Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

I want to publish map layers using OpenLayers and GeoServer. While this is easy enough to set up, I'm a bit lost when it comes to authentication possibilities. What I want is to create different users that will, by logging in with their own user name and password, be directed to their own map window. How can this be securely done so that none of my users will be able to access each other's layers?

I have understood that it is quite easy to "hack" the setup by, for example, making queries to the GeoServer where one simply asks it to list all the available layers.

What are my options? I suppose apache could be of help when setting it up in my ubuntu server? Any tutorials on this subject?

share|improve this question

4 Answers 4

First of all, I think you should read the Geoserver documentation on Security. http://docs.geoserver.org/stable/en/user/security you will discover it is possible to make layers accessible/inaccessible to different users or roles.

Another possible solution would be to make geoserver inaccessible from the outside world (close port 8080 on your server for IP's other then localhost) and then create an authentication mechanism yourself in the web programming language of your choice.

For instance: You could set up some sort of login/authentication in php that forwards requests to the geoserver on localhost once authenticated.

share|improve this answer
    
In addition: You could have a lookup table that has associations between your Application's Users and the GeoServer Users/Roles/Layers and apply layer level security on GeoServer. So when OpenLayer's proxy requests a layer it looks up the corresponding Geoserver credentials, authenticates them, and returns the layer he has access to. This way the user can try to request any other layer he wants but will not get it unless he has access to it. –  CaptDragon Nov 23 '11 at 14:35

You could have a look at GeoPrisma

We needed to make a Web mapping application with security on sensible datasets. This could have been accomplished with multiple applications and by putting a standard login+password access to them, but the project was too big and it would have been very complex to maintain. Adding a new dataset for example would require modifications of each application manually, adjustments of the security, etc.

That’s why we decided to develop our own Web mapping application that included access control on datasets using the OpenSource Web mapping applications available.

http://geoprisma.org/dist/build/html/introduction/index.html

I'd have a scan of the documentation - it may be overkill to add this in to a simple project if you only have a few layers / users on your system. If you have 100s of users/groups with editing rights on different datasets then it probably makes sense to use an existing project such as GeoPrisma.

Otherwise standard web server security built around HTTP would probably suffice.

share|improve this answer
    
Can GeoPrisma be used with GeoServer? Do they have a proven track record? –  Mimo Nov 17 '11 at 13:19
    
It can be used with any WMS Server including GeoServer. Comments added above. –  geographika Nov 17 '11 at 13:40

Please debug this statement

$type=$_GET['FORMAT'];

when you pass the value of FORMAT as the parameters of the URL do you get the map( image) from the server,If you are getting it, then your proxy should be working fine.

share|improve this answer

One approach would be to implement a Proxy like this that could verify a users credentials as logged in using session variables and only allow them to access resources they are entitled to, ie: check the url for the layers that are being called and deny access if user is not authorized to view them.

In terms of what data they may see, if it is a subset of a larger data set, this is a little more complicated but I see two approaches ..

  1. Use Parameterized SQL Views to control what data the user would see. You could use the Proxy to change the url before it is passed to Geoserver with the parameters specific to that user. You could also send the parameters back to Openlayers via an Ajax Call after the user is authenticated and supply the parameters as part of the WMS getMAP call in OpenLayers. The actual data displayed could be handled by Variable substitution in SLD to filter data displayed or by using External Styles in your WMS getMap calls to change the SLD a user uses to display a given layer.

  2. Use an Ajax Call after User Authentication to specify Map Extents to only allow the user to mover around a specified area. You could also use layerVisibility() to restrict what data could be displayed as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.