[Geoserver-users] Data security and authentication?

GeoServer GeoServer User
1

Hi everyone

I have tried and tried this: to put maps belonging to a certain workspace behind a password, but so far without any success.

The idea is that most of the maps are usable WITHOUT any password, but only maps belonging to one workspace need username and password. I have read all the documents.

If I create a user with ROLE_GROUP_ADMIN role, and use data security rule .*.r=ROLE_GROUP_ADMIN, all the workspaces are behind a password despite of the other rules in Data Security.

In Authentication Filter Chains (Request Chain) menu “default” is selected and in selected box on the right “basic” is selected.

With these settings all workspaces are behind a username and password, which is not wanted.

So, could anyone help me with this mess? I am an advanced IT person, but I cannot solve this problem, although I have read all the documents. I have not found a single working example on the net.

Oiva

2

Hi Ovia

This is not possible with GeoServer 2.2.x series, try the 2.3-beta1 or a nightly build.

Starting with 2.3, you can add and rearrange filter chains. There are 2 possibilities to access a workspace

1) http://…/geoserver/wfs?request=getcapabilities&workspace=<myWorkspace>

or

2) http://…/geoserver/<myWorkspace>/wfs?request=getcapabilities

Version 2) is covered by filter chain mapping. You have to add a chain with a list of Ant patterns covering your public chains. (/myworkspace/wfs/**,....).
Put the anonymous filter on this chain.

On the default chain (/**) you have to put a real authentication filter (basic,digest,...). The default chain has to be the last in the list.

Hope that helps

PS: There is no documentation at this point in time.

Christian

Zitat von "Hakala Oiva (MTT)" <oiva.hakala@anonymised.com>:

Hi everyone

I have tried and tried this: to put maps belonging to a certain workspace behind a password, but so far without any success.

The idea is that most of the maps are usable WITHOUT any password, but only maps belonging to one workspace need username and password. I have read all the documents.

If I create a user with ROLE_GROUP_ADMIN role, and use data security rule <workspace>.*.r=ROLE_GROUP_ADMIN, all the workspaces are behind a password despite of the other rules in Data Security.

In Authentication Filter Chains (Request Chain) menu "default" is selected and in selected box on the right "basic" is selected.

With these settings all workspaces are behind a username and password, which is not wanted.

So, could anyone help me with this mess? I am an advanced IT person, but I cannot solve this problem, although I have read all the documents. I have not found a single working example on the net.

Oiva

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

3

On Mon, Jan 28, 2013 at 1:07 PM, Hakala Oiva (MTT) <oiva.hakala@anonymised.com83…> wrote:

Hi everyone

I have tried and tried this: to put maps belonging to a certain workspace behind a password, but so far without any success.

The idea is that most of the maps are usable WITHOUT any password, but only maps belonging to one workspace need username and password. I have read all the documents.

If I create a user with ROLE_GROUP_ADMIN role, and use data security rule .*.r=ROLE_GROUP_ADMIN, all the workspaces are behind a password despite of the other rules in Data Security.

If this one is not working, then we have a regression in the data security subsystem, as this used to work just fine

Cheers
Andrea

–

==
Our support, Your Success! Visit http://opensdi.geo-solutions.it for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

4

Oiva,

I'll explain what I did and maybe that will help you?

I have two workspaces, State & Download. One is for the state to WFS our
data and the other is for the public. I made a role called "user". I then
made a user named "state" I gave the "state" username the "user" role. I
then went to data security and deleted the default "r" rule. I created two
new rules. One uses the workspace "State" and only allows the role "User" to
access this. The other uses the workspace "Download" and allows anonymous
to access. This ensures the state layers only show up to the state user
logged in. On the anonymous workspace, I took off the role authenticated so
logged in users don't see it.

I attached a picture of my data security page. Hope this helps.

<http://osgeo-org.1560.n6.nabble.com/file/n5030302/geoserver.jpg&gt;

--
View this message in context: http://osgeo-org.1560.n6.nabble.com/Data-security-and-authentication-tp5030267p5030302.html
Sent from the GeoServer - User mailing list archive at Nabble.com.