3

In our organisation we share QGIS projects with one and another. We have a subscription for a WMS-server and this subscription is used in every project within the company. This subscription is protected with Basic Authentication (Username + PW). This Username and Password can also be used to buy additional products or change settings with the supplier

When Sharing a project with somebody else the Username and PW is also shared and everybody with this password can change settings or buy additional products. This is a security risk.

Basic Authentication

Is there a way that the Username and Password are encrypted do other users of the Project can access the WMS server but are not able to see its credentials?

2
  • 1
    Wouldn't using Fiddler or such still reveal the credentials? I believe it is cosmetic security here.
    – JGH
    Nov 13, 2023 at 12:11
  • You can restrict access by IP
    – nmtoken
    Nov 14, 2023 at 12:51

2 Answers 2

3

One way to avoid this is to use GeoServer to cascade the WMS service through to internal users. This way only GeoServer (and it's admins) knows the user name and password for the external service. If necessary you can lock down access to your GeoServer service using a simple IP restriction or by providing local access accounts on the GeoServer, this includes the ability to make use of an existing LDAP or OAUTH service.

This also has the added bonus of allowing you to cache the tiles being requested from the remote service providing greater speed for your internal users and possibly a reduced usage cost to you.

2
  • Unfortunately Geoserver is JAVA based, Java is blocked by our IT department.
    – OvdE
    Nov 13, 2023 at 12:24
  • 2
    MapProxy would work too - but blocking java completely seems to be a trifle paranoid even by the standards of corporate IT
    – Ian Turton
    Nov 13, 2023 at 13:20
2

Use QGIS' built-in authentication system instead. If you create an authentification entry for that WMS service using the same name on each of your users' systems, then they can load their layers using that auth entry and have projects work all across your company. In the project files only the name/id of the auth entry would exist, not the actual login credentials.

https://docs.qgis.org/3.28/en/docs/user_manual/auth_system/auth_workflows.html

4
  • 1
    Hi bugmenot123 I tried this. And indeed In the properties of a Layer in the project file. only the 7 characters authorization entry code is visible. So far so good. But when the project is opened on another PC it requests the Authorization file. If you transfer this file Via Setting>Options>Authentication>Utilities>Export selected authentication to file. and import that on the other PC. Then the project works ok. But the Credentials are also visible in this settings/options.
    – OvdE
    Nov 13, 2023 at 13:00
  • Could you update your question to fully specify what scenario you have in mind? Who is trusted, who is not, etc. Nov 14, 2023 at 8:51
  • 1
    Only the account owners are trusted, (2 persons) All users are not trusted and should not have access to the login credentials.
    – OvdE
    Nov 16, 2023 at 8:59
  • In that case follow Ian's great suggestion to use a proxy service. Nov 16, 2023 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.