Users, Groups, Roles¶

This section provides the configuration options for User/group services and Role services. In addition, users, groups, and roles themselves and can be added, edited, or removed. A great deal of configuration can be accomplished in this section and related pages.

User Group Services¶

In this menu, user/group services can be added, removed, or edited. By default, there is one user/group service in GeoServer, which is XML-based. It is encrypted with Weak PBE and uses the default password policy. It is also possible to have a user/group service based on JDBC, with or without JNDI.

User/group services¶

Clicking an existing user/group service will enable editing, while clicking the Add new link will configure a new user/group service.

There are three tabs for configuration: Settings, Users, and Groups.

Note

When creating a new user/group service, the form filled out initially can be found under the Settings tab.

Add new XML user/group service¶

To add a new XML user/group service, click the Add new link. XML is the default option. The following figure shows the configuration options for an XML user/group service.

Adding an XML user/group service¶

Option	Description
Name	The name of the user/group service
Password encryption	Sets the type of Password encryption. Options are Plain text, Weak PBE, Strong PBE, and Digest.
Password policy	Sets the password policy. Options are any active password policies as set in the Passwords section.
XML filename	Name of the file that will contain the user and group information. Default is `users.xml` in the `security/usergroup/<name_of_usergroupservice>` directory.
Enable schema validation	If selected, forces schema validation to occur every time the XML file is read. This option is useful when editing the XML file by hand.
File reload interval	Defines the frequency (in milliseconds) in which GeoServer will check for changes to the XML file. If the file is found to have been modified, GeoServer will recreate the user/group database based on the current state of the file. This value is meant to be set in cases where the XML file contents might change “out of process” and not directly through the web admin interface. The value is specified in milliseconds. A value of 0 disables any checking of the file.

Add new JDBC user/group service¶

To add a new XML user/group service, click the Add new link, and then the JDBC option at the top of the following form. The following figure shows the configuration options for a JDBC user/group service.

Adding a user/group service via JDBC¶

Option	Description
Name	Name of the JDBC user/group service in GeoServer
Password encryption	The method to used to encrypt user passwords
Password policy	The policy to use to enforce constraints on user passwords
JNDI	When unchecked, specifies a direct connection to the database. When checked, specifies an existing connection located through JNDI.
Driver class name	JDBC driver to use for the database connection
Connection URL	Specifies the JDBC URL to use when creating the database connection
Username	Username to use when connecting to the database
Password	Password to use when connecting to the database
Create database tables	Specifies whether to create all the necessary tables in the underlying database
Data Definition Language (DDL) file	Specifies a custom DDL file to use for creating tables in the underlying database, for cases where the default DDL statements fail on the given database. If left blank, internal defaults are used.
Data Manipulation Language (DML) file	Specifies a custom DML file to use for accessing tables in the underlying database, for cases where the default DML statements fail on the given database. If left blank, internal defaults are used.

In addition to the parameters listed above, the following additional parameter will apply when the JNDI flag is set.

../../_images/ugr_ugjdbcjndisettings.png

Adding a user/group service via JDBC with JNDI¶

Option	Description
JNDI resource name	JNDI name used to locate the database connection.

Add new LDAP user/group service¶

To add a new LDAP user/group service, click the Add new link, and then the LDAP option at the top of the following form. The following figure shows the configuration options for a LDAP user/group service.

