How to put GeoServer layers behind authentication?

Question

I want to publish map layers using OpenLayers and GeoServer. While this is easy enough to set up, I'm a bit lost when it comes to authentication possibilities. What I want is to create different users that will, by logging in with their own user name and password, be directed to their own map window. How can this be securely done so that none of my users will be able to access each other's layers?

I have understood that it is quite easy to "hack" the setup by, for example, making queries to the GeoServer where one simply asks it to list all the available layers.

What are my options? I suppose apache could be of help when setting it up in my ubuntu server? Any tutorials on this subject?

Answer 1

First of all, I think you should read the Geoserver documentation on Security. http://docs.geoserver.org/stable/en/user/security/index.html you will discover it is possible to make layers accessible/inaccessible to different users or roles.

Another possible solution would be to make geoserver inaccessible from the outside world (close port 8080 on your server for IP's other then localhost) and then create an authentication mechanism yourself in the web programming language of your choice.

For instance: You could set up some sort of login/authentication in php that forwards requests to the geoserver on localhost once authenticated.

Answer 2

You could have a look at GeoPrisma

We needed to make a Web mapping application with security on sensible datasets. This could have been accomplished with multiple applications and by putting a standard login+password access to them, but the project was too big and it would have been very complex to maintain. Adding a new dataset for example would require modifications of each application manually, adjustments of the security, etc.

That’s why we decided to develop our own Web mapping application that included access control on datasets using the OpenSource Web mapping applications available.

http://geoprisma.org/dist/build/html/introduction/index.html

I'd have a scan of the documentation - it may be overkill to add this in to a simple project if you only have a few layers / users on your system. If you have 100s of users/groups with editing rights on different datasets then it probably makes sense to use an existing project such as GeoPrisma.

Otherwise standard web server security built around HTTP would probably suffice.

Answer 3

Please debug this statement

$type=$_GET['FORMAT'];

when you pass the value of FORMAT as the parameters of the URL do you get the map( image) from the server,If you are getting it, then your proxy should be working fine.

Answer 4

One approach would be to implement a Proxy like this that could verify a users credentials as logged in using session variables and only allow them to access resources they are entitled to, ie: check the url for the layers that are being called and deny access if user is not authorized to view them.

In terms of what data they may see, if it is a subset of a larger data set, this is a little more complicated but I see two approaches ..

1. Use Parameterized SQL Views to control what data the user would see. You could use the Proxy to change the url before it is passed to Geoserver with the parameters specific to that user. You could also send the parameters back to Openlayers via an Ajax Call after the user is authenticated and supply the parameters as part of the WMS getMAP call in OpenLayers. The actual data displayed could be handled by Variable substitution in SLD to filter data displayed or by using External Styles in your WMS getMap calls to change the SLD a user uses to display a given layer.

2. Use an Ajax Call after User Authentication to specify Map Extents to only allow the user to mover around a specified area. You could also use layerVisibility() to restrict what data could be displayed as well.

Answer 5

1. First create a Proxy URL(in your programming Language).
2. This Proxy URL will hit to geo-server.
3. In this proxy URL , you can do the authentication with Users & Page refferes. You can check that url is being referred from your webApp or Not. If not simply send an Unauthorized Header.
4. You will hit this proxy URL instead of of your geo-server URL.
5. No one will be able to know that what is the exact url of Geoserver & he wil not be able to hack it.
6. For Security with Users, simply add a check of Users in Proxy URL.
7. From Open Layers pass the wms-url as : http://domainname.com//proxyUrl.php?user=userid