In order to use a secured WMS service in a mapfile, one can directly provide credentials as follow:
LAYER NAME "topic-infra-service" TYPE RASTER STATUS ON CONNECTION "https://server.com/path/to/topic/wms?" CONNECTIONTYPE WMS MINSCALEDENOM 1 MAXSCALEDENOM 2000 METADATA "wms_srs" "EPSG:2056" "wms_name" "infrastructure-layer" "wms_server_version" "1.3.0" "wms_format" "image/png" "wms_auth_type" "basic" "wms_auth_username" "<username>" # <----- service clear user name "wms_auth_password" "<password>" # <----- service clear user password "wms_exceptions_format" "application/vnd.ogc.se_xml" END END
The idea here is naturally not to have these values clearly exposed in the mapfile.
Hence, I'm studying a way to pass those parameters directly from environment variables (e.g from a .env file).
There seems to be a way to feed the LAYER an encrypted password using an encryption key as described here: https://mapserver.org/utilities/msencrypt.html
But this seems to exclusively rely on a file which contains the encryption key, unless I missed something:
To encrypt a string:
msencrypt -key [key_filename] [string_to_encrypt]
Therefore, in order to decode the
string_to_encrypt, e.g. a password or a database connection string, one has to specify the path of the key file as the
MS_ENCRYPTION_KEY variable in the mapfile.
And as I'm working in a dockerized environment, I need to directly make use an environment variable containing the encryption key instead of a file when defining this
MS_ENCRYPTION_KEY var in the mapfile. Is this possible? If yes, how?
The Docker image running mapserver already starts the web server. I cannot modify the Dockerfile, but I can modify the compose file which spins the mapserver service based on this image. After some attempts, it seems that any custom commands or entrypoint (such as one building the key.file from an environment variable passed to the compose service) overrides the mapserver server process itself, crashing it. That's why I want to directly use the environment variable.