Adding a user/group service via LDAP¶

Option	Description
Name	Name of the LDAP role service in GeoServer
Password encryption	The method to used to encrypt user passwords
Password policy	The policy to use to enforce constraints on user passwords
Server URL	URL for the LDAP server connection. It must include the protocol, host, and port, as well as the “distinguished name” (DN) for the root of the LDAP tree.
TLS	Enables a STARTTLS connection. (See the section on Secure LDAP connections.)
Group search base	Relative name of the node in the tree to use as the base for LDAP groups. Example: `ou=groups`. The root DN specified as port of the Server URL is automatically appended.
Filter to search all groups	Sets the LDAP filter for search all groups available. Leave blank to derive from attribute.
Filter to search group by name	Sets the LDAP filter for search a group by its name. Leave blank to derive from attribute.
Attribute which contains the name of the group	Sets attribute containing the group name. Leave blank to derive from name filter.
Query format to retrieve the user/group mapping	Query format used for mapping user/group memberships. Leave blank to derive from attribute. This may contain some placeholder values: `{0}`, the `username` of the user, for example `bob`. `{1}`, the full DN of the user, for example `uid=bob,ou=users`.
Attribute name to retrieve the user/group mapping	Attribute name used for mapping user/group memberships. Leave blank to derive from filter.
User search base	LDAP search base for users.
Filter to search all users	Sets the filter for search all available users. Leave blank to derive from attribute.
Filter to search user by name	Sets the filter format for search a user by its name. Leave blank to derive from attribute.
Attribute which contains the name of the user	Sets the attribute containing the name for users. Leave blank to derive from name filter.
List of attributes to populate	Sets a comma separated list of attributes to populate on users.
Authenticated onto the LDAP before querying	When checked all LDAP searches will be done in authenticated mode, using the credentials given with the Username and Password options
Username	Username to use when connecting to the LDAP server. Only applicable when the Authenticated onto the LDAP before querying parameter is checked.
Password	Password to use when connecting to the LDAP server. Only applicable when the Authenticated onto the LDAP before querying parameter is checked.
Enable Hierarchical groups search	When checked all LDAP group searches will use hierarchical mode, retrieving LDAP parent groups too.
Max depth for hierarchical groups search	Max depth number for hierarchical LDAP groups search, use -1 for infinite depth. Only applicable when the Enable Hierarchical groups search parameter is checked.
Nested group search filter	LDAP search pattern for searching parent groups. Only applicable when the Enable Hierarchical groups search parameter is checked.

Edit user/group service¶

Once the new user/group service is added (either XML or JDBC), clicking on it in the list of user/group services will allow additional options to be specified, such as the users and groups associated with the service.

There are three tabs in the resulting menu: Settings, Users, and Groups. The Settings tab is identical to that found when creating the user/group service, while the others are described below.

The Users tab provides options to configure users in the user/group service.

Users tab¶

Clicking a username will allow its parameters to be changed, while clicking the Add new link will create a new user.

Add user¶

Creating or editing a user¶

Option	Description
User name	The name of the user
Enabled	When selected, will enable the user to authenticate
Password	The password for this user. Existing passwords will be obscured when viewed.
Confirm password	To set or change the password enter the password twice.
User properties	Key/value pairs associated with the user. Used for associating additional information with the user.
Group list	Full list of groups, including list of groups to which the user is a member. Membership can be toggled here via the arrow buttons.
Add a new group	Shortcut to adding a new group. Also available in the Groups tab.
Role list	Full list of roles, including a list of roles to which the user is associated. Association can be toggled here via the arrow buttons.
Add a new role	Shortcut to adding a new role
List of current roles for the user	List of current roles associated with the user. Click a role to enable editing.

The Groups tab provides configuration options for groups in this user/group service. There are options to add and remove a group, with an additional option to remove a group and the roles associated with that group.

Groups tab¶

Remove User¶

There are two related buttons that are responsible for removing users: Remove Selected, and Remove Selected and remove role associations.

Remove Selected removes user from users.xml and leave untouched roles.xml.
Remove Selected and remove role associations removes user from users.xml and also removes user and associated role to user from roles.xml.

Users tab¶

Add group¶

Creating or editing a group¶

Option	Description
Group name	The name of the group
Enabled	When selected the group will be active
Role list	Full list of roles, including a list of roles to which the group is associated. Association can be toggled here via the arrow buttons.
Add a new role	Shortcut to adding a new role

Role services¶

In this menu, role services can be added, removed, or edited. By default, the active role service in GeoServer is XML-based, but it is also possible to have a role service based on JDBC, with or without JNDI.

The Administrator role is called ROLE_ADMINISTRATOR.

Role services¶

Clicking an existing role service will open it for editing, while clicking the Add new link will configure a new role service.

There are two pages for configuration: Settings and Roles.

Note

When creating a new role service, the form filled out initially can be found under the Settings tab.

Add new XML role service¶

To add a new XML role service, click the Add new link. XML is the default option. The following figure shows the configuration options for an XML role service.

Adding an XML role service¶

Option	Description
Name	The name of the role service
Administrator role	The name of the role that performs the administrator functions
XML filename	Name of the file that will contain the role information. Default is `roles.xml` in the `security/role/<name_of_roleservice>` directory.
File reload interval	Defines the frequency (in milliseconds) in which GeoServer will check for changes to the XML file. If the file is found to have been modified, GeoServer will recreate the user/group database based on the current state of the file. This value is meant to be set in cases where the XML file contents might change “out of process” and not directly through the web admin interface. The value is specified in milliseconds. A value of 0 disables any checking of the file.

Add new JDBC role service¶

To add a new XML role service, click the Add new link, and then the JDBC option at the top of the following form. The following figure shows the configuration options for a JDBC role service.

