2

GeoServer UI (http://localhost:8080/geoserver/web/) provides the means to configure the security of layergroups by granting read/write access to various roles. I would assume that the UI is simply a front-end on the REST API and that everything which can be achieved through the UI, can also be achieved via REST API directly.

I've tried a GET request on http://localhost:8080/geoserver/rest/security/acl/layergroups but received an error 404. This is to be expected, for according to the following API references, there is no endpoint for layergroups ACL:

It would be nice if there were a separate endpoint for layergroups ACL. Apparently, after enabling read/write access of myrole to mylayergroup via GeoServer UI, the layergroups ACL settings show up in a GET request to the layers ACL:

GET http://localhost:8080/geoserver/rest/security/acl/layers
{'*.*.r': '*', '*.*.w': 'GROUP_ADMIN,ADMIN', 'mylayergroup.r': 'myrole', 'mylayergroup.w': 'myrole'}

However, GeoServer seems to expect layers ACL rules in the following format:

{'myworkspace.mylayer.r': 'myrole', 'myworkspace.mylayer.w': 'myrole'}

I tried a POST request with JSON payload in the same format as the UI seemed to have used, and got an error 422:

POST http://localhost:8080/geoserver/rest/security/acl/layers
JSON: {'mylayergroup.r': 'myrole', 'mylayergroup.w': 'myrole'}


<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
    <title>Error 422 Invalid rule mylayergroup.r, the expected format is workspace.layer.mode=role1,role2,...</title>
  </head>
  <body>
    <h2>HTTP ERROR 422</h2>
    <p>Problem accessing /geoserver/rest/security/acl/layers. Reason:
      <pre>    Invalid rule mylayergroup.r, the expected format is workspace.layer.mode=role1,role2,...
      </pre>
    </p>
    <hr>
      <a href="http://eclipse.org/jetty">Powered by Jetty:// 9.4.18.v20190429</a>
    <hr/>
  </body>
</html>

How to configure the layergroups ACL via REST API?

Improve this question

1 Answer 1

Reset to default
3

Indeed it seems impossible to add a rule via the REST API without providing a workspace. The easiest solution would be to assign your Layer Group to a workspace and make the request as suggested in your comment like this:

{'myworkspace.mylayergroup.r': 'myrole', 'myworkspace.mylayergroup.w': 'myrole'}

If that's not an option for you, you will have to add the rules on a per-layer-basis. Or you can try to prepend a dot right before mylayergroup.w and make the request look like this:

{'.mylayergroup.r': 'myrole', '.mylayergroup.w': 'myrole'}

This request returned a 200 response for me (Geoserver version 2.18) and the rule showed up in the GET request (http://localhost:8080/geoserver/rest/security/acl/layers.xml), but it's not visible in the GUI and I haven't tested whether or not the rule is actually applied correctly.

Also make sure that your workspace, layergroup or layer don't contain any dots in their names, since that will otherwise also give you the above mentioned 422 error response.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.