I’m running Geoserver 1.7.2 on Tomcat 6. I would like to require a login for any requests that involve editing my feature data. WMS (read-only) access would be unrestricted.
I would like to use Tomcat’s security, since I’m already using that for a related web application. I’m planning on leaving Geoserver’s Acegi security turned on for the Geoserver web console.
The way I’m doing this is requiring authentication for any URLs matching the pattern /wfs or /ows. Are there any other patterns I need to worry about for people editing the feature data?
I’m running Geoserver 1.7.2 on Tomcat 6. I would like to require a login for any requests that involve editing my feature data. WMS (read-only) access would be unrestricted.
I would like to use Tomcat’s security, since I’m already using that for a related web application. I’m planning on leaving Geoserver’s Acegi security turned on for the Geoserver web console.
The way I’m doing this is requiring authentication for any URLs matching the pattern /wfs or /ows. Are there any other patterns I need to worry about for people editing the feature data?
Not really, but all the wfs,ows,wms paths actually do the same thing
as far as I remember, so if you don't lock down the wms one people
will still be able to make wfs requests on it.
Better use GeoServer custom service level security instead: http://geoserver.org/display/GEOSDOC/2.6+Security+subsystem
Cheers
Andrea
--
Andrea Aime
OpenGeo - http://opengeo.org
Expert service straight from the developers.