Adding a role service via JDBC¶

Option	Description
Name	Name of the JDBC role service in GeoServer
Administrator role	The name of the role that performs the administrator function
JNDI	When unchecked, specifies a direct connection to the database. When checked, specifies an existing connection located through JNDI.
Driver class name	JDBC driver to use for the database connection
Connection URL	Specifies the JDBC URL to use when creating the database connection
Username	Username to use when connecting to the database
Password	Password to use when connecting to the database
Create database tables	Specifies whether to create all the necessary tables in the underlying database
Data Definition Language (DDL) file	Specifies a custom DDL file to use for creating tables in the underlying database, for cases where the default DDL statements fail on the given database. If left blank, internal defaults are used.
Data Manipulation Language (DML) file	Specifies a custom DML file to use for accessing tables in the underlying database, for cases where the default DML statements fail on the given database. If left blank, internal defaults are used.

In addition to the parameters listed above, the following additional parameter will apply when the JNDI flag is set.

../../_images/ugr_rolejdbcjndisettings.png

Adding a role service via JDBC with JNDI¶

Option	Description
JNDI resource name	JNDI name used to locate the database connection.

Add new LDAP role service¶

To add a new LDAP role service, click the Add new link, and then the LDAP option at the top of the following form. The following figure shows the configuration options for a LDAP role service.

Adding a role service via LDAP¶

Option	Description
Name	Name of the LDAP role service in GeoServer
Administrator role	The name of the role that performs the administrator function
Group administrator role	The name of the role that performs the group administrator function
Server URL	URL for the LDAP server connection. It must include the protocol, host, and port, as well as the “distinguished name” (DN) for the root of the LDAP tree.
TLS	Enables a STARTTLS connection. (See the section on Secure LDAP connections.)
Group search base	Relative name of the node in the tree to use as the base for LDAP groups. Example: `ou=groups`. The root DN specified as port of the Server URL is automatically appended.
Group user membership search filter	Search pattern for extracting users of a LDAP group a user belongs to. This may contain some placeholder values: `{0}`, the `username` of the user, for example `bob`. `{1}`, the full DN of the user, for example `uid=bob,ou=users`. To use this placeholder, the Filter used to lookup user needs to be defined, so that the dn of a user can be extracted from its username.
All groups search filter	Search pattern for locating the LDAP groups to be mapped to GeoServer roles inside the Group search base root node
Filter used to lookup user.	optional filter used to extract a user dn, to be used together with Group user membership search filter when the {1} placeholder is specified. This may contain a placeholder value: `{0}`, the `username` of the user, for example `bob`.
Authenticate to extract roles	When checked all LDAP searches will be done in authenticated mode, using the credentials given with the Username and Password options
Username	Username to use when connecting to the LDAP server. Only applicable when the Authenticate to extract roles parameter is checked.
Password	Password to use when connecting to the LDAP server. Only applicable when the Authenticate to extract roles parameter is checked.
Enable Hierarchical groups search	When checked all LDAP group searches will use hierarchical mode, retrieving LDAP parent groups too.
Max depth for hierarchical groups search	Max depth number for hierarchical LDAP groups search, use -1 for infinite depth. Only applicable when the Enable Hierarchical groups search parameter is checked.
Nested group search filter	LDAP search pattern for searching parent groups. Only applicable when the Enable Hierarchical groups search parameter is checked.

Edit role service¶

Once the new role service is added (either XML or JDBC), clicking it in the list of role services will allow the additional options to be specified, such as the roles associated with the service.

There are two tabs in the resulting menu: Settings and Roles. The Settings tab is identical to that found when creating the role service, while the Roles tab is described below.

Roles tab¶

Clicking a role will allow its parameters to be changed, while clicking the Add new link will create a new role.

Add role¶

Creating or editing a role¶

Option	Description
Role name	The name of role. Convention is uppercase, but is not required.
Parent roles	The role that this role inherits. See the section on Roles for more information on inheritance.
Role parameters	Key/value pairs associated with the role. Used for associating additional information with the role.

Previous: Passwords

Next: Data

Users, Groups, Roles¶

User Group Services¶

Add new XML user/group service¶

Add new JDBC user/group service¶

Add new LDAP user/group service¶

Edit user/group service¶

Add user¶

Remove User¶

Add group¶

Role services¶

Add new XML role service¶

Add new JDBC role service¶

Add new LDAP role service¶

Edit role service¶

Add role¶

Table Of Contents

Continue Reading

This Page