Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an application where each user has individually generated geotiff files. Since the users pay for the generated geotiff, I have to make sure that the users can only see their own geotiff and not the geotiff of any other user.

I'm using geoserver and PostgGIS and I plan to user WMS / WCS to deliver the data. The geotiff files are stored in the database, together with some additional data like an id.

How can I setup such an security? Is it really necessary to create an own layer and role for each user? Or is there any way to create a security based on the id of the files in the database?

best regards, DDD

share|improve this question
I am not sure if postgis/postgres is that security sophisticated. In oracle it is called fine grain security control. If each geotiff is in a seperate table then it should be fairly straight forward. However if they are all in the same table someone else may be able to help. – Brad Nesom Jun 25 '12 at 21:42
up vote 0 down vote accepted

Giving web users roles in your database is a bad idea. I think this should be handled in the application not the database. Each geotiff row would indentify the customer. Your app would be responsible for only serving them their associated rows.

share|improve this answer
OK, handling in the application is an option, but I thought of some kind of 'WCS authorization proxy' that can be configured. – I. Gona Jun 27 '12 at 19:19
I think GeoServer only does layer or service level security. See this question – Sean Jul 2 '12 at 21:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.