3

In Accessing secure Geoserver layer with username password I have found how to access the GetCapabilities of a protected service adding the user/password in the URL: The answer works perfectly:

http://user:password@localhost:8080/geoserver/wms?request=GetCapabilities

The problem is that I can't put the user/password information in a public metadata file for obvious reasons.

In the same question, the user who answered it said that the password can be encrypted. That would be great.

How can I get my encrypted password of GeoServer? I know that in "Settings" you can check the "Encrypted" box. What I want to know is the string of my encrypted password to add it to the URL.

The GeoServer documentation (http://docs.geoserver.org/latest/en/user/security/passwd.html) says it will look like this:

crypt1:KWhO7jrTz/Gi0oTQRKsVeCmWIZY5VZaD. crypt1

It doesn't say which tool I should use to get the string (only the encrpytion type, and I don't know what to do with that).

4
  • Can't you probably prompt the user for a password once the service should be accessed, instead of putting it somewhere public?
    – ulrich
    Sep 7, 2017 at 9:02
  • No. The metadata and the service has to be public. The metadata must have a link to the service Capabilties. To admin that service in GeoServer there is a specific user. So, to access the Capabilities always asks for user and password. That's why I need to add the user and password in the url :(
    – O.D.
    Sep 7, 2017 at 9:08
  • 1
    Another option could be using a small proxy script on your server, which knows the password. This way you could request without a password and refer to the secured service server-side. It prevents you from sharing the password on the client and it is what I use in similar cases.
    – ulrich
    Sep 7, 2017 at 9:24
  • Thanks! The proxy idea looks nice. My other option is granting WMS full access to the "ROLE_ANONYMOUS" in the service security settings. That way they can see the GetCapabilities, but they cannot edit it.
    – O.D.
    Sep 7, 2017 at 10:00

1 Answer 1

3

Unfortunately you didn't mention clearly, how you are going to use encrypted password,RESTful api or Web Admin UI.

If you want to use encrypted password in url you can use Key authentication module,When you configured that, users can login to geoserver by UUID v4 encrypted password and username.

Although this is a good method for secure username and password info, It has own risks.For instance: if someone steal authkey can login to user!,But it would be possible change authkey uuid v4 randomly and create new uuid for user manually or even programmatically.

Note: If uuid change, it does not mean user password changed also! for example: user with this info:

username:demo password:geoserver

can have many different UUIDs.

another option is keycloak extension. you can use keycloak community module also. It gives you more features,But it is so complicated in my opinion in comparison with previous module I mentioned above.

when you installed you should do these steps:

Go to Authentication in GeoServer Security section

enter image description here

Click on add new in Authentication filter

enter image description here

Config that like this, and then press Synchronizing users with the user/group service. and click on save button.

(this method is for when you want to store uuid v4 on file)

enter image description here

choose default in filter chain section and finally add authkey(name you used in previous step) to selected list, put it at the first, top of other authentication methods.

enter image description here

and then close this page and press save button at the end of Authentication page.

Eventually, you can use your authkey like explained in GeoServer key authentication module document.It need to add something like this &authkey=ef18d7e7-963b-470f-9230-c7f9de166888 at the end of your url.

Remember: you can find generated authkey(s) in

"GEOSERVER_DATA"/security/usergroup/default

in "authkeys.properties" file

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.