In order to use a secured WMS service in a mapfile, one can directly provide credentials as follow:

    NAME "topic-infra-service"
    CONNECTION "https://server.com/path/to/topic/wms?"
        "wms_srs"               "EPSG:2056"
        "wms_name"              "infrastructure-layer"
        "wms_server_version"    "1.3.0"
        "wms_format"            "image/png"
        "wms_auth_type"         "basic"
        "wms_auth_username"     "<username>" # <----- service clear user name
        "wms_auth_password"     "<password>" # <----- service clear user password
        "wms_exceptions_format" "application/vnd.ogc.se_xml"

The idea here is naturally not to have these values clearly exposed in the mapfile.

Hence, I'm studying a way to pass those parameters directly from environment variables (e.g from a .env file).

There seems to be a way to feed the LAYER an encrypted password using an encryption key as described here: https://mapserver.org/utilities/msencrypt.html

But this seems to exclusively rely on a file which contains the encryption key, unless I missed something:

To encrypt a string:

msencrypt -key [key_filename] [string_to_encrypt]

Therefore, in order to decode the string_to_encrypt, e.g. a password or a database connection string, one has to specify the path of the key file as the MS_ENCRYPTION_KEY variable in the mapfile.

And as I'm working in a dockerized environment, I need to directly make use an environment variable containing the encryption key instead of a file when defining this MS_ENCRYPTION_KEY var in the mapfile. Is this possible? If yes, how?

The Docker image running mapserver already starts the web server. I cannot modify the Dockerfile, but I can modify the compose file which spins the mapserver service based on this image. After some attempts, it seems that any custom commands or entrypoint (such as one building the key.file from an environment variable passed to the compose service) overrides the mapserver server process itself, crashing it. That's why I want to directly use the environment variable.

  • why not use an include to hold the user name and password
    – nmtoken
    Nov 14, 2022 at 9:19

1 Answer 1


MS_ENCRYPTION_KEY can only refer to a file - as the code tries to read the path from this setting: https://github.com/MapServer/MapServer/blob/f478a37305cc3646aea7fd618e27ded429367183/mapcrypto.c#L276

You can set MS_ENCRYPTION_KEY using an environment variable rather than in the Mapfile, or set it in the new CONFIG file available in MapServer 8.0

You can share a volume with Docker in order to copy the encryption file (and/or CONFIG file) to the running Docker machine without making any modifications to the Dockerfile itself - see https://stackoverflow.com/a/39415099/179520

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.