Hi Thomas
About your questions
1) Adding a layer and getting pink tiles
No idea here, adding a layer has nothing to do with authentication, could
you reproduce this problem using the default security configuration ?
2) The remember me service works only with http basic auth and form based
login. Why ?. The remeber me services uses a cookie and stores a digested
representation of the password as cookie value (along with the user id) .
Header authentication uses no password --> no remember me service.
3) Your filter chain
You have a proxy and the anonymous filter. The last filter in the chain
determines the authentication entry point (e.g. redirecting the browser to
a login form). The anonymous filter has no authentication entry point
because it always logs you in as "anonymous" successfully. If you use an
anonymous filter, the filter has to be the last filter in the chain. A
filter behind the anonymous filter will never be used.
You have HTTP session creation enabled. I assume you send the http header
once and use the session cookie for subsequent requests. This may be
problematic in case of a session time out because you are logged in again
as anonymous "automatically". Remove the anonymous filter if this is
possible in your scenario. Upon session time out, you must log in again.
If you cannot remove the anonymous filter, you have to send the http header
attribute in each request which requires authentication, there is no other
solution. In this scenario, you can disable session creation.
Hope this helps
Christian
2013/6/14 Thomas Colley <[email protected]>
> Hi Christian****
>
> ** **
>
> I have updated to Geoserver 2.3.2 and enabled HTTP session creation on the
> default filter chain. I then submit a getcapabilities request with header
> attached and I see the correct restricted layers. When I add one of the
> restricted layers though I still just get pink tiles and the Geoserver log
> says “could not find layer…”.****
>
> ** **
>
> I notice that rememberme is not available in the default filter chain
> while it was on Geoserver 2.2. Is rememberme needed to read the session
> that has been created?****
>
> ** **
>
> At the moment the default chain contains proxy and then anonymous. The
> only other available option is basic.****
>
> ** **
>
> If you have any suggestions that would be great.****
>
> ** **
>
> Thanks****
>
> ** **
>
> Tom****
>
> ** **
>
> *From:* Christian Mueller [mailto:[email protected]]
> *Sent:* 18 May 2013 10:18
> *To:* Andrea Aime
> *Cc:* Thomas Colley; GeoServer Mailing List List
> *Subject:* Re: [Geoserver-users] Geoserver Header Auth****
>
> ** **
>
> As Andrea already mentioned, the header has to be present in each request
> but only if the security filter chain does not allow to create an HTTP
> session. (Out of the box, HTTP session creation is only allowed for the
> "web" filter chain). ****
>
> ** **
>
> If you allow HTTP session creation on the "default" filter chain, you need
> to send the header only once, subsequent calls will use a session cookie.*
> ***
>
> ** **
>
> Cheers****
>
> Christian****
>
> ** **
>
> ** **
>
> 2013/5/14 Andrea Aime <[email protected]>****
>
> On Tue, May 14, 2013 at 9:07 AM, Thomas Colley <
> [email protected]> wrote:****
>
> Is this expected behaviour? I was expecting either all requests to fail
> after the initial GetCapabilities or that once authenticated geoserver
> would ‘remember’ the header and everything would work.****
>
> ** **
>
> Hum, not sure, but normally GetFeatureInfo is done as an ajax request.
> Wondering if the header is kept when you follow the ajax code path?****
>
> Afaik the header should still be present in each request.****
>
> ** **
>
> Cheers****
>
> Andrea****
>
> ****
>
> -- ****
>
> ==****
>
> GeoServer training in Milan, 6th & 7th June 2013! Visit
> http://geoserver.geo-solutions.it for more information.
> ==****
>
> ** **
>
> Ing. Andrea Aime ****
>
> @geowolf****
>
> Technical Lead****
>
> ** **
>
> GeoSolutions S.A.S.****
>
> Via Poggio alle Viti 1187****
>
> 55054 Massarosa (LU)****
>
> Italy****
>
> phone: +39 0584 962313****
>
> fax: +39 0584 1660272****
>
> mob: +39 339 8844549****
>
> ** **
>
> http://www.geo-solutions.it****
>
> http://twitter.com/geosolutions_it****
>
> ** **
>
> -------------------------------------------------------****
>
>
>
> ------------------------------------------------------------------------------
> AlienVault Unified Security Management (USM) platform delivers complete
> security visibility with the essential security capabilities. Easily and
> efficiently configure, manage, and operate all of your security controls
> from a single console and one unified framework. Download a free trial.
> http://p.sf.net/sfu/alienvault_d2d
> _______________________________________________
> Geoserver-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/geoserver-users****
>
>
>
> ****
>
> ** **
>
> -- ****
>
> DI Christian Mueller MSc (GIS), MSc (IT-Security)****
>
> OSS Open Source Solutions GmbH****
>
> ** **
>
--
DI Christian Mueller MSc (GIS), MSc (IT-Security)
OSS Open Source Solutions GmbH
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:
Build for Windows Store.
http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Geoserver-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/geoserver-users
