diff --git a/ontology/wotsec.html b/ontology/wotsec.html index 93db6052..1cf87290 100644 --- a/ontology/wotsec.html +++ b/ontology/wotsec.html @@ -48,15 +48,15 @@

Introduction

SecurityScheme

IRI: https://www.w3.org/2019/wot/security#SecurityScheme

Metadata describing the configuration of a security mechanism. The value assigned to the name scheme MUST be defined within a Vocabulary included in the Thing Description, either in the standard Vocabulary defined in § 5. TD Information Model or in a TD Context Extension.

For all security schemes, any keys, passwords, or other sensitive information directly providing access MUST NOT be stored in the TD and should instead be shared and stored out-of-band via other mechanisms. The purpose of a TD is to describe how to access a Thing if and only if a Consumer already has authorization, and is not meant be used to grant that authorization.

Each security scheme object used in a TD defines a set of requirements to be met before access can be granted. We say a security scheme is satisfied when all its requirements are met. In some cases requirements from multiple security schemes will have to be met before access can be granted.

Security schemes generally may require additional authentication parameters, such as a password or key. The location of this information is indicated by the value associated with the name in, often in combination with the value associated with name. The in name can take one of the following values:

header:
The parameter will be given in a header provided by the protocol, with the name of the header provided by the value of name.
query:
The parameter will be appended to the URI as a query parameter, with the name of the query parameter provided by name.
body:
The parameter will be provided in the body of the request payload, with the data schema element used provided by name. When used in the context of a body security information location, the value of name MUST be in the form of a JSON pointer [[!RFC6901]] relative to the root of the input DataSchema for each interaction it is used with. Since this value is not a fragment identifier, and is not relative to the root of the TD but to whichever data schemas the security scheme is bound to, this value should not start with "#"; it is a "pure" JSON pointer. Since this value is not a fragment identifier, it also does not need to URL-encode special characters. The targeted element may or may not already exist at the specified location in the referenced data schema. If it does not, it will be inserted. This avoids having to duplicate definitions in the data schemas of every interaction. When an element of a data schema indicated by a JSON pointer indicated in a body locator does not already exist in the indicated schema, it MUST be possible to insert the indicated element at the location indicated by the pointer.. For example, pointing to a key of a Map where that key does not exist in the corresponding Data Schema, the key and its value, which is the credential, would be inserted to the Map at the specified location during the operation execution. On the other hand, pointing to an Array's item with a number as the item index, that number should be outside the range of the Array's already specified items in order to not alter the strict sequence of items. The JSON pointer used in the body locator MAY use the "-" character to indicate a non-existent array element when it is necessary to insert an element after the last element of an existing array. The element referenced (or created) by a body security information location MUST be required and of type "string". If name is not given, it is assumed the entire body is to be used as the security parameter.
cookie:
The parameter is stored in a cookie identified by the value of name.
uri:
The parameter is embedded in the URI itself, which is encoded in the relevant interaction using a URI template variable defined by the value of name. This is more general than the query mechanism but more complex. The value uri SHOULD be specified for in in a security scheme only if query is not applicable. The URIs provided in interactions where a security scheme using uri MUST be a URI template including the defined variable.
auto:
The location is determined as part of the protocol, or negotiated. If a value of auto is set for the in field of a SecurityScheme, then the name field SHOULD NOT be set. In this case, the application of the SecurityScheme is subject to the respective specification for the given protocol (e.g. [[!RFC8288]] when using the BasicSecurityScheme with HTTP).
If multiple parameters are needed for a security scheme, repeat the security scheme definition for each parameter and combine them using a combo security scheme and allOf. In some cases parameters may not actually be secret but a user may wish to leave them out of the TD to help protect privacy. As an example of this, some security mechanisms require both a client identifier and a secret key. In theory, the client identifier is public however it may be hard to update and pose a tracking risk. In such a case it can be provided as an additional security parameter so it does not appear in the TD.

The names of URI variables declared in a SecurityScheme MUST be distinct from all other URI variables declared in the TD.

Super-class ofwotsec:APIKeySecurityScheme
wotsec:AutoSecurityScheme
wotsec:BasicSecurityScheme
wotsec:BearerSecurityScheme
wotsec:ComboSecurityScheme
wotsec:DigestSecurityScheme
wotsec:NoSecurityScheme
wotsec:OAuth2SecurityScheme
wotsec:PSKSecurityScheme
In the domain ofwotsec:proxy
td:description
td:descriptionInLanguage
td:hasConfigurationInstance

