I´m using GeoNode 2.4, which uses GeoServer 2.7 and allows GeoNode staff and admin users to access GeoServer admin panel. My aim is to make some layers in GeoNode only downloadable by a few GeoNode users, and only accessible via WFS to those few users, while keeping all other layers free to everyone else. I can manage the GeoNode download permission, but the layers are still accessible in WFS service (any user can load them and "save as"). Here´s what I´v done:
I separated those layers in a new created workspace and created a new role. Then made a rule that allows reading the new workspace only to that role and admin. Now I should assign that role to those specific GeoNode users, but I don´t know how to. In GeoServer admin panel I can´t even see the list of GeoNode users (even when I can log in to the GeoServer panel using GeoNode user credentials). When accessing WFS with a regular geonode user, I can´t see the restricted layers (which is fine) and when accessing with admin geonode user I can see all layers (which is fine too). I don´t want to give admin privileges to those users so they can access the restricted layers via WFS.