I'm trying to connect my QGIS to a WCS service using OAuth2 authentication (see curl example below to understand the authentication workflow).

the problem

The option "add WCS layer" seemed to be the obvious right choice, but the OAuth2 authentication makes it difficult. I would need to

  1. get an access token
  2. add this token to the http header along with the actual wcs request

Now. When I try to connect using "add wcs layer", I can choose to enter a username and password for basic auth, but I just cannot find any possibility to use the OAuth2 authentication protocol.

curl example

Using curl, the whole thing works as follows:

curl -i -H "Content-Type: application/x-www-form-urlencoded" -X POST -d "grant_type=client_credentials&scope=<myTestScope>&client_id=<myClientId>&client_secret=<myClientSecret>" <https-urlToGenerateToken>

I get as a repsonse my token in json format:

{ "token_type":"Bearer", "access_token": <myToken>, "expires_in":3600, "scope": <myTestScope> }

This, I can then use to call the service:

curl -i -H "Authorization: Bearer <myToken>" <wcsURL>/getCapabilities

the question

Is there a standard way to use this OAuth2 authentication workflow in qgis when connecting to a service, and I just couldn't find it? If there is no standard way, can I somehow "hook in" and add custom headers?

Edit - Tried GDAL driver:

As suggested in the comments section, I tried to use the GDAL driver. I didn't quite figure out how to use it from within QGIS (but I assume it's possible). Instead, I tried it from the command line (creating the respective xml-file and calling gdalinfo file.xml).

  • Could connect to the test server (no authentication)
  • Could connect to the server when using Basic Auth, by adding the <UserPwd> tag as documented in the GDAL Driver doc.
  • The problem with OAuth2 is still not solved. Setting <HttpAuth> to ANY and stuff doesn't work. Also, this makes total sense, as I would really need to make 2 different calls (1. token, 2. wcs-request) to two different url's, but the GDAL Driver accepts only one ServiceURL.
  • Did you see if you could do it with the GDAL WCS driver? – nmtoken Dec 12 '16 at 11:36
  • Thanks for the input, nmtoken. :) I now tried, and greatly failed with this, too... See the edit above. – misch Dec 12 '16 at 15:58
  • C'est la vie! (but I assume it's possible), yes, once you have created the XML file you can Load it in QGIS, through the Add layer(s) from a WCS Server – nmtoken Dec 12 '16 at 17:23
  • Indeed, found that option, thanks. The original problem remains. My next steps would go towards Authentication plugins (see "Authentication Methods" here: docs.qgis.org/2.14/en/docs/user_manual/auth_system/…). Hopefully won't have to make the effort of writing one myself. At least for QGIS server, they seem to have some OAuth stuff. Will keep you posted. – misch Dec 13 '16 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.