I'd like to secure access to my layers published on GeoServer 2.21.1. running on Apache Tomcat Version 9.0.65.
What I want
My goal is to create a user who is the only one who can read the layers of a specified workspace. To do this, I've tried without success all three methods explained here https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey which are Key provider using user properties, Key provider using a property file and Key provider using an external web service. I prefer to use a property file, so I'll continue to explain what I've done with this method, but if anyone knows how I can get the desired result with another method, I'll be interested.
What I did
I installed the Key authentication extension corresponding to my version of GeoServer here: https://geoserver.org/release/2.21.1/
To do the following I relied on the official GeoServer documentation (https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey) and on the topic Accessing GeoServer with encrypted password?.
First, I created an XML user group service called testservice
, to which I added a user named bob
and gave him a password. I assigned the role ADMIN
to bob
.
Under Authentication then Authentication Providers I created a new provider (username password), choosing testservice
as the group.
Next, under Authentication then Authentication Filters, I created an authentication key as shown below.
When I clicked on the synchronize button, an authkeys.properties
file was created with a key for my user bob
.
In the Data Security tab, I created a new rule, indicating the desired workspace and a layer (just one to start with for testing purposes), selecting read
as the access mode and adding admin
as the role.
Result
When I'm logged in as a bob
and go to Layer Preview, the desired layer is displayed as expected by clicking on OpenLayers next to it. But this doesn't work when I copy the link, log out and paste the link, with the key of the user bob
added, with following format:
https://XXX/geoserver/workspace/wms?service=WMS&request=GetMap&layers=workspace%LAYER&bbox=XXX&width=768&height=729&srs=EPSG%3A2154&format=application/openlayers&authkey=BOB'SKEY
This is what I get :
<ServiceExceptionReport version="1.3.0" xsi:schemaLocation="http://www.opengis.net/ogc https://XXX/geoserver/schemas/wms/1.3.0/exceptions_1_3_0.xsd">
<ServiceException code="LayerNotDefined" locator="layers">
Could not find layer WORKSPACE:LAYER
</ServiceException>
</ServiceExceptionReport>
The result is the same when choosing other data formats or other layers (both raster and vector) in the rule created under Data Security. The result is also the same if I use admin
instead of user bob
.
What did I do wrong? Why don't I get the expected result which is to access the chosen layer using the authentication key?
plaintext
as the "encryption" method to start out so you can see if the key is correct