Understanding the authentication chain helps explain how GeoServer authentication works. The authentication chain processes requests and applies certain authentication mechanisms. Examples of authentication mechanisms include:
Username/password—Performs authentication by looking up user information in an external user database
Browser cookie—Performs authentication by recognizing previously sent browser cookies (also known as “Remember Me”)
LDAP—Performs authentication against an LDAP database
Anonymous—Essentially performs no authentication and allows a request to proceed without any credentials
Multiple authentication mechanisms may be active within GeoServer at a given time. The following figure illustrates the flow of a generic request.
Before dispatching a request to the appropriate service or handler, GeoServer first filters the request through the authentication chain. The request is passed to each mechanism in the chain in order, and each is given the chance to authenticate the request. If one of the mechanisms in the chain is able to successfully authenticate, the request moves to normal processing. Otherwise the request is not routed any further and an authorization error (usually a HTTP 401) is returned to the user.
Filter chain and provider chain¶
In the case of GeoServer, the authentication chain is actually made up of two chains: a filter chain, which determine if further authentication of a request is required, and a provider chain, which performs the actual authentication.
The filter chain performs a variety of tasks, including:
Gathering user credentials from a request, for example from Basic and Digest Authentication headers
Handling events such as ending the session (logging out), or setting the “Remember Me” browser cookie
Performing session integration, detecting existing sessions and creating new sessions if necessary
Invoking the authentication provider chain to perform actual authentication
The filter chain is actually processed twice, before and after the request is handled.
The provider chain is concerned solely with performing the underlying authentication of a request. It is invoked by the filter chain when a filter determines that authentication is required.
Filter chain by request type¶
A different filter chain can be applied to each different type of request in GeoServer. This happens because the administrator can configure a list of different filter chains and a matching rule for each of them. Only the first matching chain of the configured ordered list will be applied to any given request.
- Matching rules can be applied to:
HTTP Method (GET, POST, etc.)
one or more ANT patterns for the path section of the request (e.g /wms/**); if more than one pattern (comma delimited) is specified, any of them will match
an optional regular expression to match parameters on the query string, for one or more of the specified ANT pattern; if the path matches, also the query string is checked for matching; the regular expression can be specified after the ANT pattern, with a pipe (|) separator
- ANT Patterns support the following wildcards:
? matches one character
* matches zero or more characters
** matches zero or more ‘directories’ in a path
Query String regular expressions will match the full query string (^ and $ terminators are automatically appended), so to match only part of it, remember to prefix and postfix the expression with .* (e.g. .*request=getcapabilities.*)
Examples of rules (ANT patterns and query string regular expressions)¶
simple ANT pattern
ANT pattern and querystring regex to match one parameter
ANT pattern and querystring regex to match two parameters in any order
ANT pattern and querystring regex to match one parameters and be sure another one is not matched
Kuelewa mnyororo wa uthibitisho husaidia kuelezea jinsi uthibitisho wa GeoServer unavyofanya kazi. Usalama mnyororo michakato maombi na inatumika baadhi ya taratibu za uthibitisho. Mifano ya taratibu za uthibitisho ni pamoja na: Jina la mtumiaji, Nambari ya siri, Browser, hufanya uthibitisho kwa kuangalia habari ya mtumiaji katika cookie ya hifadhidata ya mtumiaji wa nje, hufanya uthibitisho kwa kutambua kuki za kivinjari zilizotumwa hapo awali (pia inajulikana kama "Kukumbuka Mimi"), LDAP, hufanya uthibitisho dhidi ya hifadhidata ya LDAP, kimsingi haifanyi uthibitisho wowote na inaruhusu ombi kuendelea bila sifa yoyote. Mchoro ufuatao unaonyesha mtiririko wa ombi la jumla. Kabla ya kutuma ombi kwa huduma sahihi au handler, GeoServer kwanza filters ombi kupitia mnyororo uthibitisho. Ombi ni kupita kwa kila utaratibu katika mlolongo kwa utaratibu, na kila mmoja anapewa nafasi ya kuthibitisha ombi. Kama moja ya taratibu katika mlolongo ni uwezo wa mafanikio uthibitisho, ombi huendelea kwa usindikaji wa kawaida. Kwa hivyo, ombi la wavuti halitaelekezwa zaidi na kosa la idhini (kwa kawaida HTTP 401) linarudi kwa mtumiaji. Mnyororo wa Filter na Mnyororo wa Mtoaji: Katika kesi ya GeoServer, mnyororo wa uthibitisho unajumuisha mnyororo wa uchambuzi, ambao huamua ikiwa uthibitisho zaidi wa ombi unahitajika, na mnyororo wa mtoaji, ambao hufanya uthibitisho halisi. Filter mnyororo hufanya kazi mbalimbali, ikiwa ni pamoja na: Kukusanya uthibitisho wa mtumiaji kutoka ombi, kwa mfano kutoka Basic na Digest Authentication vichwa, kushughulikia matukio kama vile kumaliza kikao (logging out) au kuweka <unk>Kumbuka Me<unk> browser kuki, kufanya kikao, kugundua vikao zilizopo na kujenga vipindi vipya ikiwa ni lazima, kuanzisha mnyororo wa mtoaji wa uthibitisho kufanya uthibitisho halisi. mnyororo mtoa ni wasiwasi tu na kufanya msingi uthibitisho wa ombi. Ni kuitwa na filter mlolongo wakati filter huamua kwamba uthibitisho inahitajika. Filter mlolongo kwa aina ya ombi¶ tofauti filter mlolongo inaweza kutumika kwa kila aina tofauti ya ombi katika GeoServer. Hii hutokea kwa sababu msimamizi anaweza configure orodha ya minyororo tofauti kichujio na sheria ya mechi kwa kila mmoja wao. Tu mnyororo wa kwanza mechi ya orodha umewekwa utaratibu itakuwa kutumika kwa ombi yoyote iliyotolewa. - Matching sheria inaweza kutumika kwa: HTTP Method (GET, POST, nk.) "Kama kuna ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"" wa ""mfano"""""""" "Kama ""kitu"" cha ""kitu"" kinachohusiana na ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""kitu"" cha ""k"" cha ""kitu"" cha ""k"" cha """" cha """" cha """"" * (kwa mfano . *request=getcapabilities. Mfano wa kanuni za utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu wa utaratibu