Working with multiple GeoServer users¶

Users in GeoServer¶

GeoServer has the ability to create multiple user accounts. These users can have access to any aspect of GeoServer functionality, from the ability to edit the metadata for a workspace to the viewing of a capabilities document.

By default, GeoServer comes with two users:

• An administrative account (admin)—This account has the ability to read or write anything in the GeoServer catalog.
• A master, or root, account—This is an administrator account of “last resort” that is only to be used for disaster recovery purposes. This account can not be disabled or modified. See the GeoServer documentation on the root account.

In addition to the named users above, many functions are available through anonymous access, with no user account required. Functions allowed anonymously by default include viewing capabilities documents, executing GetFeature and GetMap requests, and using the Demo Request Builder.

Reasons to set up a multi-user system¶

There are good reasons to set up accounts with granular access. Many of these considerations are not unique to GeoServer, but instead apply to any security situation:

• Need-to-know basis—Not every user should have access to the same information.
• Minimizing disaster—Accounts with more fine-grained access lack the ability to accidentally (or maliciously) inflict widespread damage to the system.
• Audit trail—Sequestering access to certain GeoServer resources allows system administrators to keep track of who has made what changes.

Multi-user scenario¶

This tutorial will implement the following basic security scenario:

1. Most of the data to be served is public information, so anyone should be able to view map images.
2. Some layers contain private information (perhaps personal or confidential), so image viewing should be disallowed unless someone has specialized access to this information.
3. Only certain people should be able to edit the public layers
4. Those who can edit the public layers should be the only users able to download the data.
5. Certain other people should be able to edit the non-public layers
6. For security and bandwidth reasons, you want to disallow WPS for all users except for the administrator.
7. REST access should be enabled only for the administrator.

Based on this scenario, three accounts will need to be created:

• public_editor—This account will be able to edit the public data
• private_viewer—This account will be able to view the private data
• private_editor—This account will be able to edit the private data

Anonymous access would be retained for viewing the public data, and the administrative account would be retained for administering GeoServer. Any account that can edit (write to) data will have the ability to view (read) that data, but while private_editor is able to edit the private data, the user will not be able to edit the public data.

Configuring catalog¶

Public layers as defined above will be in a workspace called public, and private layers will be in a workspace called private.

Workspaces used in this tutorial

Creating roles¶

Having identified the scenario and determined what accounts need to be created, the next step is to create the roles that these users will be attached to when the users are created. Based on the the three accounts identified above, the roles to be created will be called ROLE_EDIT, ROLE_PRIVATE, and ROLE_PRIVATEEDIT.

Setting up roles can be done through the GeoServer web admin interface. This will assume that the default role service will be used.

1. Open up the GeoServer web interface and log in as the administrator account.

   

   Logged in as the administrator

2. Click Users, Groups, Roles under the Security column on the left side of the page.

   

   Click to open the Users, Groups, Roles area

3. Under the Role Services section, click the default role service.

   

   Click to edit the role service

4. Click the Roles tab at the top.

   

   Click to view the existing roles

5. The current list of roles will be shown. Click Add new role.

   

   Click to add a new role

6. Enter ROLE_PRIVATE in the Name field and click Save.

   

   Adding a new role

7. Repeat the process, adding two more roles, ROLE_EDIT and ROLE_PRIVATEEDIT.

   

   Full list of roles

Creating users¶

The next step is to create users and associate them with the newly-created roles. Note that at this point, the roles won’t “do” anything; that will come in a following step.

1. Click back to Users, Groups, Roles under the Security column on the left side of the page.

2. Under the User/group services section, click the default user/group service.

   

   Click to edit the user/group service

3. Click the Users tab. This will show the current list of users.

   

   Click to view the existing users

4. Click Add new user.

   

   Click to add a new user

5. Fill out the form with the following information, leaving all other fields blank:

   • In the User name field, enter public_editor.
   • In the Password field and Confirm password field, enter a password.
   • In the area titled Roles taken from active role service: default, click ROLE_EDIT and slick the right-arrow to move the role to the Selected box.
   

   Adding a new user

6. Click Save.

7. Click Add new user again and repeat the above process, creating two new users, private_viewer and private_edit, and associating them with the ROLE_PRIVATE and ROLE_PRIVATEEDIT roles, respectively.

Setting permissions¶

With users created and attached to roles, the next step is to apply security restrictions to these roles.

Refer to the above numbered list of requirements for this scenario:

Viewing permissions¶

Check that the setup is correct by comparing settings to the following configuration files.

<?xml version="1.0" encoding="UTF-8"?>
<userRegistry version="1.0" xmlns="http://www.geoserver.org/security/users">
    <users>
        <user enabled="true" name="admin" password="crypt1:34AorA43+YRaP5Ndflc2plv9et1Lrvz2"/>
        <user enabled="true" name="private_editor" password="crypt1:kMacwSIx/i6t0WMh9Q0g33+DNIJKmd1I"/>
        <user enabled="true" name="private_viewer" password="crypt1:J8XrZXsHP4efI1C8mXqPScvb91I4h3jQ"/>
        <user enabled="true" name="public_editor" password="crypt1:N0aHmlK3ftdguggsXKtL4oeX0amjMW8I"/>
    </users>
    <groups/>
</userRegistry>

<?xml version="1.0" encoding="UTF-8"?>
<roleRegistry version="1.0" xmlns="http://www.geoserver.org/security/roles">
    <roleList>
        <role id="ADMIN"/>
        <role id="GROUP_ADMIN"/>
        <role id="ROLE_EDIT"/>
        <role id="ROLE_PRIVATE"/>
        <role id="ROLE_PRIVATEEDIT"/>
    </roleList>
    <userList>
        <userRoles username="admin">
            <roleRef roleID="ADMIN"/>
        </userRoles>
        <userRoles username="private_editor">
            <roleRef roleID="ROLE_PRIVATEEDIT"/>
        </userRoles>
        <userRoles username="private_viewer">
            <roleRef roleID="ROLE_PRIVATE"/>
        </userRoles>
        <userRoles username="public_editor">
            <roleRef roleID="ROLE_EDIT"/>
        </userRoles>
    </userList>
    <groupList/>
</roleRegistry>

*.*=*
wfs.*=ROLE_EDIT,ROLE_PRIVATEEDIT
wps.*=ADMIN

*.*.r=*
*.*.w=*
private.*.r=ROLE_PRIVATE,ROLE_PRIVATEEDIT
private.*.w=ROLE_PRIVATEEDIT
mode=HIDE

Testing the scenario¶

There are a few different tests to ensure that the above rules have been implemented properly.