Data spaces in FROST

To configure the data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it. model of the platform in the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles., we group the key entities of the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. SensorThings model, e.g. things, into projects. To define the user's access to the entities within each project, users are assigned to project-specific roles. This ensures that data access and manipulation are tightly controlled through role-based permissions, allowing users to interact only with the entities relevant to data spacesData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it. (i.e., projects) they have access to.

How the Platform's Data space Concept Maps to the FROST-Server

For each Project in the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles., users are assigned UserProjectRolesUserProjectRoleIn FROST-Server, the assignment of a role to a user within a specific project. It governs the ability of the user to read, write, or manage the sensor data and related entities of that project. that define their access to sensors, data streams, and observations in the corresponding project (i.e., data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it.).

• User: A person or system entity that accesses FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. to manage FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. entities. Users are assigned global and data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it.-specific roles that define what actions they can perform within a data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it..
• Project: A project represents a data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it. and serves as a grouping mechanism for all FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. entities. Users must be assigned specific roles within a project to access and manipulate linked entities (see UserProjectRoleUserProjectRoleIn FROST-Server, the assignment of a role to a user within a specific project. It governs the ability of the user to read, write, or manage the sensor data and related entities of that project.).
• Roles: Roles define a user's global permissions (CRUD) independently from projects/data spacesData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it.. For example, the read role grants global read permissions, allowing the user to read all FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. entities (e.g. Thing, Observation) in all projects.
• UserProjectRoleUserProjectRoleIn FROST-Server, the assignment of a role to a user within a specific project. It governs the ability of the user to read, write, or manage the sensor data and related entities of that project.: UserProjectRoleUserProjectRoleIn FROST-Server, the assignment of a role to a user within a specific project. It governs the ability of the user to read, write, or manage the sensor data and related entities of that project. allows assigning a user a specific role within a specific project (data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it.), governing their ability to read, write, or manage sensor data streams and related entities in the project.
• FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. Entities: Core data objects in the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. consist of Things, Sensors, DataStreams, Observations, FeaturesOfInterest, Locations, HistoricalLocations, and ObservedProperties. These elements form the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. SensorThings model, which is part of the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles..

Example for Keycloak and the FROST-Server

The following settings describe the data spacesData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it. named "baumkataster" and "denkmalschutz" defined in KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles. and the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles.:

• KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles. client "api-access":
  • Roles for data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it. "baumkataster": baumkataster__read, baumkataster__create, baumkataster__update, baumkataster__delete
  • Roles for data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it. "denkmalschutz": denkmalschutz__read, denkmalschutz__create, denkmalschutz__update, denkmalschutz__delete
• KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles. client scopes "api:read", "api:write" and "api:delete":
  • In the scope "api:read", all read roles (baumkataster__read, denkmalschutz__read) are added under the Scope section
  • In the scope "api:write", all write roles (baumkataster__create, baumkataster__update, denkmalschutz__create, denkmalschutz__update) are added under the Scope section
  • In the scope "api:delete", all delete roles (baumkataster__delete, denkmalschutz__delete) are added under the Scope section
• KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles. user "Max Mustermann" (max@mustermann.de)
  • User-Role-Assignments: baumkataster__read, denkmalschutz__read, denkmalschutz__create
• FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. projects: baumkataster, denkmalschutz
• FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. global roles: read, create, update, delete, admin (default roles, always existing)

If Max requests a resource from the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. and therefore logs into the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. (via the KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles.),

• KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles. sends an access_token: (user: max@mustermann.de, roles: [baumkataster__read, denkmalschutz__read, denkmalschutz__create])
• The FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. creates a User: max@mustermann.de (if not already existing)
• The FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. creates three UserProjectRolesUserProjectRoleIn FROST-Server, the assignment of a role to a user within a specific project. It governs the ability of the user to read, write, or manage the sensor data and related entities of that project.: (max@mustermann.de, baumkataster, read), (max@mustermann.de, denkmalschutz, read), (max@mustermann.de, denkmalschutz, create)
• The FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. checks the concrete HTTP request with the created UserProjectRolesUserProjectRoleIn FROST-Server, the assignment of a role to a user within a specific project. It governs the ability of the user to read, write, or manage the sensor data and related entities of that project..

Mapping illustrated

The mapping between platform components and the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles.'s data model is illustrated in the diagram below, using colors to represent corresponding objects.

Setting Up Data spaces in the FROST-Server

Based on the roles assigned in KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles., global and project-specific roles are created in the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles.. These roles define the user's permissions within the data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it., enabling them to interact with the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles. Entities associated with the project (data spaceData spaceA thematic area that contains specific data and resources in different platform components. Data is stored in exactly one data space, and access rights are specific to each data space. Roles within a data space control what users and groups can do in it.).

For more information about how to administer the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles., please refer to the Admin Guide.