I have a multi-tenant web mapping application running on ArcGIS server. I am trying to replace with geoserver. Identity of the users for tenants are maintained through another identity api. After successful login Api generates the session token through get token service for a user passing the fixed credentials. Geoserver provides Digest and http header method- but is there a way to generate unique tokens for every session- so that no information related to user authentication is hard coded in client side code and all the communication between client application and geoserver is happening with a session token similar to this: https://xxxxx/rest/services/xxxxx/MapServer/export?bbox=xxxxx&size=1393%2C85&dpi=96&format=png24&transparent=truelayers=show%3A1&token=2Cj8mUHLD5jD2fNNZ8SO-bP-94.&f=image

  • Have you read through docs.geoserver.org/stable/en/user/security ? please update your question with what you have tried so far and what is not working for you – Ian Turton Jan 6 '16 at 8:54
  • I have been looking - but so far have not found anything unique to session. – Deep Jan 6 '16 at 16:18
  • I am looking for the same solution, have you found any yet? – Downhillski Aug 27 '16 at 1:16
  • Have you guys found a solution? I need to implement the same thing. – saviour123 Feb 1 '17 at 12:16

There is a community plugin for authkey: https://docs.geoserver.org/stable/en/user/community/authkey/index.html

A sample authenticated request looks like: http://localhost:8080/geoserver/topp/wms?service=WMS&version=1.3.0&request=GetCapabilities&authkey=ef18d7e7-963b-470f-9230-c7f9de166888

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.