738):

[dstenger]

Thank you for your input. We will discuss this in the CITE team.

[cportele]

@cportele is that a discussion for the SWG?

It would be nice to have examples for typical cases of security schemes - not as part of the standard, but separately, e.g. in the Guide. If someone would provide a draft I am sure the SWG would look at it and see how this could be published.

[ghobona]

Support for API keys is not currently supported by the ETS. However, @securedimensions recently guided the security aspects of the September 2020 OGC API code sprint. He might know of examples of implementations of different security schemes in OGC APIs.

Support for security schemes is something that we would like to support in TEAM Engine.

[ghobona]

A solution to this issue could also be applied to opengeospatial/ets-ogcapi-processes10#47

That is, if the solution supports authentication through query parameters and headers.