Protect WMS and WFS with the same path

This how-to describes how to protect multiple services with different service types, e.g. WMS and WFS, on the same path.

Some services provide different OGC web services, e.g. WMS and WFS, on the same path. GeoServer, for example, provides WMS and WFS under a URL like this https://gisserver.example.com/geoserver/ows.

To protect these services with security.manager for OGC, you can define multiple services with different service types on the same path in the server configuration.

Note that we do not recommend offering different services on the same path. If possible, use different paths for different services.

Server configuration

The following configuration demonstrates the necessary settings in the server configuration:

server-config.json

{
  "server": {
    "host": "https://gisserver.example.com",
    "services": [
      {
        "path": "/path/to/nature",
        "type": "WMS",
        "policy-ref": "nature-wms-policy"
      },
      {
        "path": "/path/to/nature",
        "type": "WFS",
        "policy-ref": "nature-wfs-policy"
      }
    ]
  }
}

In this example, two services are protected on the path /path/to/nature. The first service is a WMS service, the second a WFS service. Both services have different permissions, which are referenced via the policy-ref.

How it works

security.manager for OGC distinguishes between the two services based on the SERVICE parameter in incoming OGC requests. Depending on whether the SERVICE parameter has the value WMS or WFS, the request is forwarded to the corresponding service and the corresponding access rights are applied.