[Geoserver-users] Issue with WPS request when using data security

Hello all,

I’m having an issue with performing a WPS request against a layer that has been secured by an entry in the layers.properties file.

After adding a new rule for sf:roads through the web admin Data Security page my layers.properties file looks like this:

#Fri Feb 15 18:01:43 NZDT 2013
..r=*
..w=*
sf.roads.r=ROLE_AUTHENTICATED
mode=HIDE

Next I go to Demos > WPS request builder in the web admin, choose “gs:Count” process, select the “sf:roads” feature, and click Execute. The response is:

<?xml version="1.0" encoding="UTF-8"?>

<wps:ExecuteResponse xml:lang=“en” service=“WPS” serviceInstance=“http://localhost:8080/geoserver/ows?” version=“1.0.0” xmlns:wps=“http://www.opengis.net/wps/1.0.0” xmlns:ows=“http://www.opengis.net/ows/1.1” xmlns:xlink=“http://www.w3.org/1999/xlink”><wps:Process wps:processVersion=“1.0.0”>ows:Identifiergs:Count</ows:Identifier>ows:TitleCount Features</ows:Title>ows:AbstractComputes the number of features in a feature collection.</ows:Abstract></wps:Process><wps:Status creationTime=“2013-02-15T05:06:49.101Z”>wps:ProcessFailed<ows:ExceptionReport version=“1.1.0”><ows:Exception exceptionCode=“NoApplicableCode”

ows:ExceptionTextProcess failed during execution

Process execution ef1514b7-25b1-477f-a277-5fffe63c2fc5 failed

Failed to retrieve value for input features

Could not locate {http://www.openplans.org/spearfish}roads in catalog.</ows:ExceptionText></ows:Exception></ows:ExceptionReport></wps:ProcessFailed></wps:Status></wps:ExecuteResponse>

If I remove the security rule for sf.roads.r then “825” is returned from the gs:Count request as expected. Is there a way to perform this request successfully with the security rule in place? Any assistance would be greatly appreciated.

Environment details:

Tested on a fresh install of GeoServer v2.2.4 war with the WPS plugin added.

Server version: Apache Tomcat/6.0.30
Server built: March 24 2011 1142
Server number: 6.0.30.0
OS Name: Mac OS X
OS Version: 10.8.2
Architecture: x86_64
JVM Version: 1.6.0_37-b06-434-11M3909
JVM Vendor: Apple Inc.

Exception from GeoServer log:

