<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
h1
{mso-style-priority:9;
mso-style-link:"Heading 1 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:24.0pt;
font-family:"Times New Roman","serif";
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.Heading1Char
{mso-style-name:"Heading 1 Char";
mso-style-priority:9;
mso-style-link:"Heading 1";
font-family:"Times New Roman","serif";
font-weight:bold;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>I’m playing around with the security settings on a GeoServer site.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>In GeoServer, I can set the “Catalog mode”:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in'><b><span style='font-size:10.0pt'>Catalog mode configuration - mode=HIDE|CHALLENGE|MIXED<o:p></o:p></span></b></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in'><span style='font-size:10.0pt'>Set the catalog mode level<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in'><b><span style='font-size:10.0pt'>hide</span></b><span style='font-size:10.0pt'> (default): does not show to the user the layers that he cannot access, behaves as if a layer was read only if the user does not have write permissins. The capabilities document do not contain the clayers the current user cannot access to. This is the highest security mode, it assumes a privileged user has logged in before showing him the secured layers. Because of this, it does not work very well with clients such as uDig or Google Earth, where the authentication dialog pops up only if the server returns a HTTP 401 after attempting to access a secured resource.<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in'><b><span style='font-size:10.0pt'>challenge</span></b><span style='font-size:10.0pt'>: allows free access to metadata, any attempt at accessing actual data is metby a HTTP 401 code that forces most clients to show an authentication dialog. The capabilities do contain the full list of layers, DescribeFeatureType and DescribeCoverage do work fine, the first attempt to access the actual data without the necessary privileges is met with a 401 error. This mode works fine with capabilities driven clients such as uDig, and with any client that needs a 401 in order to trigger an authentication dialog.<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in'><b><span style='font-size:10.0pt'>mixed</span></b><span style='font-size:10.0pt'>: hides the layers the user cannot read from the capabilities, but triggers authentication for any other attempt to access the data or the metadata. Useful if you don't want the world to see the very existence of some of your data, but you still want selected people whom you give direct data access links to get the data after authentication.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>When I set the mode to <b>challenge</b>, and do a Connect from the “Add Layer(s) from a Server” dialog, I see all the layers. If I try to add one to the map, I get a “Enter Credentials” dialog, where I can enter Username and Password, and if correct I see the layer in the map.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>When I set the mode to <b>hide</b>, and do a Connect, I don’t see the layers.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>But here’s the thing. All of the above is with the User name and Password fields of the “Create a new WMS connection” dialog blank. And the above is the behavior I’d expect, with those fields blank.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>But if I fill in username and password, in the connection dialog, I still get the same behavior. I’d expect to be able to see the authenticated-only layers, in the getCapabilities XML, and hence in the layer list in the qGIS dialog, if the user name and password are correct. I’m not seeing that.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>In fact, it looks as if it makes no difference whatsoever whether I enter a username and password when defining a WMS connection.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>Am I misunderstanding what the username and password fields are for? Or are they not working? Or is GeoServer handling something incorrectly?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p></div></body></html>