💡 [Feature] Protect GeoServer #333
Assignees
Labels
component/geoserver
Related to GeoServer or one of its underlying services
enhancement
New feature or request
project/DACCS
Related to DACCS project (https://github.com/orgs/DACCS-Climate)
security
Issues or features related to security concerns
Projects
Comments
fmigneault
added
enhancement
mishaschwartz
added a commit
that referenced
this issue
Nov 1, 2023
#348) ## Overview Geoserver: protect web interface and ows routes behind magpie/twitcher Updates Magpie version to [3.35.0](https://github.com/Ouranosinc/Magpie/tree/3.35.0) in order to take advantage of updated Geoserver Service. The `geoserverwms` Magpie service is now deprecated. If a deployment is currently using this service, it is highly recommended that the permissions are transferred from the deprecated `geoserverwms` service to the `geoserver` service. The `/geoserver` endpoint is now protected by default. If a deployment currently assumes open access to Geoserver and would like to keep the same permissions after upgrading to this version, please update the permissions for the `geoserver` service in Magpie to allow the `anonymous` group access. A `Magpie` service named `geoserver` with type `wfs` exists already and must be manually deleted before the new `Magpie` service created here can take effect. The `optional-components/all-public-access` component provides full access to the `geoserver` service for the `anonymous` group in Magpie. Please note that this includes some permissions that will allow anonymous users to perform destructive operations. Because of this, please remember that enabling the `optional-components/all-public-access` component is not recommended in a production environment. Introduces the `GEOSERVER_SKIP_AUTH` environment variable. If set to `True`, then requests to the geoserver endpoint will not be authorized through twitcher/magpie at all. This is not recommended at all. However, it will slightly improve performance when accessing geoserver endpoints. ## Changes **Non-breaking changes** In order to provide public access to geoserver by default now, the `all-public-access` optional component must be enabled **Breaking changes** The current `wfs` Magpie service named `geoserver` must be deleted before the change here can take effect. ## Related Issue / Discussion - Resolves #333 ## Additional Information
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
Ensure GeoServer is accessed following Magpie/Twticher authentication/authorization.
References
The text was updated successfully, but these errors were encountered: