GeoSpatial Techno is a startup focused on geospatial information that is providing e-learning courses to enhance the knowledge of geospatial information users, students, and other startups. The main approach of this startup is providing quality, valid specialized training in the field of geospatial information.

( YouTube | LinkedIn | Facebook | X )

Utilizing the Demo Section in Geoserver

In this session we aim to provide content on how to use the Demo menu and its modules in GeoServer and teach the process of making different requests and getting responses from the server. If you want to access the complete tutorial, simply click on the link.

Introduction

The Demo page provides valuable tool to help you practice with requests and understand how GeoServer works. The Demo Requests is used to create and test requests to GeoServer. The user can see the response to successful requests, or troubleshoot problems. To become familiar with the demo page, navigate to Demos to open the GeoServer Demos page. This page contains these options:

• Demo Requests
• SRS List
• Reprojection Console
• WCS Request Builder.

If you have installed the WPS extension, you will see an additional option called WPS Request Builder.

Note. These tools are for the public like Layer Preview, you do not need to be logged into GeoServer to access this page.

Note. This video was recorded on GeoServer 2.22.4, which is not the most up-to-date version. Currently, versions 2.24.x and 2.25.x are supported. To ensure you have the latest release, please visit this link. and avoid using older versions of GeoServer.

Demo Request

This page has examples of WMS, WCS, and WFS requests for GeoServer that you can use to examine and change. To learn about WMS, WFS, and WCS standards, simply click on the link.

Now let’s explore some basic operations:

• From the drop-down list, you can select a set of prepared requests. They are listed with a syntax declaring the standard as a prefix and the standard’s version as a suffix. Choose WFS_getCapabilities-1.1.xml.
• Press the Submit button. A new panel is shown, and, after a while, it lists the XML response from GeoServer.
• Another basic WFS operation is getFeature, which will retrieve a feature for you. Select WFS_getFeature-1.0.xml. If you look at the XML code, you can see a clear reference to the topp:states layer, which is included in the sample set.
• Press the Submit button. A new panel is shown, and, after a while, it lists the XML response from GeoServer. The code is a GML representation of the features with fid = 3, as requested in the filter.

The Demo requests interface lets you select sample requests and modify them to perform testing on GeoServer. When in doubt about a specific operation, this application should be the first point where you go to debug. From here, you can concentrate on the request’s syntax, avoiding network issues or other problems that you may have experienced with an external client.

New Feature: For GeoServer 2.25.2 the Demo Request page has been improved to show response Headers, and provide the option to pretty print XML output.

SRS List

GeoServer natively supports almost 4000 Spatial Referencing Systems (SRS), also known as projections, and more can be added. A spatial reference system defines an ellipsoid, a datum using that ellipsoid, and either a geocentric, geographic or projection coordinate system. This page lists all SRS info known to GeoServer.

The Code column refers to the unique integer identifier of that spatial reference system. Each code is linked to a more detailed description page, accessed by clicking on that code. Now let’s filter the projection list:

• In the Search textbox, type in the project code for the basic projection, 4326 or WGS 84; then press Enter.
• Click on the projection code to show the projection details that include:
  • A short text description of the SRS
  • An EPSG or Internal description of the SRS, provides an overview of how each projection is defined. It includes several parameters formatted in the WKT format.
  • And a map showing you the area of validity or bounding box for the SRS. For 4326, it is the planet’s surface.
• Repeat these steps to review another code 32633 which is the WGS 84, UTM zone 33N. Please consider the area of validity and the countries eligible to use this SRS.

Reprojection console

The reprojection console allows you to calculate and quickly test coordinate transformation. You can use it to convert a single coordinate or WKT geometry and transform it from one CRS to another. In this recipe, you’ll discover a simple, yet very useful tool that ships with GeoServer. It lets you have a look at how coordinates change when you move data from one CRS to another.

• From the list, select the Reprojection console.
• Insert EPSG:4326 in the Source CRS field and EPSG:32632 in the Target CRS field. Then, enter the coordinates of the POINT in the Geometry of Source CRS field, similar to what you see on the video. In this example, we used the coordinates of the San Siro stadium in Milan.
• Click on the Forward Transformation link; GeoServer calculates the new coordinates for you and fills the Geometry of Target CRS textbox. Use Forward transformation to convert from source CRS to target CRS, and Backward transformation to convert from target CRS to source CRS. You can also view the underlying calculation GeoServer is using to perform the transformation.

