3

As a followup of this question I am wondering how to enable a certain user to be able to place HTTP PUT/POST calls to /geoserver/rest/styles/ without granting the user admin rights or disabling chain security check under Authentication->Filter chain.

With my $geoserver_home/data/security/rest.properties settings being

/rest/**;GET=ROLE_REST_READ
/rest/**;POST,PUT,DELETE=ROLE_REST_WRITE 

I assigned user 'chief' the roles 'ROLE_REST_READ' and 'ROLE_REST_WRITE'.

When doing PUT/POST calls with this credentials it will result in Status Code 405 NOT ALLOWED. GET calls however work fine. Using admin credentials or disabling REST chain security check PUT/POST calls work fine (Status Code 200). I tried changing the REST chain settings (check HTTP method, role filter) with no luck. Changing the admin role of the current role service 'default' from ROLE_ADMIN to ROLE_REST_WRITE also works, giving user chief complete admin right over the web interface however.

How/where can I edit the REST filter chain settings to not block PUT/POST calls? Please excuse me if I am missing some basic filter chain points here as I am pretty new to this topic.

1 Answer 1

1

A little late to the party but I ran into a similar issue on GeoServer 2.17.1; however, I also got an additional clue in the response:

405 Cannot edit global resource , full admin credentials required

ymmv, but I was able to resolve it by adding a workspace to the request and updating the rest.properties appropriately. For example:

  • rest/styles\?name\=my-new-style
  • rest/workspaces/ws/styles\?name\=my-new-style

Full Example

rest.properties

/rest/workspaces/*/styles*;GET,POST,PUT=ROLE_REST_WRITE
/**;GET,POST,PUT,DELETE=ROLE_ADMINISTRATOR

CURL

curl -v -K geo-curl -X POST -T my-new-style.ysld \
-H "Accept: application/json" \
-H "Content-Type: application/vnd.geoserver.ysld+yaml" \
http://localhost:8080/geoserver/rest/workspaces/ws/styles\?name\=my-new-style

Sources

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.