Object Properties

allOf

IRI: https://www.w3.org/2019/wot/security#allOf

Array of two or more strings identifying other named security scheme definitions, all of which must be satisfied for access.
Domain includeswotsec:ComboSecurityScheme

authorization

IRI: https://www.w3.org/2019/wot/security#authorization

URI of the authorization server.
Domain includeswotsec:BearerSecurityScheme
wotsec:OAuth2SecurityScheme

oneOf

IRI: https://www.w3.org/2019/wot/security#oneOf

Array of two or more strings identifying other named security scheme definitions, any one of which, when satisfied, will allow access. Only one may be chosen for use.
Domain includeswotsec:ComboSecurityScheme
-

proxy

IRI: https://www.w3.org/2019/wot/security#proxy

URI of the proxy server this security configuration provides access to. If not given, the corresponding security configuration is for the endpoint.
This feature is at risk.
Domain includeswotsec:SecurityScheme

refresh

IRI: https://www.w3.org/2019/wot/security#refresh

URI of the refresh server.
Domain includeswotsec:OAuth2SecurityScheme

token

IRI: https://www.w3.org/2019/wot/security#token

URI of the token server.
Domain includeswotsec:OAuth2SecurityScheme

Datatype Properties

alg

IRI: https://www.w3.org/2019/wot/security#alg

Encoding, encryption, or digest algorithm.
Domain includeswotsec:BearerSecurityScheme

in

IRI: https://www.w3.org/2019/wot/security#apikeyIn

Specifies the location of security authentication information.
Domain includeswotsec:APIKeySecurityScheme

flow

IRI: https://www.w3.org/2019/wot/security#flow

Authorization flow.
Domain includeswotsec:OAuth2SecurityScheme

format

IRI: https://www.w3.org/2019/wot/security#format

Specifies format of security authentication information.
Domain includeswotsec:BearerSecurityScheme

identity

IRI: https://www.w3.org/2019/wot/security#identity

Identifier providing information which can be used for selection or confirmation.
Domain includeswotsec:PSKSecurityScheme
-

in

IRI: https://www.w3.org/2019/wot/security#in

Specifies the location of security authentication information.
Domain includeswotsec:BasicSecurityScheme
wotsec:BearerSecurityScheme
wotsec:DigestSecurityScheme
-

name

IRI: https://www.w3.org/2019/wot/security#name

Name for query, header, cookie, or uri parameters.
Domain includeswotsec:APIKeySecurityScheme
wotsec:BasicSecurityScheme
wotsec:BearerSecurityScheme
wotsec:DigestSecurityScheme
+

in

IRI: https://www.w3.org/2019/wot/security#in

Specifies the location of security authentication information.
Domain includeswotsec:BasicSecurityScheme
wotsec:BearerSecurityScheme
wotsec:DigestSecurityScheme
wotsec:PoPSecurityScheme
+

name

IRI: https://www.w3.org/2019/wot/security#name

Name for query, header, cookie, or uri parameters.
Domain includeswotsec:APIKeySecurityScheme
wotsec:BasicSecurityScheme
wotsec:BearerSecurityScheme
wotsec:DigestSecurityScheme
wotsec:PoPSecurityScheme
+

proxy

IRI: https://www.w3.org/2019/wot/security#proxy

URI of the proxy server this security configuration provides access to. If not given, the corresponding security configuration is for the endpoint.
This feature is at risk.
Domain includeswotsec:SecurityScheme
Range includes

qop

IRI: https://www.w3.org/2019/wot/security#qop

Quality of protection.
This feature is at risk.
Domain includeswotsec:DigestSecurityScheme

scopes

IRI: https://www.w3.org/2019/wot/security#scopes

Set of authorization scope identifiers provided as an array. These are provided in tokens returned by an authorization server and associated with forms in order to identify what resources a client may access and how. The values associated with a form should be chosen from those defined in an OAuth2SecurityScheme active on that form.
This feature is at risk.
Domain includeswotsec:OAuth2SecurityScheme

Annotation Properties

No AnnotationProperty found in the ontology.

diff --git a/ontology/wotsec.ttl b/ontology/wotsec.ttl index 820951ca..0237f1da 100644 --- a/ontology/wotsec.ttl +++ b/ontology/wotsec.ttl @@ -68,10 +68,11 @@ rdfs:comment "Set of authorization scope identifiers provided as an array. These are provided in tokens returned by an authorization server and associated with forms in order to identify what resources a client may access and how. The values associated with a form should be chosen from those defined in an OAuth2SecurityScheme active on that form.
This feature is at risk."@en ; schema:domainIncludes :OAuth2SecurityScheme . -:proxy rdf:type owl:ObjectProperty ; +:proxy rdf:type owl:DatatypeProperty ; rdfs:label "proxy" ; rdfs:comment "URI of the proxy server this security configuration provides access to. If not given, the corresponding security configuration is for the endpoint.
This feature is at risk."@en ; - schema:domainIncludes :SecurityScheme . + schema:domainIncludes :SecurityScheme ; + schema:rangeIncludes xsd:anyURI . :authorization rdf:type owl:ObjectProperty ; rdfs:label "authorization" ;