Geoserver and Geofence - using custom rules

Question

I've checked all the options of the rule creation in GeoFence Embedded (integrated with GeoServer) and GeoFence Standalone web application. The available options for building data access rules seem to be limited to: username, user's role, service name, request name, workspace and layer. The additional option is to limit the access with the geographical area.

Is there a way, using GeoServer and GeoFence, to make rules more specific, as in the following examples:

1. Restricting access to a group of features from a layer, which belong to the selected bigger layer (show only cities from a selected state)
2. Using CQL expressions in GeoFence rules with system variables (showing only features from a layer which have in one attribute the username of the logged-in, using GeoFence authenticator, user)

Answer 1

Rules can also filter by the caller's IP address, as described here: https://github.com/geoserver/geofence/wiki/Main-concepts#rules

1. you can restrict the set of returned features by using a CQL filter. Once you define a layer in a rule, the "detail" button will become active. Pressing it, a dialog will be displayed where various settings can be set for the rule. Among these, there is a textarea where you can enter the CQL filter. More info here: https://github.com/geoserver/geofence/wiki/Main-concepts#constraints.

2. the CQL string is reported as-is to GeoServer, and no parsing or token substitution is performed on it.

Answer 2

Thank you Emanuele!
You've helped me and in the meantime I've found additional solutions:

1. Cross-layer filtering using querylayer GeoServer extension:
   http://docs.geoserver.org/stable/en/user/extensions/querylayer/index.html
2. Probably not possible without source code changes.