Testing ahead of 2.27.0 release

jive · March 17, 2025, 12:43pm

Hello everyone, @groldan and myself volunteered to do the GeoServer 2.27.0 release this month - and we could use your help

GeoServer stopped doing “release candidates” ahead of each major release instead relying on nightly builds for feedback.

Testing is the best way to ensure GeoServer works for you and your organization. This is “where we do the open source thing” and share risk, share work, and simply make better software. Reply to this thread with your feedback, and we will thank you in the release announcements.

Test with your Data Directory

Try a nightly build with your data directory.

This is an important point where we depend on the public for help. With large open source projects there is the Linus’s law “given enough eyeballs, all bugs are shallow”. Subjecting a problem to a lot of feedback helps find corner cases.

My variation, Jody’s law , is for smaller scientific projects like GeoSever: “given enough data, all bugs are shallow”. We do not need a lot of people testing, we need GeoServer exposed to a wider range of datasets than the development team has access to.

Please check for:

UI CSP: Browser “content security policy” restrictions are now in place, so let us know if you find any problems. The docs has information how to identify CSP issues, and turn off CSP if needed. For experts there is config screen if you need to relax CSP settings on a case by case basis.
UI Dialogs: As part of getting ready for GS3 we had to implement our own dialogs. If you run into any problems please let us know!

Catalog Loader: GeoServer startup has seen a lot of improvements and we are seeking feedback on how-much-faster your experience is (and ensure we avoid deadlocks).
OGC API - Features: Read the instructions and learn how to configure along side WFS output.

Quick 2.27.x feedback

It is very easy to do with the docker instructions for 2.27.x.

Example: To give feedback on ogcapi-features service:

docker pull docker.osgeo.org/geoserver:2.27.x

docker run -it -p8080:8080 \
 --env INSTALL_EXTENSIONS=true \
 --env STABLE_EXTENSIONS="ogcapi-features" \
 docker.osgeo.org/geoserver:2.27.x

schorsch2 · March 18, 2025, 7:05am

Hello,

So I have now given it a try with Docker and my data directory. The layers appear as expected.
However, I cannot log in.
Firefox’s developer tools show: ‘Content-Security-Policy: The page settings have blocked the loading of a resource (form-action) on http://server:8080/geoserver/j_spring_security_check because it violates the following directive: “form-action ”self’’
This seems to be an intended result, but how do I get to the administration interface now?
I have already updated the page with Control-R and Control-Shift-R. Otherwise I don’t know what to do.

Best regards

Georg

jive · March 18, 2025, 10:51am

Hi @schorsch2 and thanks for feedback

Following the identify CSP issues instructions there is a --env org.geoserver.web.csp.strict=false setting to “break in”.

However that it is not working in Firefox for you is unexpected - as I tested the instructions before posting.

Let me try again now … yeah it still works for me:

18-Mar-2025 10:40:30.403 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"]
18-Mar-2025 10:40:30.464 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in [21697] milliseconds

Yeah your feedback is exactly what we are needing:

Can you tell me anything more about your setup?

Your message indicated server:8080 but are you usually accessing via https:server:80 with a proxy base url?
You can try clearing your browser cache completely or accessing in “privacy mode”

Peter · March 18, 2025, 10:53am

@jive, I believe that [GEOS-11284] Promote community module "datadir catalog loader" to core by groldan · Pull Request #8370 · geoserver/geoserver · GitHub has not yet been merged into 2.27.x, so we will not see this improvement yet, and we will have to re-request users to test after the merge.

jive · March 18, 2025, 10:54am

Yes I am very aware, one advantage of nightly tests is that we can ask for feedback as changes are made.

I had been holding off on sending this post since the start of March waiting on catalog data dir loader …

aaime-geosolutions · March 18, 2025, 1:09pm

In the meantime those that actually run test found issues that got fixed…
it did not take hours to start up geoserver on a small number of data dirs, althought it was not trivial to ensure that it would not deadlock on startup, or lose all of the layer groups…

Cheers
Andrea

roarbra · March 18, 2025, 2:22pm

Hi,

I’ve done some testing with the 2.27.x in combination with geoserver-sec-oauth2-openid-connect-plugin. The login/logout- buttons with this combinations is certainly influenced by the CSP settings.

My findings is that out of the box, without any configuration, clicking the login-button would make the browser hang with a message in the console:

Refused to load https://iam.dummy.net/openid-connect/logout?post_logout_redirect_uri=https://dummy.net/geoserver because it does not appear in the form-action directive of the Content Security Policy.

After logging in with an admin account, I discovered the new Content Security Policy page. First impression was that it were too complicated. I entered the IAM domain into “Allowed sources for remote web resources”, and then tried to find a suitable place to add this url into a ‘form-action’ rule.

I ended up editing “other-requests”. That didn’t work. My changes was gone when logging out and trying to log in again.

Then I tried to do the changes manually in the csp.xml file. That worked and now I can use the Login / Logout-buttons with the CSP enabled.

The url of these two are: /j_spring_security_logout and /web/j_spring_oauth2_openid_connect_login. What would be the correct Rule to place this?

I wonder why it is an ordered list of Policy List. They seems to be independent of each other. It would also make sense to shorten the Rule List.

Best regards,
Roar Brænden

jive · March 18, 2025, 7:01pm

Thanks Andrea, I performed some additional testing of a half dozen data directories I have access to.

