Fix #10966 basic auth for services by MV88 · Pull Request #11067 · geosolutions-it/MapStore2

MV88 · 2025-05-02T12:27:47Z

Description

A new SecurityPopup plugin has been added to handle secured services using basic auth.

main features

you can defined protected services in the catalog service editor of main viewer through a new button
this button is injected from SecurityPlugin to enhance Catalog one
when defined a new username and password for a particular service and you save the service all layers added now will be "secured"
credentials are stored in session storage
security object of layers are stored, but it only stores the sourceId to be able to fetch from session storage an the type of method ("basic")
also services has a protectedId property that detemines if a service requires basic auth
this is applied to maps, dashboards and geostories
when resource page is loaded a check is done and if we find one or more services/layers protected we ask for introducing credentials if they are not present is session storage otherwise
all layers update functions have been considering a security change (rand property is used to trigger the refresh and therefore render the layer)

Please check if the PR fulfills these requirements

The commit message follows our guidelines: https://github.com/geosolutions-it/MapStore2/blob/master/CONTRIBUTING.md
Tests for the changes have been added (for bug fixes / features)
Docs have been added / updated (for bug fixes / features)

What kind of change does this PR introduce? (check one with "x", remove the others)

Issue

What is the current behavior?

Fix #10966

What is the new behavior?

Breaking change

Does this PR introduce a breaking change? (check one with "x", remove the other)

Yes, and I documented them in migration notes
No

Other useful information

This is how a secured service look like

For tester

We created a set of rules using GeoFence in gs-stable for testing. i have created a layer "linea costa basic" that has access using some credentials, can can ask in pvt. so you can try using it

the idea is that this will only work if a protected service is configured, and failing if not. This will be valid for many layer types in ol and cesium

with cesium test WMS and WMTS, TileProvider
with openlayers test WMS, WMTS, WFS, ARCGIS, TMS, TileProvider, COG

# This is the 1st commit message: Fix geosolutions-it#10966 basic auth for services # This is the commit message #2: Wip

allyoucanmap · 2025-05-05T08:02:47Z

web/client/actions/layers.js

        options
    };
 }
+export function refreshSecurityLayers() {


Could you add a comment or jsdoc to explain this action?

allyoucanmap · 2025-05-05T08:15:21Z

web/client/actions/security.js

+/**
+ * set status to show modal for inserting credentials
+ * @param {boolean} status
+ */
+export const setShowModalStatus = (status) => {
+    return {
+        status,
+        type: SET_SHOW_MODAL_STATUS
+    };
+};
+/**
+ * set protected services to request to provide username and password
+ * @param {object[]} protectedServices
+ */
+export const setProtectedServices = (protectedServices) => {
+    return {
+        protectedServices,
+        type: SET_PROTECTED_SERVICES
+    };
+};


These two actions seems specific for the SecurityPopup plugin but they are inside the security actions.

@MV88 please ignore this comment

i did not want to create a securityPopop folder for just these actions but since the plugin is about security it might be good to have theme here

web/client/actions/security.js

allyoucanmap · 2025-05-05T08:25:08Z

web/client/components/map/cesium/plugins/WMTSLayer.js

            url: head(getURLs(isArray(options.url) ? options.url : [options.url], queryParametersString)),
-            proxy: proxy && new WMTSProxy(proxy) || new NoProxy()
+            proxy: proxy && new WMTSProxy(proxy) || new NoProxy(),
+            ...(headers)


Looking at the doc, headers should be an object not spread inside the Cesium.Resource class, could you double check if it's working?

allyoucanmap · 2025-05-05T08:27:45Z

web/client/components/map/openlayers/plugins/WMSLayer.js


 import {optionsToVendorParams} from '../../../../utils/VendorParamsUtils';
-import {addAuthenticationToSLD, addAuthenticationParameter, getAuthenticationHeaders} from '../../../../utils/SecurityUtils';
+import {/* getCredentials, */addAuthenticationToSLD, addAuthenticationParameter, getAuthenticationHeaders} from '../../../../utils/SecurityUtils';


please remove the commented method

web/client/plugins/MetadataExplorer.jsx

allyoucanmap · 2025-05-05T08:34:33Z

web/client/actions/security.js

+export const setCredentialsAction = (protectedService, creds) => {
+    if (creds && protectedService.protectedId) {
+        setCredentials(protectedService.protectedId, {
+            ...creds,
+            url: protectedService.url
+        });
+    }
+    return {
+        protectedService,
+        type: SET_CREDENTIALS
+    };
+};


Not sure if it would be better to have the setCredentials side effect inside the reducer instead of the action

web/client/utils/LayersUtils.js

web/client/plugins/MetadataExplorer.jsx

Co-authored-by: stefano bovio <stefano.bovio@geosolutionsgroup.com>

) * # This is a combination of 2 commits. Fix geosolutions-it#10966 basic auth for services Wip * Fix geosolutions-it#10966 basic auth for services * update config * fix jsdoc * fix jsdoc * fix tests * update review * clean up * fix tests * Update web/client/plugins/MetadataExplorer.jsx Co-authored-by: stefano bovio <stefano.bovio@geosolutionsgroup.com> * Update web/client/plugins/MetadataExplorer.jsx Co-authored-by: stefano bovio <stefano.bovio@geosolutionsgroup.com> --------- Co-authored-by: stefano bovio <stefano.bovio@geosolutionsgroup.com>