WCS Request Builder

The WCS Request Builder is a tool for generating and executing WCS requests. Since WCS requests can be cumbersome to the author, this tool can make working with WCS much easier. To access the WCS Request Builder, Select WCS Request Builder from the list of demos. The WCS Request Builder consists of a form that can be used to generate several different types of requests. When first opened, the form is short, only including these options:

• WCS Version—Version of WCS to use when crafting the request.
• Coverage name—Coverage to use in the request.

Note. All other options displayed will be non-functional until Coverage name is selected. Once selected, the remainder of the form will be displayed. Watch the video for a full explanation of these options:

• Spatial subset
• Coordinate reference system
• Specify source grid manually (1.0.0 only)
• Target coverage layout (1.1.1 only)
• Target CRS
• Output format

There is also a link for Describe coverage next to the Coverage name which will execute a WCS DescribeCoverage request for the particular layer. At the bottom of the form are two buttons for form submission:

• Get Coverage: It executes a GetCoverage request using the parameters in the form.
• Generate GetCoverage XML: Clicking this button generates the GetCoverage request based on the form parameters.

By using this generated XML code, you can easily construct and customize your GetCoverage requests with various parameters, making it easier to retrieve the desired coverage data from GeoServer.

New Feature: For GeoServer 2.25.2 the WCS Request Builder has new option to open the generated request in the Demo Request Builder. This is very helpful allowing the response to be shown on the page, rather than downloaded in the browser.

WPS Request Builder

GeoServer with the WPS extension installed includes a request builder for generating and executing WPS processes. Using this tool can greatly simplify the process of authoring WPS requests and making your work with WPS much more convenient and efficient. It’s always nice to have assistance in tasks that can be complex or time-consuming. This tool can be a valuable asset in your WPS workflow.

In future sessions, we’ll dive deep into the Web Processing Service or WPS and explore its functionalities and how to use different functions in detail. So get ready to expand your knowledge and learn how to leverage the power of WPS for your geospatial analysis needs!

New Feature: For GeoServer 2.25.2 the WPS Request Builder has the new option to open the generated request in the Demo Request Builder.

In this session, we took a brief journey through GeoServer Demo section. we have explored the Demo menu and its modules in GeoServer. If you want to access the complete tutorial, simply click on the link.

GeoServer 2.25.2 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a stable release of GeoServer recommended for production use. This release is made ahead of schedule to address an urgent bug or security vulnerability (see CVE-2024-36401 below). GeoServer 2.25.2 is made in conjunction with GeoTools 31.2, and GeoWebCache 1.25.2.

Thanks to Jody Garnett (GeoCat) for making this release on behalf of GeoCat customers.

Security Considerations

This release addresses security vulnerabilities and is considered an essential upgrade for production systems.

• CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions (Critical)
• CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat (Moderate)
• CVE-2024-35230 Moderate

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See the project security policy for more information on how security vulnerabilities are managed.

Demo Requests page rewritten

The Demo Request page has been rewritten to use JavaScript to issue POST examples. This provides a much better user experience:

• Show Result lists the response headers to be viewed along side the returned result (with an option for XML pretty printing).
• Show Result in a New Page is available to allow your browser to display the result.

The WCS Request Builder and WPS Request Builder demos now have the option to show their results in Demo Requests page. Combined these changes replace the previous practice of using an iframe popup, and have allowed the TestWfsPost servlet to be removed.

For more information please see the Demo requests in the User Guide.

Thanks to David Blasby (GeoCat) for these improvements, made on behalf of the GeoCat Live project.

• GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Release notes

New Feature:

• GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Improvement:

• GEOS-11351 Exact term search in the pages’ filters

Bug:

• GEOS-7183 Demo request/wcs/wps pages incompatible with HTTPS/PKI
• GEOS-11416 GeoPackage output contains invalid field types when exporting content from PostGIS
• GEOS-11430 CiteComplianceHack not correctly parsing the context

Task:

• GEOS-11411 Upgrade to ImageIO-EXT 1.4.11
• GEOS-11426 Rework community dependency packaging to use module’s dependencies
• GEOS-11429 Split COG community module packaging based on target cloud provider
• GEOS-11432 Upgrade to ImageIO-EXT 1.4.12

For the complete list see 2.25.2 release notes.

