Tag Info

Hot answers tagged

14

First of all, I think you should read the Geoserver documentation on Security. http://docs.geoserver.org/stable/en/user/security you will discover it is possible to make layers accessible/inaccessible to different users or roles. Another possible solution would be to make geoserver inaccessible from the outside world (close port 8080 on your server for IP's ...


13

The OGC spec only mandates the use of http. If it is compliant http it should be okay. Some possible methods: HTTP Basic Authentication (password sent as plain text, may have limited client support) HTTP Digest Authentication (more secure, may have limited client support) Filter IP address of client (easy to implement but not particularly secure). ...


7

You could have a look at GeoPrisma We needed to make a Web mapping application with security on sensible datasets. This could have been accomplished with multiple applications and by putting a standard login+password access to them, but the project was too big and it would have been very complex to maintain. Adding a new dataset for example ...


7

This OGC post from 2005 says: There are no specific security aspects that are part of the OGC WMS/WFS/WCS Interface Specifications. Instead, security and authentication is best handled at another layer in the processing stack.


6

Please have a look at How ArcGIS Server Security works. Basically, you will need to make users and groups, and give a particular User rights over certain services. Once you have done that, then you need to use Token based security in your JavaScript Application. What this means is that, you ask the User for their UserName & password. That is sent to ...


4

I finally found what I was looking for: a proper ArcGIS Server web endpoint that I could use to generate tokens! The call is this: GET http://<arcgisserver_host:port>/arcgis/tokens?request=getToken&username=<usr>&password=<usr>&expiration=<token_lifespan> which gives back the token into the HTTP response body, and one ...


4

The solution we ended up with was to add an authenticating proxy server between the OpenLayers client and the backend WMS service. So instead of connecting directly to the WMS service the OpenLayers client connects to a proxy server which adds the required authentication headers to the requests. Example code for creating the layers: var layer = new ...


3

A proxy page can also be used to bypass an authenticated service with 10.x versions of the APIs. A few things to note: Bypassing the Windows authentication with a proxy page will cause all of your connections to be made by the identity of the application pool that runs the proxy page, or by the identity of the connection you make within the proxy page. ...


3

If security through obscurity is enough for your purposes you might configure a false extend for the layer : Just use coordinates on the other side of the Earth. The layer will still appears in the layer list, requests will still be possible but if a user simply select it in a GIS software and choose "zoom to layer" he will not see anything and might think ...


3

You can send a fake ajax request before adding the layer to the map. The browser will handle the basic authentication for you: // Assuming myLayer **WITHOUT** user:pass in the url $.ajax({ url: myLayer.url, data: myLayer.params, method: 'GET', error: function(jqXHR, textStatus, errorThrown){ // Handle not authoruzed here }, ...


2

According to your question following things may be possible : 1.If you are using ArcGIS Server 10.1 then you can use ArcGIS administrator API (Click here for more details) 2.If you are using REST Service (through java script application) then you can set such query tasks to control the features (Click here for more details)


2

In the ArcGIS API for JavaScript, there's a widget called the Identity Manager that addresses exactly what you want to do. Check out samples that use the identity manager to see how it works. The sample linked by Devdatta, while valid, is the pre-Identity Manager way of doing this and involves a lot more code that is necessary now that authentication for ...


2

For Geoserver 2.1.3 By default, no service-level security is set. Two examples are given in the service.properties file by default, commented out: wfs.GetFeature=ROLE_WFS_READ wfs.Transaction=ROLE_WFS_WRITE Make Sure they are included for WFS_T http://docs.geoserver.org/2.1.3/user/security/sec_service.html Example Service File with the correct ...


1

Take a look at this example I wrote a while back, https://github.com/andrewxhill/cartodb-examples/blob/gh-pages/private-maps/index.html It would present you with a form where you drop your api-key and it will create the map. You can use it as a starting point if you just want to write your api_key directly into the file. The way to do it in the library ...


1

We decided to use our own proxy to achieve authentication. Details on the first version of the proxy can be seen here Essentially we use a standard login using Ajax against our client database over https. We return a Guid, which is stored in a table on the server, to the JavaScript and modified the proxy code given above to validate back against the ...


1

It looks like the proper way to secure this service will be to use windows integrated authentication, and although I'm not clear on the details, use that to control which features are being rendered. Potentially, but not with ArcGIS Server security. ArcGIS Server security at 10.1 currently only allows you to dish out individual map services to ...


1

When you connect to a secured web site with a non-IE Browser, the login credentials you use will be re-used when you connect to the same web site. If you are using two different web sites, then the user will be prompted again when their browser tries to connect to the second web site. You are certainly able to generate a token for a client to consume ...


1

Solved it - Three things contributed to this: The user name needed to be companydomain\username instead of companydomain.com\username, which I have been using because our company has an identity issue i wont go into detail about. If Anonymous is on while Windows Authentication is on it will try to use the Anonymous account which is not authorized to get ...


1

I had a similar problem which was confirmed as a bug, perhaps you are having the same issue if you are using domain logins, check ravi's response: http://forums.arcgis.com/threads/36199-Bugs-Issues-with-Token-service-%28and-iOS%29


1

When securing ArcGIS Server, you can either use IIS authentication, or database authentication (you would want DB). Alternately, disable anonymous access to your REST endpoint and expose a proxy page which accepts username/password. Then use your proxy page to authenticate against the information found in the database, and from there make a request to the ...


1

http://52north.org/communities/security/general/user_guide.html http://geoprisma.org/site/index.php http://www.opengeospatial.org/projects/groups/geormwg src:http://www.delicious.com/based2/bundle:comp.infosystems.gis



Only top voted, non community-wiki answers of a minimum length are eligible