Hi everyone
We experience a problem since Version 2.12.0 of the GeoServer. Version 2.11.5 was the last Version where it worked properly. With the newest Version 2.27.1 it still doesn’t work.
If you have a clean instance of the GeoServer you can run the following to create a WMS Store:
curl --silent --fail --request POST \
--url http://localhost:8080/geoserver/rest/workspaces/cite/wmsstores \
--header 'Authorization: Basic YWRtaW46Z2Vvc2VydmVy' \
--header 'Content-Type: application/json' \
--data '{
"wmsStore" : {
"name" : "swisstopo",
"description" : "swisstopo",
"type" : "WMS",
"enabled" : true,
"workspace" : {
"name" : "cite"
},
"capabilitiesURL" : "https://wms.geo.admin.ch/?SERVICE=WMS&VERSION=1.3.0&REQUEST=GetCapabilities",
"metadata" : {
"useConnectionPooling" : false
},
"maxConnections" : 6,
"readTimeout" : 60,
"connectTimeout" : 30
}
}'
If you look at http://localhost:8080/geoserver/rest/workspaces/cite/wmsstores/swisstopo.json you see there is no user/password.
With the following command you can add a user/password:
curl --silent --fail --request PUT \
--url http://localhost:8080/geoserver/rest/workspaces/cite/wmsstores/swisstopo \
--header 'Authorization: Basic YWRtaW46Z2Vvc2VydmVy' \
--header 'Content-Type: application/json' \
--data '{
"wmsStore": {
"user": "test",
"password": "test"
}
}'
If you now execute the following command, the expected behaviour is that the username/password is completely removed:
curl --silent --fail --request PUT \
--url http://localhost:8080/geoserver/rest/workspaces/cite/wmsstores/swisstopo \
--header 'Authorization: Basic YWRtaW46Z2Vvc2VydmVy' \
--header 'Content-Type: application/json' \
--data '{
"wmsStore": {
"user": null,
"password": null
}
}'
In fact it’s not removed. The user is still there with an empty value and the password is still there with some value. If you again look at http://localhost:8080/geoserver/rest/workspaces/cite/wmsstores/swisstopo.json you see something like this:
...
"user": "",
"password": "crypt1:JlxVVkiN7/OYKSmhXVjR1A==",
...
That causes problems because this credentials are then used.
You can’t really test it with the swisstopo WMS from the example because it doesn’t need credentials. I just used it to showcase the problem that the user/password is still in the config.
Has the way to remove user/password changed or is this actually a bug?