GeoServer authentication key not working as expected

Question

I'd like to secure access to my layers published on GeoServer 2.21.1. running on Apache Tomcat Version 9.0.65.

What I want

My goal is to create a user who is the only one who can read the layers of a specified workspace. To do this, I've tried without success all three methods explained here https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey which are Key provider using user properties, Key provider using a property file and Key provider using an external web service. I prefer to use a property file, so I'll continue to explain what I've done with this method, but if anyone knows how I can get the desired result with another method, I'll be interested.

What I did

I installed the Key authentication extension corresponding to my version of GeoServer here: https://geoserver.org/release/2.21.1/

To do the following I relied on the official GeoServer documentation (https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey) and on the topic Accessing GeoServer with encrypted password?.

First, I created an XML user group service called testservice, to which I added a user named bob and gave him a password. I assigned the role ADMIN to bob.

Under Authentication then Authentication Providers I created a new provider (username password), choosing testservice as the group. Next, under Authentication then Authentication Filters, I created an authentication key as shown below.

When I clicked on the synchronize button, an authkeys.properties file was created with a key for my user bob. In the Data Security tab, I created a new rule, indicating the desired workspace and a layer (just one to start with for testing purposes), selecting read as the access mode and adding admin as the role.

Result

When I'm logged in as a bob and go to Layer Preview, the desired layer is displayed as expected by clicking on OpenLayers next to it. But this doesn't work when I copy the link, log out and paste the link, with the key of the user bob added, with following format:

https://XXX/geoserver/workspace/wms?service=WMS&request=GetMap&layers=workspace%LAYER&bbox=XXX&width=768&height=729&srs=EPSG%3A2154&format=application/openlayers&authkey=BOB'SKEY

This is what I get :

<ServiceExceptionReport version="1.3.0" xsi:schemaLocation="http://www.opengis.net/ogc https://XXX/geoserver/schemas/wms/1.3.0/exceptions_1_3_0.xsd">
<ServiceException code="LayerNotDefined" locator="layers">
Could not find layer WORKSPACE:LAYER
</ServiceException>
</ServiceExceptionReport>

The result is the same when choosing other data formats or other layers (both raster and vector) in the rule created under Data Security. The result is also the same if I use admin instead of user bob.

What did I do wrong? Why don't I get the expected result which is to access the chosen layer using the authentication key?

Answer 1

While testing, I used the default User/Group Service, as I don't necessarily need to create a new one. I finally figured out what the problem was. Turns out I hadn't done the following:

1. Under Services, I had to add a new rule where service is * and method is * with roles ROLE_AUTHENTICATED and ROLE_ANONYMOUS selected.
2. Then under Authentication, I had to modify the default filter chain by checking "Allow creation of an HTTP session for storing the authentication token" and selecting the authkey role.

Applying the same procedure to another User/Group Service should also work.