User/group services

A user/group service provides the following information for users and groups:

  • Listing of users
  • Listing of groups, including users affiliated with each group
  • User passwords

Many authentication providers will make use of a user/group service to perform authentication. In this case, the user/group service would be the database against which users and passwords are authenticated. Depending on how the Authentication chain is configured, there may be zero, one, or multiple user/group services active at any given time.

A user/group service may be read-only, providing access to user information but not allowing new users and groups to be added or altered. This may occur if a user/group service was configured to delegate to an external service for the users and groups database. An example of this would be an external LDAP server.

By default, GeoServer support two types of user/group services:

  • XML—(Default) User/group service persisted as XML
  • JDBC—User/group service persisted in database via JDBC

XML user/group service

The XML user/group service persists the user/group database in an XML file. This is the default behavior in GeoServer. This service represents the user database as XML, and corresponds to this XML schema.

Note

The XML user/group file, users.xml, is located in the GeoServer data directory, security/usergroup/<name>/users.xml, where <name> is the name of the user/group service.

The following is the contents of users.xml that ships with the default GeoServer configuration:

<userRegistry version="1.0" xmlns="http://www.geoserver.org/security/users">
  <users>
    <user enabled="true" name="admin" password="crypt1:5WK8hBrtrte9wtImg5i5fjnd8VeqCjDB"/>
  </users>
  <groups/>
</userRegistry>

This particular configuration defines a single user, admin, and no groups. By default, stored user passwords are encrypted using the weak PBE method.

For further information, please refer to configuring a user/group service in the Web administration interface.

JDBC user/group service

The JDBC user/group service persists the user/group database via JDBC, managing the user information in multiple tables. The user/group database schema is as follows:

Table: users
Field Type Null Key
name varchar(128) NO PRI
password varchar(254) YES  
enabled char(1) NO  
Table: user_props
Field Type Null Key
username varchar(128) NO PRI
propname varchar(64) NO PRI
propvalue varchar(2048) YES  
Table: groups
Field Type Null Key
name varchar(128) NO PRI
enabled char(1) NO  
Table: group_members
Field Type Null Key
groupname varchar(128) NO PRI
username varchar(128) NO PRI

The users table is the primary table and contains the list of users with associated passwords. The user_props table maps additional properties to a user. (See Users and Groups for more details.) The groups table lists all available groups, and the group_members table maps which users belong to which groups.

The default GeoServer security configuration is:

Table: users
name password enabled
Empty Empty Empty
Table: user_props
username propname propvalue
Empty Empty Empty
Table: groups
name enabled
Empty Empty
Table: group_members
groupname username
Empty Empty

For further information, please refer to configuring a user/group service in the Web administration interface.

LDAP user/group service

The LDAP user/group service is a read only user/group service that maps users and groups from an LDAP repository to GeoServer users and groups.

Users are extracted from a specific LDAP node, configured as the Users search base. Groups are extracted from a specific LDAP node, configured as the Groups search base. A user is mapped for every matching user and a group is mapped for every matching group.

It is possible to specify the attributes which contain the name of the group (such as cn), the user (such as uid) as well as the membership relationship between the two (such as member). However, it is also possible to specify specific filters to search for all users/groups (for example cn=*), find a user/group by name (for example cn={0}) and map users to groups (such as member={0}). These filters can also be automatically derived from the attribute names. Alternatively, the attribute names may be left empty if the filters are provided.

For users, additional properties (key/value pairs, see Users and Groups) may be populated from the LDAP Server by providing a comma separated list of property names.

Retrieving the user/group information can be done anonymously or using a given username/password if the LDAP repository requires it.

An example of configuration file (config.xml) for this type of role service is the following:

<org.geoserver.security.ldap.LDAPUserGroupServiceConfig>
  <id>2c3e0e8d:154853796a3:-8000</id>
  <name>myldapservice</name>
  <className>org.geoserver.security.ldap.LDAPUserGroupService</className>
  <serverURL>ldap://127.0.0.1:10389/dc=acme,dc=org</serverURL>
  <groupSearchBase>ou=groups</groupSearchBase>
  <groupFilter>cn={0}</groupFilter>
  <groupNameAttribute>cn</groupNameAttribute>
  <allGroupsSearchFilter>cn=*</allGroupsSearchFilter>
  <groupSearchFilter>member={0}</groupSearchFilter>
  <groupMembershipAttribute>member</groupMembershipAttribute>
  <userSearchBase>ou=people</userSearchBase>
  <userFilter>uid</userFilter>
  <userNameAttribute>uid={0}</userNameAttribute>
  <allUsersSearchFilter>uid=*</allUsersSearchFilter>
  <useTLS>false</useTLS>
  <bindBeforeGroupSearch>true</bindBeforeGroupSearch>
  <user>admin</user>
  <password>admin</password>
  <passwordEncoderName>emptyPasswordEncoder</passwordEncoderName>
  <passwordPolicyName>default</passwordPolicyName>
  <populatedAttributes>email, telephone</populatedAttributes>
</org.geoserver.security.ldap.LDAPUserGroupServiceConfig>

For further information, please refer to configuring a user/group service in the Web administration interface.

Previous: Users and Groups
Next: Roles