I’m having trouble getting users-roles-data access rules correctly configured in the Boundless Suite 4.9.1.  The issue appears to be with Composer, not Geoserver.

BLUF:  I want 2 separate editors for 2 separate workspaces – I don’t want either to be able to upload data, view, make maps, edit or delete data in the other workspace. I can’t prevent a user from viewing or uploading data to a workspace.   Simple use case, in Composer I want:

  1. One user to be able to edit a private workspace, but not view or edit data in the public workspace.

  2. One user who is able to edit a public workspace, but not view or edit data in the private workspace.

I am testing behavior by seeing if users can upload data and view data in the workspaces based on their permissions. My goals is that the public user would not be able to upload data to the private workspace and vice/versa. I started with the following data access rules:

enter image description here

There is a 1:1 correspondance between the privateEditor user and the c1_role_privateEdit and between the publicEditor user and the c1_role_publicEdit  In this case both users can upload, view and delete data in both workspaces. I assume the access rules are where the problem is but I have tried every configuration I can think of:

1.      I have locked the write access down for the admin user but no effect.

 enter image description here (..R=*; ..w=admin,groupAdmin);

2. Adding read permission to any user to any workspace results in no longer being able to upload data to that workspace, even if they also have write permission. For example I add read permission to the private user in the private workspace (C1_private..w, C1_private..r) – which the private user is not able to upload data to the private workspace but the public user can still upload data to the private workspace. When I restrict the Admin user to read access (..r=admin,groupAdmin) due to inheritance the other users are unable to upload data to any workspace.

  1. I have added additional admin privileges to the private user (C1_private.*.a) for the private workspace, and the public user for the public workspace with no effect.

  2. I have tried making he role_publicEdit the parent to role_privateEdit with no effect.

  3. I’ve tried locking services under the unlikely hypothesis that uploading and deleting may call WFS or WPS but service level permissions are granted on all workspaces and I want to restrict specific users to specific workspaces.

  4. I looked at the application calls to see if I needed to lock down permissions in the rest.properties XML but as far as I can tell uploading and downloading are not running through the rest api. I have tried setting up every combination of r, w, and a for users to those workspaces as the admin user in Geoserver but no matter what I do, within Composer each editor can see, upload to, and delete from workspaces that are not assigned to them. 

Is there another setting that I need to be looking at in order to lock down the security in Composer? Are uploads and delete considered write functions, or admin functions?