No problems with the data load found - but I did fix one long standing annoyance - warnings about accessDenied.jsp not being found on initial startup.

schorsch2 · March 19, 2025, 7:37am

I also came across this instruction. My Docker script looks like this:

docker run -d -it -p8080:8080
–name geoserver
–mount type=bind,src=/daten/geodaten/geoserver_data,target=/opt/geoserver_data
–env INSTALL_EXTENSIONS=true
–env STABLE_EXTENSIONS=“css,wps”
–env org.geoserver.web.csp.strict=false
docker.osgeo.org/geoserver:2.27.x

Did I use it correctly?

schorsch2 · March 19, 2025, 8:50am

Maybe I’m already a bit further along.
I managed to connect to geoserver with an nginx proxy to reach the connection via https. I have adjusted the proxy address in the global.xml file in the data directory accordingly.
Now I can log in as admin.
So far so good, but apparently I still don’t have sufficient rights, because access to the settings is not displayed. Is there any other idea?

dcal · March 19, 2025, 10:52am

Hi,

I just downloaded the current nightly build and stumbled over a broken link for the GeoFence Server plugin. Instead of

https://build.geoserver.org/geoserver/main/ext-latest/geoserver-2.27-SNAPSHOT-geofence-server-plugin.zip

there are now to versions of the plugin:

Please correct the download page.

Regards
Daniel

dcal · March 19, 2025, 12:39pm

I installed the nightly build and unfortunately the GeoFence plugin doesn’t work anymore. I’m persisting the configuration into Oracle and I now used the H2 version of the plugin using the following configuration:

geofenceVendorAdapter.databasePlatform=org.hibernatespatial.oracle.OracleSpatial10gDialect
geofenceDataSource.driverClassName=oracle.jdbc.OracleDriver
geofenceDataSource.url=jdbc:oracle:thin:@mydatabase
geofenceDataSource.username=user
geofenceDataSource.password=pass
geofenceEntityManagerFactory.jpaPropertyMap[hibernate.default_schema]=geofence
geofenceEntityManagerFactory.jpaPropertyMap[hibernate.hbm2ddl.auto]=validate

GeoServer fails to start an writes the following error to the logfile:

12:26:29 WARN   [internal.JdbcEnvironmentInitiator] - HHH000342: Could not obtain connection to query metadata
org.hibernate.boot.registry.selector.spi.StrategySelectionException: Unable to resolve name [org.hibernatespatial.oracle.OracleSpatial10gDialect] as strategy [org.hibernate.dialect.Dialect]
Caused by: org.hibernate.boot.registry.classloading.spi.ClassLoadingException: Unable to load class [org.hibernatespatial.oracle.OracleSpatial10gDialect]
	...
Caused by: java.lang.ClassNotFoundException: Could not load requested class : org.hibernatespatial.oracle.OracleSpatial10gDialect
	...
13:34:55 ERROR  [jpa.LocalContainerEntityManagerFactoryBean] - Failed to initialize JPA EntityManagerFactory: Unable to create requested service [org.hibernate.engine.jdbc.env.spi.JdbcEnvironment]

I’m using the hibernate-spatial-oracle-1.1.3.2.jar. Could someone give me a hint what changed in GeoServer or the plugin or what I could do to fix the issue?

jive · March 19, 2025, 3:40pm

Hi @dcal and welcome back.

I see several:

Check the docs show that both h2 and postgres clients are expected, but the nightly download page layout was not updated.

Let me fix that now.

jive · March 19, 2025, 3:44pm

I note that the manual says something about an unusual version of h2 being used not compatible with other plugins.

Warning: this plugin will install a version of the H2 library that is not compatible with other plugins using H2 (e.g. grib/netcdf).

This package is purely for demo purposes, allowing you to run the GeoFence plugin without the need to configure an external DB backend.

Do you have any of those other plugins installed?

jive · March 19, 2025, 3:47pm

@schorsch2 not sure I understand:

I still don’t have sufficient rights, because access to the settings is not displayed. Is there any other idea?

Are you thinking your admin user does not have ADMIN permission? Perhaps you can use a longer description or screen snaps to be more clear.

schorsch2 · March 20, 2025, 6:35am

I see no difference between a registered ‘admin’ and a non-registered user. Normally a bar with status, log, contact etc. appears on the left.

jive · March 20, 2025, 9:11am

Hi @schorsch2 that looks like your “admin” user does not have ADMIN permission.

You could remove your security folder and geoserver will recreate it from scratch if you want to try a “fresh” test.

etj · March 20, 2025, 9:44am

Hi @dcal, pls note that you need to edit your configuration file, since it is still referring to the package org.hibernatespatial.<...> while the new version (since 2.27) requires now org.hibernate.spatial.<...>. Please check the class name of the Oracle version you need in the “Direct known subclasses” at Dialect (Hibernate JavaDocs).
Also, hibernate-spatial-oracle-1.1.3.2.jar .is no longer needed, since all the hibernate spatial dialects are now already provided. You only need to add the oracle jdbc driver, since h2 and postgis are the only two provided by default.
Thanks for the head up, I’ll update the doc at Installing the GeoServer GeoFence Server extension — GeoServer 2.27.x User Manual related to using different DBMS.

schorsch2 · March 20, 2025, 12:32pm

Deleting the ‘security’ directory did not work. I was able to log in, but an error message was displayed instead of the layer list.
However, I used my geodata directory for testing on another computer. There was still a reference to a proxyBaseUrl in the settings.xml files in my workspace, as well as in the ‘global.xml’ file. I deleted this and now I can no longer detect any problems with access.

Thank you!

jive · March 20, 2025, 1:47pm

Hi @schorsch2 I just want to be sure I understand so we can write good update instructions here: Content Security Policy (GeoServer 2.27 and newer)

If I understand correctly your proxy base url was incorrect, and since content security policy is setup to enforce such things it was deeply unhappy.

Any tips or warnings we could add that would of helped you?