[Geoserver-users] GWC and By-Layer security

GeoServer GeoServer User
1

Hi again,

I just wanted to check (from my testing this looks to be true):

If you make a vector layer secure using the by-layer security, then attempt to use GWC to cache PNGs of this layer, it doesn’t seem to work, nothing gets cached.

True?

Thanks,
Roger

2

Roger Bedell ha scritto:

Hi again,
I just wanted to check (from my testing this looks to be true):
If you make a vector layer secure using the by-layer security, then attempt to use GWC to cache PNGs of this layer, it doesn't seem to work, nothing gets cached.
True?

Most likely. Security is enforced down at the data access level,
there is no skipping around it. GWC would need to authenticate
itself just like everything else (with proper credentials of
course).

Cheers
Andrea

--
Andrea Aime
OpenGeo - http://opengeo.org
Expert service straight from the developers.

3

Andrea Aime wrote:

Roger Bedell ha scritto:
  

Hi again,
I just wanted to check (from my testing this looks to be true):
If you make a vector layer secure using the by-layer security, then attempt to use GWC to cache PNGs of this layer, it doesn't seem to work, nothing gets cached.
True?
    
Most likely. Security is enforced down at the data access level,
there is no skipping around it. GWC would need to authenticate
itself just like everything else (with proper credentials of
course).

Cheers
Andrea
  

Taking that one inch further: GWC does not have a security framework at this time, so if we enabled GWC to bypass this then the security would be mute.

-Arne

--
Arne Kepp
OpenGeo - http://opengeo.org
Expert service straight from the developers

4

Thanks,
That is what I thought. It might be nice at some point to have this added to
GWC, in particular for sensitive imagery layers.

Or perhaps, as possibly an
easier solution, to use the cache seeder to fill it, then Geoserver acts as
a gatekeeper to allow access to the cached layer or not?

I've determined that
even filling the cache doesn't allow a GWC secure layer to be displayed.

Roger

--------------------------------------------------
From: "Arne Kepp" <ak@anonymised.com>
Sent: Tuesday, April 21, 2009 4:11 PM
Cc: "Roger Bedell" <roger@anonymised.com>;
<geoserver-users@lists.sourceforge.net>
Subject: Re: [Geoserver-users] GWC and By-Layer security

Andrea Aime wrote:

Roger Bedell ha scritto:

Hi again,
I just wanted to check (from my testing this looks to be true):
If you make a vector layer secure using the by-layer security, then
attempt to use GWC to cache PNGs of this layer, it doesn't seem to work,
nothing gets cached.
True?

Most likely. Security is enforced down at the data access level,
there is no skipping around it. GWC would need to authenticate
itself just like everything else (with proper credentials of
course).

Cheers
Andrea

Taking that one inch further: GWC does not have a security framework at
this time, so if we enabled GWC to bypass this then the security would be
mute.

-Arne

--
Arne Kepp
OpenGeo - http://opengeo.org
Expert service straight from the developers

5

Doable in GeoServer 2.0 if someone funds it, but it doesnt apply cleanly to composite layers and WFS is a separate story.

It would be *really* cool to have a cascading filtering system, sort of like IPTables with authorization plugged in... but making a GUI for that would be hell.

-Arne

Roger Bedell wrote:

Thanks,
That is what I thought. It might be nice at some point to have this added to
GWC, in particular for sensitive imagery layers.

Or perhaps, as possibly an
easier solution, to use the cache seeder to fill it, then Geoserver acts as
a gatekeeper to allow access to the cached layer or not?

I've determined that
even filling the cache doesn't allow a GWC secure layer to be displayed.

Roger

--------------------------------------------------
From: "Arne Kepp" <ak@anonymised.com>
Sent: Tuesday, April 21, 2009 4:11 PM
Cc: "Roger Bedell" <roger@anonymised.com>;
<geoserver-users@lists.sourceforge.net>
Subject: Re: [Geoserver-users] GWC and By-Layer security

Andrea Aime wrote:
    

Roger Bedell ha scritto:

Hi again,
I just wanted to check (from my testing this looks to be true):
If you make a vector layer secure using the by-layer security, then
attempt to use GWC to cache PNGs of this layer, it doesn't seem to work,
nothing gets cached.
True?

Most likely. Security is enforced down at the data access level,
there is no skipping around it. GWC would need to authenticate
itself just like everything else (with proper credentials of
course).

Cheers
Andrea

Taking that one inch further: GWC does not have a security framework at
this time, so if we enabled GWC to bypass this then the security would be
mute.

-Arne

--
Arne Kepp
OpenGeo - http://opengeo.org
Expert service straight from the developers

------------------------------------------------------------------------------
Stay on top of everything new and different, both inside and around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today. Use priority code J9JMT32. http://p.sf.net/sfu/p
_______________________________________________
Geoserver-users mailing list
Geoserver-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-users
  
--
Arne Kepp
OpenGeo - http://opengeo.org
Expert service straight from the developers

6

There is some work on security as GSOC 2009 project.
http://geoserver.org/display/GEOS/GeoXACML-Integration

Perhaps we find a solution for this

Arne Kepp writes:

Doable in GeoServer 2.0 if someone funds it, but it doesnt apply cleanly to composite layers and WFS is a separate story.

It would be *really* cool to have a cascading filtering system, sort of like IPTables with authorization plugged in... but making a GUI for that would be hell.

-Arne

Roger Bedell wrote:

Thanks,
That is what I thought. It might be nice at some point to have this added to
GWC, in particular for sensitive imagery layers.

Or perhaps, as possibly an
easier solution, to use the cache seeder to fill it, then Geoserver acts as
a gatekeeper to allow access to the cached layer or not?

I've determined that
even filling the cache doesn't allow a GWC secure layer to be displayed.

Roger

--------------------------------------------------
From: "Arne Kepp" <ak@anonymised.com>
Sent: Tuesday, April 21, 2009 4:11 PM
Cc: "Roger Bedell" <roger@anonymised.com>;
<geoserver-users@lists.sourceforge.net>
Subject: Re: [Geoserver-users] GWC and By-Layer security

Andrea Aime wrote:
    

Roger Bedell ha scritto:

Hi again,
I just wanted to check (from my testing this looks to be true):
If you make a vector layer secure using the by-layer security, then
attempt to use GWC to cache PNGs of this layer, it doesn't seem to work,
nothing gets cached.
True?

Most likely. Security is enforced down at the data access level,
there is no skipping around it. GWC would need to authenticate
itself just like everything else (with proper credentials of
course).

Cheers
Andrea

Taking that one inch further: GWC does not have a security framework at
this time, so if we enabled GWC to bypass this then the security would be
mute.

-Arne

--
Arne Kepp
OpenGeo - http://opengeo.org
Expert service straight from the developers

------------------------------------------------------------------------------
Stay on top of everything new and different, both inside and around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today. Use priority code J9JMT32. http://p.sf.net/sfu/p
_______________________________________________
Geoserver-users mailing list
Geoserver-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-users
  
--
Arne Kepp
OpenGeo - http://opengeo.org
Expert service straight from the developers

------------------------------------------------------------------------------
Stay on top of everything new and different, both inside and around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today. Use priority code J9JMT32. http://p.sf.net/sfu/p
_______________________________________________
Geoserver-users mailing list
Geoserver-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-users