Hello,
I’m currently working on Geoserver in order to add some advance features in rights management. I have added a DataAccessManager in SecureCatalog but the problem is when I change the box in layer’s resources,although the getCapabilities become compliant with the rights, the layer is still available outside the restricted area…
What can I do in order to block informations outside the envelope? (For the moment, I use AOP and I intercept getMap in DefaultWebMapService to check the request’s validity, nevertheless I have to create an interceptor for each service and, in my opinion, it’s weird. Furthermore, GetMapResponse is not an interface so…).
Thank you for your time
Fabien Cellier
Ce message et les pièces jointes sont confidentiels et réservés à l’usage exclusif de ses destinataires. Il peut également être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d’en avertir immédiatement l’expéditeur et de le détruire. L’intégrité du message ne pouvant être assurée sur Internet, la responsabilité du groupe Atos Origin ne pourra être recherchée quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l’expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d’un virus transmis.
This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Atos Origin group liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.
Ciao Fabien,
I am resurrecting this thread since Luca, who is cc'ed, might be
interested in helping you out.
Simone.
-------------------------------------------------------
Ing. Simone Giannecchini
GeoSolutions S.A.S.
Owner - Software Engineer
Via Carignoni 51
55041 Camaiore (LU)
Italy
phone: +39 0584983027
fax: +39 0584983027
mob: +39 333 8128928
http://www.geo-solutions.it
http://simboss.blogspot.com/
http://www.linkedin.com/in/simonegiannecchini
-------------------------------------------------------
On Mon, Mar 16, 2009 at 4:50 PM, Cellier Fabien
<fabien.cellier@anonymised.com> wrote:
Hello,
I'm currently working on Geoserver in order to add some advance features in
rights management. I have added a DataAccessManager in SecureCatalog but the
problem is when I change the box in layer's resources,although the
getCapabilities become compliant with the rights, the layer is still
available outside the restricted area...
What can I do in order to block informations outside the envelope? (For the
moment, I use AOP and I intercept getMap in DefaultWebMapService to check
the request's validity, nevertheless I have to create an interceptor for
each service and, in my opinion, it's weird. Furthermore, GetMapResponse is
not an interface so...).
Thank you for your time
Fabien Cellier
________________________________
Ce message et les pièces jointes sont confidentiels et réservés à l'usage
exclusif de ses destinataires. Il peut également être protégé par le secret
professionnel. Si vous recevez ce message par erreur, merci d'en avertir
immédiatement l'expéditeur et de le détruire. L'intégrité du message ne
pouvant être assurée sur Internet, la responsabilité du groupe Atos Origin
ne pourra être recherchée quant au contenu de ce message. Bien que les
meilleurs efforts soient faits pour maintenir cette transmission exempte de
tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa
responsabilité ne saurait être recherchée pour tout dommage résultant d'un
virus transmis.
This e-mail and the documents attached are confidential and intended solely
for the addressee; it may also be privileged. If you receive this e-mail in
error, please notify the sender immediately and destroy it. As its integrity
cannot be secured on the Internet, the Atos Origin group liability cannot be
triggered for the message content. Although the sender endeavours to
maintain a computer virus-free network, the sender does not warrant that
this transmission is virus-free and will not be liable for any damages
resulting from any virus transmitted.
------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Geoserver-devel mailing list
Geoserver-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel
Hello Luca,
(NB: sorry for my English, I’m bad in foreign languages 
>I've gathered the security module of GS implements layer (and namespace)
>security, which is great... even greater would be to allow users to read only data within
>a certain bounding box:
```
First, be careful if you want change bbox in getCapabilities with the org.geoserver.security.DataAccessManager, multithreading cause some trouble (I was wrong in my mail :)
```
> how difficult would it be to implement such a check ?
It’s depend on what you want. If it’s just blocking request which are not in a certain boundingbox for a certain user, it’s very easy thanks acegi,spring and the org.geoserver.ows.security.OperationInterceptor (if you want know how it’s works, you can read org.geoserver.ows.Dispatcher#execute in ows module).
Nevertheless, if you want rewrite response (for example having picture with information only in the permitted Bbox), it’s harder, you have to rewrite a part of response’s writer (perhaps another solution exist but I haven’t found it :()
>It might be interesting to get that code, review it and commit it.
I’m sorry, but I’m speaking with my manager in order to know what part of the geoRm I wrote can be opened …
Regards,
Fabien
fabien cellier <fabien.cellier@anonymised.com> writes:
It's depend on what you want. If it's just blocking request which are
not in a certain boundingbox for a certain user, it's very easy thanks
acegi,spring and the
org.geoserver.ows.security.OperationInterceptor (if you want know how
it's works, you can read org.geoserver.ows.Dispatcher#execute in ows
module).
Great ! Thanks.
Nevertheless, if you want rewrite response (for example having picture
with information only in the permitted Bbox), it's harder, you have to
rewrite a part of response's writer (perhaps another solution exist but
I haven't found it :()
That would be nice too... but not a must on the project I am working on.
Could you share the details on how you extended the security configuration files
to put in them the info about the allowed bbox ?
Regards,