0

I have two colleagues that now need read-permission on a layer. The previous GIS engineer had already created in pgAdmin:

  • Two login Roles (for these two colleagues)
  • One group role _read

so I put those two login roles as members of the read role. And the read role is already a privilege for the layer (table) in pgAdmin.

The layer in question is published via GeoServer but the two colleagues still do not see the layer.

Our GeoServer "reads" the Active Directory groups. The login role names in pgAdmin are written the same than in the AD accounts.

I do not understand if I need to do something with the permissions in GeoServer maybe and what to do?

I do not understand how the AD account are linked to the login role in pgAdmin.

Improve this question
5
  • 1
    have you worked through the turtorial before attempting to modify a poorly documented production system?
    – Ian Turton
    Commented Sep 16 at 14:30
  • Note that this is a PostgreSQL issue, not a PostGIS one (the former is a database, the latter a geometry extension for the former)
    – Vince
    Commented Sep 16 at 18:01
  • Thanks Vince, it is PostgreSQL I meant indeed. Thanks @IanTurton for the tutorial, I think I understood quite well now how the link is made between Active Directory and our GeoServer. But questions remains : In Active Directory I can put different AD user in an AD group. In PostgreSQL I give permission to a login role. In GeoServer I give permission to an AD group (which has AD users in it). How does this login role (in Postgre) relate to an AD user? What is the relationship between the permission I give in Postgre and AD. I don´t get it.
    – PGeo
    Commented Sep 17 at 10:08
  • OK, next I recommend my talk from a few years back on this topic vedio slides
    – Ian Turton
    Commented Sep 17 at 10:32
  • Thank you @IanTurton for sharing this very interesting talk. A few clarifications: I manage my "GIS groups" directly in our Active Directory, IT has given me access to add or remove AD users in each group. My users do not need to log in to pgAdmin. So I guess no need for ldap-sync or anything like that. I use pgAdmin to manage the permissions on each table. These are later published via geoServer. I am trying to answer the question "How does a login role (in pgAdmin) relate to an AD user?" Is it enough to create a user on each system with the same login name? or how are they related?
    – PGeo
    Commented Sep 17 at 12:18

1 Answer 1

Reset to default
1

As far as I know, GeoServer can not forward any credentials to the database. It uses a static application user login defined in the store settings in GeoServer. So it is that user that should have access to the data in Postgres.

In Geoserver then you set up the access rules to match your groups access levels. Provided that you already have a Role service set up that fetches roles from AD you can set the desired role to have read access on the layers in question. And when the user authenticates themselves as their AD-users they will get access if the are in fact members of the AD-group.

Improve this answer
2
  • thanks @Stefan, I think I now understand how GeoServer "knows" which permissions are linked to which AD user. The thing I can't understand is how a user (login role) is created in Postgre for Active Directory to know which AD user it is linked to? In other words: In Active Directory I can put a different AD user in an AD group. In Postgre I give permission to a login role. In GeoServer I give permission to an AD group (which has AD users in it). How does this login role (in Postgre) relate to an AD user? What is the relationship between the permission I give in Postgre and AD.
    – PGeo
    Commented Sep 17 at 9:59
  • If your users only access the data through geoserver you don't have to do anything in Postgres for each user. You only have one application user that Geoserver uses in order to connect and is specified in the store in Geoserver. Then set the permissions on each layer in Geoserver. If your users connect directly to the database they should have their own logins. That is a Postgres question, not a gis question. But in short if you want SSO using the AD user as login you set up SSPI authentication on your database (in pg_hba.conf) and create a login in Postgres that matches the user name in AD.
    – Stefan
    Commented Sep 17 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.