Community Updates

Community module development:

• GEOS-11412 Remove reference to JDOM from JMS Cluster (as JDOM is no longer in use)
• GEOS-11413 STAC uses inefficient dabase queries when asking for collections in JSON format

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.25 Series

Additional information on GeoServer 2.25 series:

• GeoServer 2.25 User Manual
• GeoServer 2024 Roadmap Plannings
• Raster Attribute Table extension
• Individual contributor clarification

Release notes: ( 2.25.2 | 2.25.1 | 2.25.0 | 2.25-RC )

GeoServer 2.24.4 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a maintenance release of GeoServer providing existing installations with minor updates and bug fixes. It also includes security vulnerability fixes.

GeoServer 2.24.4 is made in conjunction with GeoTools 30.4, and GeoWebCache 1.24.4.

Thanks to Peter Smythe (AfriGIS) for making this release.

Security Considerations

This release addresses security vulnerabilities and is considered an essential upgrade for production systems.

• CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions (Critical)
• CVE-2024-34696 GeoServer About Status lists sensitive Environmental Variables (Moderate)

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project security policy for more information on how security vulnerabilities are managed.

Demo Requests page rewritten

The Demo Request page has been rewritten to use JavaScript to issue POST examples. This provides a much better user experience:

• Show Result lists the response headers to be viewed along side the returned result (with an option for XML pretty printing).
• Show Result in a New Page is available to allow your browser to display the result.

The WCS Request Builder and WPS Request Builder demos now have the option to show their results in Demo Requests page. Combined these changes replace the previous practice of using an iframe popup, and have allowed the TestWfsPost servlet to be removed.

For more information please see the Demo requests in the User Guide.

Thanks to David Blasby (GeoCat) for these improvements, made on behalf of the GeoCat Live project.

• GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Release notes

New Feature:

• GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Improvement:

• GEOS-11311 Show a full stack trace in the JVM stack dump panel

• GEOS-11369 Additional authentication options for cascaded WMS

  WMTS data stores

• GEOS-11400 About Page Layout and display of build information
• GEOS-11401 Introduce environmental variables for Module Status page

Bug:

• GEOS-7183 Demo request/wcs/wps pages incompatible with HTTPS/PKI
• GEOS-11202 CAS extension doesn’t use global “proxy base URL” setting for service ticket
• GEOS-11331 OAuth2 can throw a “ java.lang.RuntimeException: Never should reach this point”
• GEOS-11332 Renaming style with uppercase/downcase empty the sld file
• GEOS-11382 The interceptor “CiteComplianceHack” never gets invoked by the Dispatcher Servlet
• GEOS-11385 Demo Requests functionality does not honour ENV variable PROXY_BASE_URL
• GEOS-11416 GeoPackage output contains invalid field types when exporting content from PostGIS
• GEOS-11430 CiteComplianceHack not correctly parsing the context

Task:

• GEOS-11318 Upgrade postgresql from 42.6.0 to 42.7.2
• GEOS-11374 Upgrade Spring version from 5.3.33 to 5.3.34
• GEOS-11375 GSIP 224 - Individual contributor clarification
• GEOS-11393 Upgrade commons-io from 2.12.0 to 2.16.1
• GEOS-11395 Upgrade guava from 32.0.0 to 33.2.0
• GEOS-11397 App-Schema Includes fix Integration Tests
• GEOS-11402 Upgrade PostgreSQL driver from 42.7.2 to 42.7.3
• GEOS-11403 Upgrade commons-text from 1.10.0 to 1.12.0
• GEOS-11404 Upgrade commons-codec from 1.15 to 1.17.0

For the complete list see 2.24.4 release notes.

Community Updates

Community module development:

• GEOS-11040 Could not get a ServiceInfo for service Features thus could not check if the service is enabled
• GEOS-11381 Error in OIDC plugin in combination with RoleService
• GEOS-11412 Remove reference to JDOM from JMS Cluster (as JDOM is no longer in use)

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.24 Series

Additional information on GeoServer 2.24 series:

• GeoServer 2.24 User Manual
• Control remote HTTP requests sent by GeoTools/GeoServer
• State of GeoServer 2.24.1 (foss4g-asia presentation)
• Multiple CRS authority support, planetary CRS
• Extensive GeoServer Printing improvements
• Upgraded security policy

Release notes: ( 2.24.4 | 2.24.3 | 2.24.2 | 2.24.1 | 2.24.0 | 2.24-RC )

GeoServer 2.23.6 release is now available with downloads (bin, war, windows), along with docs and extensions.

This series has previously reached end-of-life, with this release issued to address an urgent bug or security vulnerability (see CVE-2024-36401 below).

This GeoServer 2.23.6 update is provided as a temporary measure. Rather plan to upgrade to a stable GeoServer 2.25.2 or maintenance GeoServer 2.24.4.

