I'd like to secure access to my layers published on GeoServer 2.21.1. running on Apache Tomcat Version 9.0.65.

What I want

My goal is to create a user who is the only one who can read the layers of a specified workspace. To do this, I've tried without success all three methods explained here https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey which are Key provider using user properties, Key provider using a property file and Key provider using an external web service. I prefer to use a property file, so I'll continue to explain what I've done with this method, but if anyone knows how I can get the desired result with another method, I'll be interested.

What I did

I installed the Key authentication extension corresponding to my version of GeoServer here: https://geoserver.org/release/2.21.1/

To do the following I relied on the official GeoServer documentation (https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey) and on the topic Accessing GeoServer with encrypted password?.

First, I created an XML user group service called testservice, to which I added a user named bob and gave him a password. I assigned the role ADMIN to bob.

enter image description here

Under Authentication then Authentication Providers I created a new provider (username password), choosing testservice as the group. Next, under Authentication then Authentication Filters, I created an authentication key as shown below.

enter image description here

When I clicked on the synchronize button, an authkeys.properties file was created with a key for my user bob. In the Data Security tab, I created a new rule, indicating the desired workspace and a layer (just one to start with for testing purposes), selecting read as the access mode and adding admin as the role.


When I'm logged in as a bob and go to Layer Preview, the desired layer is displayed as expected by clicking on OpenLayers next to it. But this doesn't work when I copy the link, log out and paste the link, with the key of the user bob added, with following format:


This is what I get :

<ServiceExceptionReport version="1.3.0" xsi:schemaLocation="http://www.opengis.net/ogc https://XXX/geoserver/schemas/wms/1.3.0/exceptions_1_3_0.xsd">
<ServiceException code="LayerNotDefined" locator="layers">
Could not find layer WORKSPACE:LAYER

The result is the same when choosing other data formats or other layers (both raster and vector) in the rule created under Data Security. The result is also the same if I use admin instead of user bob.

What did I do wrong? Why don't I get the expected result which is to access the chosen layer using the authentication key?

  • try using plaintext as the "encryption" method to start out so you can see if the key is correct
    – Ian Turton
    Commented Aug 2, 2023 at 15:52
  • You need to turn up the logging level to developer in the global settings page, and then make the request again. Then edit your question with the relevant part of the log file.
    – Ian Turton
    Commented Aug 2, 2023 at 15:52

1 Answer 1


While testing, I used the default User/Group Service, as I don't necessarily need to create a new one. I finally figured out what the problem was. Turns out I hadn't done the following:

  1. Under Services, I had to add a new rule where service is * and method is * with roles ROLE_AUTHENTICATED and ROLE_ANONYMOUS selected.
  2. Then under Authentication, I had to modify the default filter chain by checking "Allow creation of an HTTP session for storing the authentication token" and selecting the authkey role.

Applying the same procedure to another User/Group Service should also work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.