I'm having trouble with Data Security in my Geoserver 2.5 application. Let me preface my situation. I am using Geoexplorer composer which is making GeoServer API calls through ows and wms. I have multiple clients which should not be allowed to see each other's wms services. The implementation of my data security rules are scatter shot when ows and wms are used through GeoExplorer. CompanyAUser can see all layers in the CompanyAWS and 1 layer from CompanyB's ws. CompanyBUser can see 10 out of the 60 layers in CompanyA's ws. A further twist to this problem is that if I sign in as each company's user in Geoserver's webapp and I navigate to Layer Preview each user can only see the layers which I have specified that they are allowed to see in Data Security. I have made some edits to the Geoexplorer Composer code but nothing major. I don't think that this should effect the security in any way since security is implemented by the Geoserver application. I have included my security parameters below.
Groups: group, role CompanyA, COMPANY_A CompanyB, COMPANY_B CompanyC, COMPANY_C Users: user, group CompanyAUser, CompanyA CompanyBUser, CompanyB CompanyCUser, CompanyC Data rules: Roles, rule path Company_A, COMPANYAWS.*.r Company_B, COMPANYBWS.*.r Company_C, COMPANYCWS.*.r Service rules: *.* ADMIN,COMPANY_A,COMPANY_B,COMPANY_C Roles are independent and do not have parent/child relationships.
Are my roles, groups, data rules and service rules set correctly?
EDIT1 I've noticed that the only layers that are errantly shared to users belonging to different company groups are 'Group Layers'. This leads me to my next question. What causes a regular layer to be hidden and a group layer to be shown to roles that do not have permission to do so?
