Hot answers tagged

16

First of all, I think you should read the Geoserver documentation on Security. http://docs.geoserver.org/stable/en/user/security/index.html you will discover it is possible to make layers accessible/inaccessible to different users or roles. Another possible solution would be to make geoserver inaccessible from the outside world (close port 8080 on your ...


15

The OGC spec only mandates the use of http. If it is compliant http it should be okay. Some possible methods: HTTP Basic Authentication (password sent as plain text, may have limited client support) HTTP Digest Authentication (more secure, may have limited client support) Filter IP address of client (easy to implement but not particularly secure). ...


9

I finally found what I was looking for: a proper ArcGIS Server web endpoint that I could use to generate tokens! The call is this: GET http://<arcgisserver_host:port>/arcgis/tokens?request=getToken&username=<usr>&password=<usr>&expiration=<token_lifespan> which gives back the token into the HTTP response body, and one ...


8

You could have a look at GeoPrisma We needed to make a Web mapping application with security on sensible datasets. This could have been accomplished with multiple applications and by putting a standard login+password access to them, but the project was too big and it would have been very complex to maintain. Adding a new dataset for example ...


8

This OGC post from 2005 says: There are no specific security aspects that are part of the OGC WMS/WFS/WCS Interface Specifications. Instead, security and authentication is best handled at another layer in the processing stack.


7

Please have a look at How ArcGIS Server Security works. Basically, you will need to make users and groups, and give a particular User rights over certain services. Once you have done that, then you need to use Token based security in your JavaScript Application. What this means is that, you ask the User for their UserName & password. That is sent to ...


6

The solution we ended up with was to add an authenticating proxy server between the OpenLayers client and the backend WMS service. So instead of connecting directly to the WMS service the OpenLayers client connects to a proxy server which adds the required authentication headers to the requests. Example code for creating the layers: var layer = new ...


5

You can use ArcCatalog and in this case you need to grant the permissions on the feature dataset in which the network resides, not its individual feature classes. Note that it's not the geometric network (or topology etc.) which dictates this approach, it's the presence of a feature dataset.


5

I've figured out how to use their web services. It looks like you have to send the token as a header instead of directly in the URL. For example, you can download an add-on to your browser such as postman that allows you to send GET and POST requests to web servers. Then select the option to send a get request to the web server such as ...


4

You can send a fake ajax request before adding the layer to the map. The browser will handle the basic authentication for you: // Assuming myLayer **WITHOUT** user:pass in the url $.ajax({ url: myLayer.url, data: myLayer.params, method: 'GET', error: function(jqXHR, textStatus, errorThrown){ // Handle not authoruzed here }, ...


4

The user you specify when making the connection must be a member of the 'agsusers' (or 'agsadmin') group on the target ArcGIS Server. An application you create with the manager likely uses (and encodes!) the identity of the ArcGISWebServices user, who's in the agsusers group by default. Try adding yourself to the agsusers group, and then use your ...


4

If security through obscurity is enough for your purposes you might configure a false extend for the layer : Just use coordinates on the other side of the Earth. The layer will still appears in the layer list, requests will still be possible but if a user simply select it in a GIS software and choose "zoom to layer" he will not see anything and might think ...


4

A proxy page can also be used to bypass an authenticated service with 10.x versions of the APIs. A few things to note: Bypassing the Windows authentication with a proxy page will cause all of your connections to be made by the identity of the application pool that runs the proxy page, or by the identity of the connection you make within the proxy page. ...


4

I have done this in the past, but I authenticated the secured service from our own server on the ArcGIS Online side. In my case, I just needed a single Feature Service to be used in an AGOL app. Not quite the same workflow, but it worked. Here are the steps I followed: From your "My Content" tab, click "Add Item". Choose "ArcGIS Server web service". ...


3

There are also specialized frameworks like SecureOWS by CampToCamp : http://www.secureows.org/trac/secureows


3

You can require that users connect to the WMS over HTTP secured by a VPN. It puts the security layer on the level of the IP network, but certainly adds complexity.


3

When securing ArcGIS Server, you can either use IIS authentication, or database authentication (you would want DB). Alternately, disable anonymous access to your REST endpoint and expose a proxy page which accepts username/password. Then use your proxy page to authenticate against the information found in the database, and from there make a request to the ...


2

For Geoserver 2.1.3 By default, no service-level security is set. Two examples are given in the service.properties file by default, commented out: wfs.GetFeature=ROLE_WFS_READ wfs.Transaction=ROLE_WFS_WRITE Make Sure they are included for WFS_T http://docs.geoserver.org/2.1.3/user/security/sec_service.html Example Service File with the correct ...


2

It looks like the proper way to secure this service will be to use windows integrated authentication, and although I'm not clear on the details, use that to control which features are being rendered. Potentially, but not with ArcGIS Server security. ArcGIS Server security at 10.1 currently only allows you to dish out individual map services to ...


2

According to your question following things may be possible : If you are using ArcGIS Server 10.1 then you can use ArcGIS administrator API (Click here for more details) If you are using REST Service (through java script application) then you can set such query tasks to control the features (Click here for more details)


2

In the ArcGIS API for JavaScript, there's a widget called the Identity Manager that addresses exactly what you want to do. Check out samples that use the identity manager to see how it works. The sample linked by Devdatta, while valid, is the pre-Identity Manager way of doing this and involves a lot more code that is necessary now that authentication for ...


2

We do not use GeoServer Authentication, but we do use an ASP version of that Proxy Script we wrote ourselves with some tweaks. Our script handles the authentication via a Hashtag we included in the WMS Client Calls. The HashTag is set into a database at the Application Level User Login and removed at LogOut or Timeout. It is sent to the client via Ajax ...


2

I use GeoServer in OpenGeo Suite 4.1. In this package, the "Service access rules list" page has a rule that only "ADMIN" roles have permission for WFS-Transaction. wfs.Transation --> ADMIN You must delete this rule.


2

I was having the same exact problem. What finally worked for me is adding the following to the ROOT site and NOT the application for the web adapter. Does it make sense? Not to me. But it worked for me. <?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <httpProtocol> <customHeaders> ...


1

You want to look into ArcGIS Portal. It is a server extension. They describe it as Portal for ArcGIS gives your organization a platform for managing all of its geospatial content. It enables secure and private sharing within the organization and leverages mobile, server, and desktop clients. It is ideal if you have high confidential and proprietary ...


1

We decided to use our own proxy to achieve authentication. Details on the first version of the proxy can be seen here Essentially we use a standard login using Ajax against our client database over https. We return a Guid, which is stored in a table on the server, to the JavaScript and modified the proxy code given above to validate back against the ...


1

It turns out that this is not possible. ArcGIS can authenticate by Windows Authentication OR token authentication - but not both at the same time. So there is no way to obtain a token using Windows Authentication.


1

You can use a proxy page: https://developers.arcgis.com/javascript/jshelp/ags_proxy.html and embed the security token in there. (or possibly even have it check one out for you with the proper credentials)


1

Take a look at this example I wrote a while back, https://github.com/andrewxhill/cartodb-examples/blob/gh-pages/private-maps/index.html It would present you with a form where you drop your api-key and it will create the map. You can use it as a starting point if you just want to write your api_key directly into the file. The way to do it in the library ...


1

It means integrating stick into the SDK application, in order to use server-side javascript. https://github.com/hns/stick https://github.com/boundlessgeo/suite/blob/master/geoexplorer/pom.xml#L79:L85 The best I can advise is to look at how this is done in GeoExplorer.



Only top voted, non community-wiki answers of a minimum length are eligible