Security Concepts
Release 9.3.1 E-mail This Topic Printable Version Give Us Feedback

Security Considerations in the Geoportal Extension

This section discusses security concepts that are specific to the Geoportal extension. Overarching security concepts for an enterprise system can be found at the ESRI Enterprise Resource Center security webpage.



The main topics that this section will address are:

Securing Metadata

An organization may want data to be discoverable to certain groups of people, but not discoverable to other groups. Access to metadata records can be configured in the Geoportal by implementing a security policy for metadata access. The access policy chosen by the implementing organization will determine if and how a publisher can restrict access to his/her metadata.



IMPORTANT: Restricting user access to metadata records only restricts who can see the metadata. It does not determine user access to the actual data or web service resource itself.



For more information on securing metadata please see How to Restrict Access to Metadata.

Architecture Configurations

Another way to secure your Geoportal is to manage access through the system architecture. Three models are briefly described below.

Considerations for HTTPS Communications

Hypertext Transfer Protocol - Secure (HTTPS) is a variant of HTTP enhanced by a security mechanism such as an encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection. It allows data sharing to take place on the internet in a protected way.



The article Setting up SSL provides a good introduction to SSL and considerations for setting it up on your system.



Besides general SSL configurations for your organization (see Security Resources for Geoportal System Environment Components), there are no Geoportal-specific configurations required, with the exception of full url references.



For example, if you've configured a Map Viewer application to run from your Geoportal under https, then it needs to be specified correctly within gpt.xml:



mapViewerUrl="https://host:port/mvs_viewer"



Encryption Concepts

This section describes some important concepts for encryption within the Geoportal Extension.

Encrypting Passwords in the gpt.xml file

In the gpt.xml file, there are sections where you can specify if the password is encrypted. When encryption is set to true, an encrypted password can be defined in these sections. To generate an encrypted password for storing passwords in the gpt.xml, follow the steps below:

  1. Open the Geoportal in a browser
  2. Log in as an administrator
  3. Navigate to http://<machineName>/<GeoportalApplicationName>/catalog/identity/encryptPassword.page to display the Password Encryption Utility page
  4. Enter in your admin password into the password box
  5. Click the Encrypt button. The encrypted password appears in the "Encrypted value" box
  6. Copy and paste this value into your gpt.xml file

Change the Encryption Key

In the Manage Repositories page, it is possible to define a connection to another catalog that requires a username and password. To protect the security of these remote catalogs, the Geoportal will not store the password in clear text in its Harvesting tables and configuration files. Instead, the Geoportal will apply an encryption algorithm to store the password. When the Harvesting Tool uses the password information to connect to the repository, it decrypts the password.



Because all Geoportal instances out-of-the-box use the same encryption key, it is important to change the value in the <encKey> section of the gpt.xml file so the encrypted passwords cannot be easily deciphered.

NOTE: If the encryption key is changed at any point, any data already stored in the database that was encrypted with the "old" key will become invalid. In that case, the data will need to be re-generated and re-stored in the database to correspond to the new encryption key. For this reason it is recommended to change the encryption key at the beginning of Geoportal deployment and not change it thereafter.


To Change the Encryption Key:

  1. Open the gpt.xml file from the \\geoportal\WEB-INF\classes\gpt\config folder in a text editor
  2. Scroll to the "<identity" tag, and note the value of 'encKey'
  3. Change this value to a new key. The key can be a simple word
  4. Save the file and close it
  5. Update the system registry for the Harvesting Tool to reference the new encryption key. The registry settings where the key is set are:
    • HKEY_CURRENT_USER\Software\ESRI\Applications\Portal_Harvesting_Tool\Harvester\EncryptionKey
    • HKEY_LOCAL_MACHINE\SOFTWARE\ESRI\Applications\Portal_Harvesting_Tool\Harvester\EncryptionKey

Security Resources for Geoportal Extension System Environment Components

Because the Geoportal extension is deployed in the context of other products upon which it depends, it is important to investigate security recommendations from those other underlying technologies.



Here are some useful documents that can be used for reference: