Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.


In my current project, I've the requirement to validate that requests coming to GeoServer (2.3.0) are allowed.

The project holds those facts:

  • the GS client cannot provide the principal information (the password for instance), GS itself has no connection with a user/role repo

So we took the opportunity to use the auth filter mechanism in order to check that:

  • a valid request (to a specific WFS' layer) contains a special HTTP Header (let's say X-CUSTOM-VALID)
  • This header is a JSON encoded message holding enough information to validate the fact that the request was initiated by a client that was connected to a valid third system (a username, a secret, stuffs like that)


The documentation is telling us that we should be able to do so...

However, the documentation is not clear how to create such components and how they should be configured.

Debugging GeoServer I managed to find that to configure such a filter, it requires a dedicated Authentication Provider. That, in order to have a panel in the web admin interface (under authentications, in the Authentication Filters list)


Thus my code is composed of those files:

  • ProducteurAuthFilterPanel.java
  • ProducteurAuthFilterPanelInfo.java
  • ProducteurAuthenticationFilterConfig.java
  • ProducteurAuthenticationFilterPanel.html

These are require to add a panel in the Web Admin Interface. ProducteurAuthFilterPanelInfo is glueing the two other along with the ProducteurAuthenticationFilter here-after (THE filter ^^).

The ProducteurAuthenticationFilterConfig declares that in its constructor:


Filter (and Provider)

Now, the classes needed to create a filter to be included in a chain (I guess):

  • ProducteurAuthenticationFilter : the filter implementation extending GeoServerSecurityFilter and implementing GeoServerAuthenticationFilter
  • ProducteurAnonymousAuthenticationProvider: somehow required by the Panel (above) to define the new filter
  • ProducteurAuthenticationException: used in the AuthenticationEntryPoint (only Http403ForbiddenEntryPoint for now)

Finally, the beans are defined like so:

<bean id="yaanonymousFilterProvider" class="dgarne.java.geoserver.security.ProducteurAnonymousAuthenticationProvider"/>

<bean id="producteurAuthPanelInfo" class="dgarne.java.geoserver.security.ProducteurAuthFilterPanelInfo">
    <property name="id" value="security.producteurAuthFilter" />
    <property name="shortTitleKey" value="ProducteurAuthFilterPanel.short"/>
    <property name="titleKey" value="ProducteurAuthFilterPanel.title"/>
    <property name="descriptionKey" value="ProducteurAuthFilterPanel.description"/>

At the end of the game, in the Web Admin Interface I've a new Item in the filter panel, and I used it in the default mapping (see image below for references): enter image description here

Problem description

Here we are...

None of my WFS request issued by a client (OpenLayers) which are matching the default mapping (/**) is going through the defined Filter. While debugging I found that the filter chains defined in the Spring Context are never including my definition, but rather are always including the classical one using either anonymous, digest or basic...


So is there anyone able to point me out with a (much ^^) more complete documentation about how I have to do it?

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.