GeoNode WFS - restrict some layers to certain users

Question

I´m using GeoNode 2.4, which uses GeoServer 2.7 and allows GeoNode staff and admin users to access GeoServer admin panel. My aim is to make some layers in GeoNode only downloadable by a few GeoNode users, and only accessible via WFS to those few users, while keeping all other layers free to everyone else. I can manage the GeoNode download permission, but the layers are still accessible in WFS service (any user can load them and "save as"). Here´s what I´v done:

I separated those layers in a new created workspace and created a new role. Then made a rule that allows reading the new workspace only to that role and admin. Now I should assign that role to those specific GeoNode users, but I don´t know how to. In GeoServer admin panel I can´t even see the list of GeoNode users (even when I can log in to the GeoServer panel using GeoNode user credentials). When accessing WFS with a regular geonode user, I can´t see the restricted layers (which is fine) and when accessing with admin geonode user I can see all layers (which is fine too). I don´t want to give admin privileges to those users so they can access the restricted layers via WFS.

Any help?

Answer 1

It would be better if you can use GeoNode 2.5+ / GeoServer 2.9+ with Oauth2 security and GeoServer as backend. It will prevent you to download layer data on the backend side directly.

Here you can find the GNIP for A&A refactor and realted PR

https://github.com/GeoNode/geonode/issues/2374

https://github.com/GeoNode/geonode/pull/2755

Also the detailed documentation is available on GeoNode docs here

http://docs.geonode.org/en/master/tutorials/admin/geoserver_geonode_security/index.html

Specifically about view and download permissions, here you can find the GNIP and PR:

https://github.com/GeoNode/geonode/issues/2696

https://github.com/GeoNode/geonode/pull/2698

GeoServer makes use of GeoFence advanced security subsystem in order to allow you to define fine-grained rules on layers. GeoNode handles them automatically, but you can also refine them manually via GeoServer admin interface.