Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

I've a mapping site where users have to login in with username and password. Once logged in the user gets a map of their data using WMS and WFS to display and edit data. This data is served using GeoServer and displayed using OpenLayers. The WMS on the layer is secured using a username\password. I've seen similar questions to this but basically I want to access the secured layers via WMS without exposing my username\password. Any advice\clarity would be appreciated - my own thoughts are as follows:

  1. User logs in to website.
  2. WMS request using HTTPS for their specific information - uses some filter based upon who they are.
  3. How do I send this filter without exposing it in the WMS call?
  4. How do I send username\password without exposing it in WMS call?

Theres lots of talk about reverse proxies - do I send the WMS request with no username\password then when the request reaches the proxy I validate the user then modify the request by adding the WMS username\password using the reverse proxy. If so dont I still need to send some identifier to determine who sent the request or will the proxy knows this due to the users session?

Basically any help would be appreciated

share|improve this question

2 Answers 2

up vote 2 down vote accepted

how about this: http://osgeo-org.1560.x6.nabble.com/Load-GeoServer-WMS-secured-layers-with-OpenLayers-td3919938.html, basically it uses a proxy script to do what you need.

share|improve this answer
    
Thanks. I had read this post but was still unsure how the OL4JSFProxy knew the credentials of the user that sent the initial request. Is this just stored in the session data? Also is this what other users are using in Production environments? –  gisWeeper May 27 '13 at 12:45
    
I know there are some guys using web frameworks like this for production, however this probably goes beyond the specific user/password thing you need. –  Gery May 27 '13 at 13:40

GeoPrisma might fit your needs. It's a web mapping application featuring Access Control (Permissions) to geospacial data (Resources). It also has a proxy that allows/denies access to a Resource depending on your permission to that Resource. As an added bonus, it also has templates and widgets that you can use for your application.

share|improve this answer
    
Thanks for reply. Is this what other users are using in Production environments? –  gisWeeper May 27 '13 at 12:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.