ElenaGallo · 2025-05-06T09:08:43Z

@MV88
1_ If the credentials are not entered in the service, it is still possible to add the "basic coastline" level to the map

1.mp4

2_ when I set the credentials and click on the Confirm button, the credentials popup does not close automatically. You have to click on Cancel

2.mp4

3_ Once the Authentication button turns green, when you open it, the username and password are not visible

3.mp4

MV88 · 2025-05-06T11:08:03Z

1_ If the credentials are not entered in the service, it is still possible to add the "basic coastline" level to the map

@tdipisa do we have to check this before adding the layer? from getCapabilities id no not know if a layer is protected via basic auth, the admin should know it, otherwise we have to try to make a request per each record to see if the getMap will fail or not without basic auth, but i',m not sure if we want this now or in the future

2_ when I set the credentials and click on the Confirm button, the credentials popup does not close automatically. You have to click on Cancel

checking probably a quick issue

3_ Once the Authentication button turns green, when you open it, the username and password are not visible

this is because credentials are not persisted in the application, but only if a service / layers is protected using ids

tdipisa · 2025-05-07T07:52:41Z

1_ If the credentials are not entered in the service, it is still possible to add the "basic coastline" level to the map

@tdipisa do we have to check this before adding the layer? from getCapabilities id no not know if a layer is protected via basic auth, the admin should know it, otherwise we have to try to make a request per each record to see if the getMap will fail or not without basic auth, but i',m not sure if we want this now or in the future

2_ when I set the credentials and click on the Confirm button, the credentials popup does not close automatically. You have to click on Cancel

checking probably a quick issue

3_ Once the Authentication button turns green, when you open it, the username and password are not visible

this is because credentials are not persisted in the application, but only if a service / layers is protected using ids

Status after last sync reported in #10966 (comment)

#11070)

MV88 added 3 commits May 2, 2025 12:34

# This is a combination of 2 commits.

e076cf3

# This is the 1st commit message: Fix geosolutions-it#10966 basic auth for services # This is the commit message #2: Wip

Fix geosolutions-it#10966 basic auth for services

ec4d17e

update config

eb61668

MV88 added the New Feature used for new functionalities label May 2, 2025

MV88 added this to the 2025.02.00 milestone May 2, 2025

MV88 requested a review from tdipisa May 2, 2025 12:27

MV88 self-assigned this May 2, 2025

MV88 added 3 commits May 2, 2025 15:49

fix jsdoc

88de6f1

fix jsdoc

2216efa

fix tests

99dcd7f

tdipisa requested review from allyoucanmap and removed request for tdipisa May 2, 2025 16:29

allyoucanmap requested changes May 5, 2025

View reviewed changes

MV88 added 3 commits May 5, 2025 12:56

update review

440e296

clean up

197ec85

fix tests

c25c5d7

MV88 requested a review from allyoucanmap May 5, 2025 11:42

allyoucanmap reviewed May 5, 2025

View reviewed changes

web/client/plugins/MetadataExplorer.jsx Outdated Show resolved Hide resolved

web/client/plugins/MetadataExplorer.jsx Outdated Show resolved Hide resolved

MV88 and others added 2 commits May 5, 2025 14:41

Update web/client/plugins/MetadataExplorer.jsx

a0fc468

Co-authored-by: stefano bovio <stefano.bovio@geosolutionsgroup.com>

Update web/client/plugins/MetadataExplorer.jsx

d3a1987

Co-authored-by: stefano bovio <stefano.bovio@geosolutionsgroup.com>

allyoucanmap self-requested a review May 5, 2025 12:42

allyoucanmap approved these changes May 5, 2025

View reviewed changes

tdipisa enabled auto-merge (squash) May 5, 2025 12:48

tdipisa merged commit 0bb73f5 into geosolutions-it:master May 5, 2025
5 checks passed

MV88 mentioned this pull request May 5, 2025

backport c027-2024.01.xx - Fix #10966 basic auth for services (#11067) #11070

Merged

allyoucanmap pushed a commit that referenced this pull request May 13, 2025

backport c027-2024.01.xx - Fix #10966 basic auth for services (#11067) (

51ca3d0

#11070)

dsuren1 mentioned this pull request Jul 11, 2025

[Backport 2025.01.xx] #11252: Replace font-awesome icon with glyphicon (#11261) #11306

Merged

Conversation

MV88 commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Breaking change

Other useful information

For tester

Uh oh!

allyoucanmap May 5, 2025

Choose a reason for hiding this comment

Uh oh!

allyoucanmap May 5, 2025

Choose a reason for hiding this comment

Uh oh!

allyoucanmap May 5, 2025

Choose a reason for hiding this comment

Uh oh!

MV88 May 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

allyoucanmap May 5, 2025

Choose a reason for hiding this comment

Uh oh!

allyoucanmap May 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

allyoucanmap May 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ElenaGallo commented May 6, 2025

Uh oh!

MV88 commented May 6, 2025

Uh oh!

tdipisa commented May 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MV88 commented May 2, 2025 •

edited

Loading