GeoServer Access Control List authorization¶

System Properties¶

If you choose to use Java System properties, add the following ones to the GeoServer JVM parameters, with the appropriate values:

-Dgeoserver.acl.client.basePath=https://example.com/acl/api
-Dgeoserver.acl.client.username=geoserver
-Dgeoserver.acl.client.password=ch4ng3m3

Disabling the plugin¶

The geoserver.acl.enabled config property defaults to true so it’s not required for the plugin to run. In order to completely disable the plugin, set it to false:

-Dgeoserver.acl.enabled=false

Environment variables¶

In production environments it’s usually more convenient to control configuration options through environment variables, where sensitive values can be obtained from docker/kubernetes secrets.

All the system properties mentioned above can be mapped to environment variables by changing their names to upper case and replacing dots by underscores:

For example:

export GEOSERVER_ACL_ENABLED=false
export GEOSERVER_ACL_CLIENT_BASEPATH=https://example.com/acl/api
export GEOSERVER_ACL_CLIENT_USERNAME=geoserver
export GEOSERVER_ACL_CLIENT_PASSWORD=ch4ng3m3

And so on.

Setting the plugin’s authorization cache expiration time¶

The GeoServer ACL API plugin implements a local cache for authorization requests/responses, that has a default 30 seconds expiration time.

The cache “expiration time”, or “time to live”, can be changed through the Dgeoserver.acl.client.cache.ttl configuration property, which accepts a java.time.Duration string. For example:

-Dgeoserver.acl.client.cache.ttl=PT5S

or

export GEOSERVER_ACL_CLIENT_CACHE_TTL=PT5S

will set the cache TTL to 5 seconds.

Examples:

"PT20.345S" -- parses as "20.345 seconds"
"PT15M"     -- parses as "15 minutes" (where a minute is 60 seconds)
"PT10H"     -- parses as "10 hours" (where an hour is 3600 seconds)
"P2D"       -- parses as "2 days" (where a day is 24 hours or 86400 seconds)
"P2DT3H4M"  -- parses as "2 days, 3 hours and 4 minutes"

This is important because the cache TTL will impact the latency for GeoServer to respond to data access or workspace admin access rules modified or deleted directly through the ACL REST API that happen outside GeoServer.

If you’re implementing a workflow where you’re managing ACL rules directly through the ACL service API, you might want to set a shorter cache TTL.

Alternatively, you can introduce a direct call to the GeoServer REST API to force clearing the cache using the /rest/reset endpoint. For example:

curl -u admin:geoserver -X POST "http://localhost:8080/geoserver/rest/reset"

The web user interface can also be used to clear out the caches through the “Server Status” page, clicking the Resource Cache -> Clear button.

In either case, you’d see a message like the following in the GeoServer logs, provided the logging configuration enables the info level for the org.geoserver.acl.authorization.cache topic:

INFO   [org.geoserver.acl.authorization.cache] - evicted 56 cached ACL authorizations