I'm new to GeoServer, and I've successfully created WMS layers within GeoServer. These layers are currently accessible in my web application using Leaflet. Now, my goal is to enhance the security of these layers. To achieve this, I've introduced new user accounts and roles in GeoServer, granting access to specific layers based on these roles. Here's where I'm encountering an issue: When I'm logged into GeoServer in one browser, the WMS layers function correctly within my web application. However, if I attempt to access the same layers in a different browser where I'm not logged into GeoServer, I encounter an error. My web application has its authentication system in place.

How can I implement Single Sign-On (SSO) to allow seamless access to these WMS layers, considering my web application's existing authentication system?

  • Welcome to Geographic Information Systems! Welcome to GIS SE! We're a little different from other sites; this isn't a discussion forum but a Q&A site. Your questions should as much as possible describe not just what you want to do, but precisely what you have tried and where you are stuck trying that. Please check out our short tour for more about how the site works
    – Ian Turton
    Commented Sep 26, 2023 at 10:10
  • 1
    There are many SSO systems out there, which one are you using? is there a geoserver extension for yours? did you install that extension? It sounds like GeoServer is working exactly as you have asked it to with regards to access
    – Ian Turton
    Commented Sep 26, 2023 at 10:12

1 Answer 1


Geoserver supports header authentication. Using that you send the already authenticated user's username in an HTTP header. In that way you can authenticate your users any way you want. You can also add which groups the user belongs to in another HTTP header if your authentication system supports role based authentication.

If you are accessing Geoserver directly from your client side you need to find a way to add the header to each request and make sure that the name of the HTTP header can not be read by reading the code client side or eavesdropping the conversation.

Safest way to implement a header authentication scheme is to create a reverse proxy that handles the SSO of your choice and adds the header server side. One way is to deploy the application and the Geoserver proxy on the same site so they can share cookies and set a server side cookie containing the username. In that way the name of the header is never compromised.

It is hard to give a precise answer not knowing which SSO and server environment you are using, but this is a general approach. There may be other ways more suitable to your needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.