Single Sign-On for GeoServer WMS layer request

Question

I'm new to GeoServer, and I've successfully created WMS layers within GeoServer. These layers are currently accessible in my web application using Leaflet. Now, my goal is to enhance the security of these layers. To achieve this, I've introduced new user accounts and roles in GeoServer, granting access to specific layers based on these roles. Here's where I'm encountering an issue: When I'm logged into GeoServer in one browser, the WMS layers function correctly within my web application. However, if I attempt to access the same layers in a different browser where I'm not logged into GeoServer, I encounter an error. My web application has its authentication system in place.

How can I implement Single Sign-On (SSO) to allow seamless access to these WMS layers, considering my web application's existing authentication system?

Answer 1

Geoserver supports header authentication. Using that you send the already authenticated user's username in an HTTP header. In that way you can authenticate your users any way you want. You can also add which groups the user belongs to in another HTTP header if your authentication system supports role based authentication.

If you are accessing Geoserver directly from your client side you need to find a way to add the header to each request and make sure that the name of the HTTP header can not be read by reading the code client side or eavesdropping the conversation.

Safest way to implement a header authentication scheme is to create a reverse proxy that handles the SSO of your choice and adds the header server side. One way is to deploy the application and the Geoserver proxy on the same site so they can share cookies and set a server side cookie containing the username. In that way the name of the header is never compromised.

It is hard to give a precise answer not knowing which SSO and server environment you are using, but this is a general approach. There may be other ways more suitable to your needs.