2013-02-15 18:06:49,113 ERROR [geoserver.wps] - Process execution failed
org.geotools.process.ProcessException: Process execution ef1514b7-25b1-477f-a277-5fffe63c2fc5 failed
at org.geoserver.wps.executor.DefaultProcessManager.getOutput(DefaultProcessManager.java:157)
at org.geoserver.wps.executor.WPSExecutionManager.getOutput(WPSExecutionManager.java:173)
at org.geoserver.wps.Execute.run(Execute.java:75)
at org.geoserver.wps.DefaultWebProcessingService.execute(DefaultWebProcessingService.java:76)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
at org.geoserver.ows.util.RequestObjectLogger.invoke(RequestObjectLogger.java:54)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
at $Proxy33.execute(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.geoserver.ows.Dispatcher.execute(Dispatcher.java:772)
at org.geoserver.ows.Dispatcher.handleRequestInternal(Dispatcher.java:272)
at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:789)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.geoserver.filters.ThreadLocalsCleanupFilter.doFilter(ThreadLocalsCleanupFilter.java:23)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:74)
at org.geoserver.filters.SpringDelegatingFilter.doFilter(SpringDelegatingFilter.java:45)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.geoserver.platform.AdvancedDispatchFilter.doFilter(AdvancedDispatchFilter.java:49)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.vfny.geoserver.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:311)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:68)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:116)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:72)
at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:68)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:72)
at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.geoserver.security.filter.GeoServerAnonymousAuthenticationFilter.doFilter(GeoServerAnonymousAuthenticationFilter.java:53)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:68)
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:150)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:72)
at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:91)
at org.geoserver.security.filter.GeoServerBasicAuthenticationFilter.doFilter(GeoServerBasicAuthenticationFilter.java:82)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:68)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:72)
at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:173)
at org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:97)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.geoserver.filters.LoggingFilter.doFilter(LoggingFilter.java:71)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:47)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:46)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
at java.lang.Thread.run(Thread.java:680)
Caused by: org.geoserver.wps.WPSException: Failed to retrieve value for input features
at org.geoserver.wps.executor.LazyInputMap.get(LazyInputMap.java:37)
at org.geotools.process.factory.AnnotationDrivenProcessFactory$InvokeMethodProcess.buildProcessArguments(AnnotationDrivenProcessFactory.java:496)
at org.geotools.process.factory.AnnotationDrivenProcessFactory$InvokeMethodProcess.execute(AnnotationDrivenProcessFactory.java:381)
at org.geoserver.wps.executor.DefaultProcessManager$ProcessCallable.call(DefaultProcessManager.java:215)
at org.geoserver.wps.executor.DefaultProcessManager$ProcessCallable.call(DefaultProcessManager.java:189)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
… 1 more
Caused by: org.geoserver.wfs.WFSException: Could not locate {http://www.openplans.org/spearfish}roads in catalog.
at org.geoserver.wfs.GetFeature.featureTypeInfo(GetFeature.java:1036)
at org.geoserver.wfs.GetFeature.run(GetFeature.java:338)
at org.geoserver.wfs.DefaultWebFeatureService.getFeature(DefaultWebFeatureService.java:121)
at org.geoserver.wps.executor.SimpleInputProvider.handleAsInternalWFS(SimpleInputProvider.java:168)
at org.geoserver.wps.executor.SimpleInputProvider.getValue(SimpleInputProvider.java:117)
at org.geoserver.wps.executor.LazyInputMap.get(LazyInputMap.java:35)
… 9 more

Regards,

Matt.

On Fri, Feb 15, 2013 at 6:46 AM, Matt Currie <matt.currie@anonymised.com> wrote:

Next I go to Demos > WPS request builder in the web admin, choose “gs:Count” process, select the “sf:roads” feature, and click Execute. The response is:

<?xml version="1.0" encoding="UTF-8"?>

<wps:ExecuteResponse xml:lang=“en” service=“WPS” serviceInstance=“http://localhost:8080/geoserver/ows?” version=“1.0.0” xmlns:wps=“http://www.opengis.net/wps/1.0.0” xmlns:ows=“http://www.opengis.net/ows/1.1” xmlns:xlink=“http://www.w3.org/1999/xlink”><wps:Process wps:processVersion=“1.0.0”>ows:Identifiergs:Count</ows:Identifier>ows:TitleCount Features</ows:Title>ows:AbstractComputes the number of features in a feature collection.</ows:Abstract></wps:Process><wps:Status creationTime=“2013-02-15T05:06:49.101Z”>wps:ProcessFailed<ows:ExceptionReport version=“1.1.0”><ows:Exception exceptionCode=“NoApplicableCode”

ows:ExceptionTextProcess failed during execution

Process execution ef1514b7-25b1-477f-a277-5fffe63c2fc5 failed

Failed to retrieve value for input features

Could not locate {http://www.openplans.org/spearfish}roads in catalog.</ows:ExceptionText></ows:Exception></ows:ExceptionReport></wps:ProcessFailed></wps:Status></wps:ExecuteResponse>

This error is normal, and intended to happen, if you are issuing the request with an
anonymous user.
However, if you are using a authenticated user instead, it should work… but it
may be that it does not due to the fact every WPS request runs in a separate
thread (other than the one which initiated the request),
which makes it lose the autentication thread locals

Cheers
Andrea

==
Our support, Your Success! Visit http://opensdi.geo-solutions.it for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it