Should it be possible to have the AuthKey plugin installed but still deliver WMS services without needing an authkey parameter?

I have Tomcat9 running with GeoServer 2.20.2 and generally all is fine. I installed the Authkey plugin and went through various setups to get it configured and working and it does what I need for the moment, namely our WMS endpoints won't work unless there's an authkey parameter in the request string. My problem now is that I can't seem to create a WMS endpoint that will work without the authkey.

Basically I have lots of layers and I need some of them behind the Authkey system while others I want public, is this possible as I can't seem to get the idea working.

The confusion I have shows my lack of understanding of how the workspaces, layers, roles, users, authentication and security settings all interact. For the public layer(s) I've created a workspace for the layer and created the layer from a shapefile and in the security settings have selected nothing. Yet and the only way I can connect is with the authkey. For any other combination of users, roles that I set up that seem separate from the Authkey plugin it just results in the WMS giving a 403 forbidden error.

  • How have you secured the other layers?
    – Ian Turton
    Jun 3 at 17:18
  • The Authkey module seems to be getting applied to every layer across the server. So for all layers to date, which I want (reasonably) secured behind an authkey, I followed the Authkey install steps, and activation process. For every layer I create I just make sure I've selected the AuthKey user in both the Workspace and Layer security sections. And this all seems to work... If I create a new workspace, datastore and layer without selecting any user in any security section, I would have thought the layer would become publicly accessible. However that doesn't seem to be the case.
    – Diplonics
    Jun 7 at 11:51
  • Only if it ends up with anonymous read access - if for example you have restricted access for a service then all layers will be restricted
    – Ian Turton
    Jun 7 at 12:24
  • What defines a service, is it something within GeoServer or the whole GeoServer install itself. I guess I probably installed across the whole GeoServer setup, which I only have 1 of.
    – Diplonics
    Jun 7 at 14:50
  • no, a WMS or a WFS is a service. There are two options for security services or data
    – Ian Turton
    Jun 7 at 15:40


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.