3

I need to restrict access to WFS services on admins only, so in the Services Access Rules list I add the following rule

wfs.*=ADMIN

Then I logged in as an ADMIN, and try to excute one of the WFS requests from the demos, but the request return asking me for login credentials. I tried login with the root user, the same problem happens !!

Here are my security configurations:

config.xml:

<security>
  <roleServiceName>default</roleServiceName>
  <authProviderNames>
    <string>default</string>
  </authProviderNames>
  <configPasswordEncrypterName>pbePasswordEncoder</configPasswordEncrypterName>
  <encryptingUrlParams>false</encryptingUrlParams>
  <filterChain>
    <filters name="web" class="org.geoserver.security.HtmlLoginFilterChain" interceptorName="interceptor" exceptionTranslationName="exception" path="/web/**,/gwc/rest/web/**,/,/wcs*,/wfs*" disabled="false" allowSessionCreation="true" ssl="false" matchHTTPMethod="false">
      <filter>rememberme</filter>
      <filter>form</filter>
      <filter>anonymous</filter>
    </filters>
    <filters name="webLogin" class="org.geoserver.security.ConstantFilterChain" path="/j_spring_security_check,/j_spring_security_check/" disabled="false" allowSessionCreation="true" ssl="false" matchHTTPMethod="false">
      <filter>form</filter>
    </filters>
    <filters name="webLogout" class="org.geoserver.security.LogoutFilterChain" path="/j_spring_security_logout,/j_spring_security_logout/" disabled="false" allowSessionCreation="false" ssl="false" matchHTTPMethod="false">
      <filter>formLogout</filter>
    </filters>
    <filters name="rest" class="org.geoserver.security.ServiceLoginFilterChain" interceptorName="restInterceptor" exceptionTranslationName="exception" path="/rest/**" disabled="false" allowSessionCreation="false" ssl="false" matchHTTPMethod="false">
      <filter>basic</filter>
    </filters>
    <filters name="gwc" class="org.geoserver.security.ServiceLoginFilterChain" interceptorName="restInterceptor" exceptionTranslationName="exception" path="/gwc/rest/**" disabled="false" allowSessionCreation="false" ssl="false" matchHTTPMethod="false">
      <filter>basic</filter>
    </filters>
    <filters name="default" class="org.geoserver.security.ServiceLoginFilterChain" interceptorName="interceptor" exceptionTranslationName="exception" path="/**" disabled="false" allowSessionCreation="false" ssl="false" matchHTTPMethod="false">
      <filter>basic</filter>
    </filters>
  </filterChain>
  <rememberMeService>
    <className>org.geoserver.security.rememberme.GeoServerTokenBasedRememberMeServices</className>
    <key>geoserver</key>
  </rememberMeService>
  <bruteForcePrevention>
    <enabled>false</enabled>
    <minDelaySeconds>1</minDelaySeconds>
    <maxDelaySeconds>5</maxDelaySeconds>
    <maxBlockedThreads>100</maxBlockedThreads>
    <whitelistedMasks>
      <string>127.0.0.1</string>
    </whitelistedMasks>
  </bruteForcePrevention>
</security>

layers.properties:

*.*.a=ADMIN
mode=HIDE

services.properties:

*.*=*
wfs.*=ADMIN
Improve this question
2
  • currently, I think the demos page always asks for a login - try with CURL or other program to test access constraints
    – Ian Turton
    Commented Jan 29, 2018 at 13:20
  • Thank you very much Ian, the problem was as you mentioned from the demos page.
    – Faz B
    Commented Jan 29, 2018 at 13:31

1 Answer 1

Reset to default
5

The demos page (at least in recent versions) always asks for a login. If you want to get a clear view of permissions you should use CURL or another program to test it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.