Restrict only a layer instead of giving the whole service?

Question

Scenario (example):

I have a database called MYDB linked to GeoServer. In GeoServer I have a workspace called A where A has a store connected to my MYDB. In section layers I published four layers called waters, buildings, roads and people.

How can I provide an URL for each published layer separately.

For example, for layer waters I will have the following WMS URL: http://localhost:8080/geoserver/geonode/wms?service=WMS&version=1.1.0&request=GetMap&layers=A:waters

When I connect this URL into QGIS it will connect to the whole workspace.

How can I ensure that it only will display one specific layer or group of layers?

Note that if I call in OpenLayers it will filter only the specific layer but in QGIS it will connect with the entire workspace.

Answer 1

You can use GeoServer's virtual service endpoints to do this. For example, if your normal WMS endpoint is http://localhost:8080/geoserver/wms , you can use http://localhost:8080/geoserver/A/wms for just the layers in the A workspace.

You can also use http://localhost:8080/geoserver/A/people/wms for just the single A:people layer.

This isn't totally secure though, so if you are worried about any access of other layers, you should set up some security rules.

Answer 2

Another option is to turn off option 'Advertised' in layer properties, so it won't be shown in any properties document and any of software using properties will not know about it (e.g. it will not be shown in QGIS wms properties). To display a layer user have to know his name...

Of course keep in mind this is not restriction - in this case you can still display this layer in OpenLayers or any other software when you'll give it's name directly since it's not disabled only not advertised.