I'd like to secure access to my layers published on GeoServer 2.21.1. running on Apache Tomcat Version 9.0.65.
What I want
My goal is to create a user who is the only one who can read the layers of a specified workspace. To do this, I've tried without success all three methods explained here https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey which are Key provider using user properties, Key provider using a property file and Key provider using an external web service. I prefer to use a property file, so I'll continue to explain what I've done with this method, but if anyone knows how I can get the desired result with another method, I'll be interested.
What I did
I installed the Key authentication extension corresponding to my version of GeoServer here: https://geoserver.org/release/2.21.1/
To do the following I relied on the official GeoServer documentation (https://docs.geoserver.org/main/en/user/extensions/authkey/index.html#authkey) and on the topic Accessing GeoServer with encrypted password?.
First, I created an XML user group service called
testservice, to which I added a user named
bob and gave him a password. I assigned the role
Under Authentication then Authentication Providers I created a new provider (username password), choosing
testservice as the group.
Next, under Authentication then Authentication Filters, I created an authentication key as shown below.
When I clicked on the synchronize button, an
authkeys.properties file was created with a key for my user
In the Data Security tab, I created a new rule, indicating the desired workspace and a layer (just one to start with for testing purposes), selecting
read as the access mode and adding
admin as the role.
When I'm logged in as a
bob and go to Layer Preview, the desired layer is displayed as expected by clicking on OpenLayers next to it. But this doesn't work when I copy the link, log out and paste the link, with the key of the user
bob added, with following format:
This is what I get :
<ServiceExceptionReport version="1.3.0" xsi:schemaLocation="http://www.opengis.net/ogc https://XXX/geoserver/schemas/wms/1.3.0/exceptions_1_3_0.xsd"> <ServiceException code="LayerNotDefined" locator="layers"> Could not find layer WORKSPACE:LAYER </ServiceException> </ServiceExceptionReport>
The result is the same when choosing other data formats or other layers (both raster and vector) in the rule created under Data Security. The result is also the same if I use
admin instead of user
What did I do wrong? Why don't I get the expected result which is to access the chosen layer using the authentication key?