On Thu, Oct 28, 2010 at 4:59 PM, web <[email protected]> wrote: > Hi all, > > I run the 2.1 beta of Geoserver and was trying the virtual services. I've > created a workspace and a PostGIS datastore, created some users, pushed some > layers online. > > I'm working with catalog security "cache" mode. I've added a new role for my > user, and added a rule like mynamespace.*.r -> my_role. This should ensure > that all layers of this workspace are only available read-only for my user > with role: my_role.. > > Now I do a getCapabilites on a layer of this workspace without > authentication (with Firefox): > http://localhost:8080/geoserver/mynamespace/wms?request=GetCapabilities&service=WMS&version=1.1.1 > ---response (Only show the interesting part)---- > > <Capability> > ... > ... > <Layer> > <Title>Geoserver Web Map Service</Title> > <Abstract>etc...</Abstract> > <SRS>etc...</SRS> > <LatLonBoundingBox minx="0.0" miny="0.0" maxx="-1.0" maxy="-1.0"/> > </Layer> > </Capability> > > The same URL with authentication (creds from new created user) return > exactly the same response. Normally I should see the layer... > > When I do a get map, with or without authentication, I got a service > exception: Layer not found. > > Now, the Weird thing: Because I do these tests on Firefox, then I open a new > tab, go login to Geoserver's config and when I make all the test above > again, my layer appears in the getCap and the getMap returns an image of my > layer, all is fine. The only thing I noticed with the previous tests is that > now a JSESSION cookie was sent.
I cannot provide a hint about what's going on with virtual services, but for the security I know what's going on. Once you log in as an administrator in the browser every request you make works with the full permissions of the administrator, which can do everything and can access to everything. So if you want to test security setting you should never be logged in: use a different browser or log out as soon as you've done with the administration tasks. Cheers Andrea ----------------------------------------------------- Ing. Andrea Aime Senior Software Engineer GeoSolutions S.A.S. Via Poggio alle Viti 1187 55054 Massarosa (LU) Italy phone: +39 0584962313 fax: +39 0584962313 http://www.geo-solutions.it http://geo-solutions.blogspot.com/ http://www.linkedin.com/in/andreaaime http://twitter.com/geowolf ----------------------------------------------------- ------------------------------------------------------------------------------ Nokia and AT&T present the 2010 Calling All Innovators-North America contest Create new apps & games for the Nokia N8 for consumers in U.S. and Canada $10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store http://p.sf.net/sfu/nokia-dev2dev _______________________________________________ Geoserver-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/geoserver-users