GeoServer 2.23.6 is made in conjunction with GeoTools 29.6, and GeoWebCache 1.23.5.

Thanks to Jody Garnett (GeoCat) for making this release on behalf of GeoCat customers.

Security Considerations

This release addresses security vulnerabilities and is considered an essential update for production systems.

• CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions (Critical)

See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

• GEOS-11327 Add warning about using embedded data directories
• GEOS-11347 STAC Landing Page links should include root link

Bug:

• GEOS-11331 OAuth2 can throw a “java.lang.RuntimeException: Never should reach this point”

Task:

• GEOS-11316 Update Spring version to 5.3.32
• GEOS-11318 Upgrade postgresql from 42.6.0 to 42.7.2

For the complete list see 2.23.6 release notes.

Community Updates

Community module development:

• GEOS-11348 JMS cluster does not allow to publish style via REST “2 step” approach
• GEOS-11358 Feature-Autopopulate Update operation does not apply the Update Element filter
• GEOS-11381 Error in OIDC plugin in combination with RoleService
• GEOS-11412 Remove reference to JDOM from JMS Cluster (as JDOM is no longer in use)

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.23 Series

Additional information on GeoServer 2.23 series:

• GeoServer 2.23 User Manual
• Drop Java 8
• GUI CSS Cleanup
• Add the possibility to use fixed values in Capabilities for Dimension metadata
• State of GeoServer 2.23
• GeoServer Feature Frenzy 2023
• GeoServer used in fun and interesting ways
• GeoServer Orientation

Release notes: ( 2.23.6 | 2.23.5 | 2.23.4 | 2.23.3 | 2.23.2 | 2.23.1 | 2.23.0 | 2.23-RC1 )

GeoSpatial Techno is a startup focused on geospatial information that is providing e-learning courses to enhance the knowledge of geospatial information users, students, and other startups. The main approach of this startup is providing quality, valid specialized training in the field of geospatial information.

( YouTube | LinkedIn | Facebook | X )

How to Implement Basic Security in Geoserver

In this session, we want to discuss the Security section in GeoServer, Defining Users, Groups, and Roles, and Granting rights to created users. If you want to access the complete tutorial, simply click on the link.

Introduction

GeoServer has a robust security subsystem. Most of the security features are available through the Web Administration interface. In the Security panel, you can find links to set user properties and bind data to security rules. The basic idea is that you create users and roles, and then combine them with data rules to enable a specific set of access policies. You can also limit read and write access by role.

Defining users, groups, and roles

Security in GeoServer is based on a role system where each role defines a specific set of functions. You can assign roles to users and groups; that is, assign functions to real people using your system. To ensure data security, you must identify who is accessing your layers and services.

To organize your real users, GeoServer provides you with the user, group, and role concepts. With the first two, you can insert real people into the GeoServer security subsystem, and with roles, you can grant rights to real users.

User definition

In GeoServer, a user is someone entitled to use the system; it may be another software or a real person. When you add a user to the security system, GeoServer stores a username, uniquely identifying the user, a password, and a set of key/value pairs to store general information about it. You can disable a user at any time, preventing him from using the system.

Group definition

A group in GeoServer is a collection of users. It consists of a list of usernames that are part of the group, along with a unique group name that identifies it. Since GeoServer may have a large number of users, assigning roles to each individual user can be challenging. Therefore, groups can be created to simplify the process, allowing roles to be assigned based on the group membership of users.

Note. Considering that there are no dependencies between users, groups, and roles. A group can be disabled, but note that this only removes the roles deriving from the disabled group and does not disable the users belonging to the group.

Roles definition

GeoServer roles are associated with performing certain tasks or accessing particular resources. Roles are assigned to users and groups, authorizing them to perform the actions associated with the role.

Creating users and groups

To fully understand how security works in GeoServer, we will use a typical scenario. We want to restrict access to this data to only the organization’s members. Inside the organization, there are a few people editing data to create new data sets or to update existing ones, and many more members who need to read data to compose maps. There is also a need for an administrator to keep it all working. Lastly, we need to consider that our GeoServer site also contains data that should remain freely available. We will now create the security organization from an unsecured GeoServer as follows:

• In the Security section of the left pane, click the Users, Groups, and Roles link. This link shows you the User Group Services configured. You will find the default service shipped with GeoServer. Click on the Name to edit it.
• Select the Groups tab, then click on Add a new group.
• Enter group_readers as a group name and leave the group Enabled. Do not assign any role to the new group as we will create specific roles later. Press the Save button.
• Repeat the previous step to create the group_editors and group_admins groups. Your list should now show the three groups.
• Now switch to the Users tab. Obviously, it lists the only existing user, that is, admin, as shown in the screen.
• Click on the Add new user link, and add user_admin with a password of your choice, as Data Administrator.
• Add “user_admin” to the “group_admins”, then press the Save button.
• Repeat the previous step to create a user, user_editor as a member of the “group_editors” group, and user_reader as a “group_readers” group member. Your list now shows the three users.

We just created three users for the three groups and this may seem overkill to you. Consider them as templates for real users. In the real world, we do not want to have too many administrators; we will probably need several “user_readers” and “user_editors” processing the data. Now, we need to define what they can do on GeoServer.

Defining roles

A user or a group without any role assigned is useless. Now it is time to create roles and assign them to our users. Please refer to the following points:

• From the User, Groups, and Roles section, select the Roles tab. You will find that two roles already exist. They are the administrative roles assigned to the admin account, and they grant access to all GeoServer configurations. Click on the Edit link
• Switch to the Roles tab, then click on Add new role.
• Enter role_reader as a new role name. We do not need a Parent role. A child role inherits all the rights from the Parent role, making it useful when you want to extend a basic role with more rights. Indeed, we will do this in the next step.
• Press the Save button and then repeat the previous step to create the role_editor role. This time, select “role_reader” as the Parent role.
• Press the Save button and then repeat the previous step to create the role_admin role. This time, select “role_editor” as the Parent role.
• The final step is to associate a role to users or groups. Select the User, Groups, and Roles page from the left pane, then select the Groups list and click on the “group_readers” group to edit it. Add the “role_reader” role to the group and save it.
• Now click on the “group_editors” group and associate it with the role_editor role.
• Finally, associate the “group_admins” group to the “role_admin” role.

By defining roles and associating them to the users, we completed the definition of our organization. Now, we need to explore how data is bound to roles and users.

Accessing data and services

GeoServer supports access control at both the service level and at the per-layer or per-workspace level, allowing for restriction of service operations to authenticate users with specific roles. This helps in ensuring data security and controlling access to different layers or workspaces within the server. When working with layers, you can define rules that specify what a role can do on any specific layer.

The operations controlled are the view, write, and admin access. When granting read access on a layer, you enable a user to add it on a map; while granting write access you enable the user to update, create, and delete features contained in the layer. The admin access level enables the user to update the layer’s configuration.

Layer Security

We want to protect the dataset contained in the test workspace from unauthorized access while leaving the remaining layers freely available to all users. In this section, we will associate layers and roles:

• Navigate to the Data > Security page. The rules list shows the two shipped with the default GeoServer configuration. The *.*.r rule is associated with the * roles. This means that “any user”, including the anonymous one, can access “any layer” from “any workspace” configured on GeoServer. The general format of the rules is: workspace.layer.accessMode.
• Now click on the Add new rule link. In the rule editing page, select test as the Workspace and leave “*” as a Layer. Since we want to protect all layers in this workspace, the Access mode should be Read. Select the “role_reader” role and move it to the right list by clicking on the arrow. Press the Save button to create the reading rule.
• Repeat the previous step to create a writing rule. Select Write as the access mode and “role_editor” as the role.
• Repeat the previous step, then create the administration rule. In other words, select Admin as the Access mode and “role_admin” as the Role.
• Press the Save button, on the rule list page, and then log off from the GeoServer web interface. If you try to access the layer preview anonymously, you won’t see any layers from the test workspace while all the others are still listed.
• Now, log on as “user_reader”, with the password you assigned to him. Going back to the layer preview, you should see the test layers listed. Try the Open Layers preview page for the river layer. It works and you can use the data to compose maps.
• However, “user_reader” can’t edit the styles associated with the layer or any other property. He would need admin rights granted for it; can you guess who the proper user will be?
• Log on to GeoServer as “user_admin”. Now, the left pane is richer than it was when you were “user_reader”, but with fewer features than those visible to the GeoServer’s default admin role. Click on the Layer link; you will see only the layers belonging to the test workspace.
• If you go on Layer preview and select the rivers layer again, can you see the map? Of course, you can. Because of roles inheritance, which you set when creating the roles. So, “role_admin” inherits all the rights from “role_editor”, and hence from “role_reader”.

In this session, we took a brief journey through GeoServer security. we discussed the Security section, Defining Users, Groups, and Roles, and Granting rights to created users in GeoServer. If you want to access the complete tutorial, simply click on the link.