I am using geoserver that publises WMS, WFS services to clients. I am using geoserver services in an OpenLayers application. My application will requiere username and password authentication.

1 - For example I have a polyline data published WMS. If a user is working on Arizona, she/he can see only Arizona polylines. Can I configure this on geoserver. Or should I do on application?

2- Geoserver admin panel is including Users/Groups/Roles menu. Should I use this users and roles in OpenLayers applicaiton?

How can I specify the security way?

closed as too broad by PolyGeo May 17 '18 at 23:00

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    The geofence project may help. I'd start with reviewing the talk that Mauro did on it at FOSS4G - vimeo.com/106221740 – BradHards Oct 1 '14 at 11:24

One approach would be to implement a Proxy like this that could verify a users credentials as logged in using session variables and only allow them to access resources they are entitled to, ie: check the url for the layers that are being called and deny access if user is not authorized to view them.

In terms of what data they may see, if it is a subset of a larger data set, this is a little more complicated but I see two approaches ..

  1. Use Parameterized SQL Views to control what data the user would see. You could use the Proxy to change the url before it is passed to Geoserver with the parameters specific to that user. You could also send the parameters back to Openlayers via an Ajax Call after the user is authenticated and supply the parameters as part of the WMS getMAP call in OpenLayers. The actual data displayed could be handled by Variable substitution in SLD to filter data displayed or by using External Styles in your WMS getMap calls to change the SLD a user uses to display a given layer.

  2. Use an Ajax Call after User Authentication to specify Map Extents to only allow the user to mover around a specified area. You could also use layerVisibility() to restrict what data could be displayed as well.

Not the answer you're looking for? Browse other questions tagged or ask your own question.