Re: [MapServer-users] Security and LDAP with mapservet
G. Völkl via MapServer-users: > Hello, > > I want to create some WMS Services which can be only accessed by some Special > Users. > > Is it possible to Secure wms Services? Is it possible to use LDAP. > > Best regards Gerhard > Von meinem iPhone gesendet You can secure Mapserver WMS using whatever webserver you are exposing them through, be it NGINX og Apache (0). I know Apache supports ldap (1) and I would guess NGINX does to. If you expose Mapserver WMS through mapscript, you can handle authn/authz inside your mapscript-code. (0) https://httpd.apache.org/docs/2.4/howto/auth.html (1) https://httpd.apache.org/docs/2.4/mod/mod_ldap.html -- BEst regards Bjørn Ove Grøtan ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [MapServer-users] Mapserver requests / prometheus metrics
Marcin Niemyjski via MapServer-users: > Hello, > > does mapserver expose any prometheus metrics that I can scrape? I'm > especially interested in metrics related to number of requests per second. > > Thanks, Marcin > Not that I'm aware of. Mapserver doesn't run a webserver by itself, but is meant to be run as stateless cgi/fastcgi in a webserver such as Apache, NginX or other. You could propably make one of those servers give you some metrics Example: https://promcat.io/apps/apache Would be nice to see an exporter able to understand the OGC specific stuff, like layers and request-types, but maybe you can configure a custom parser. -- Kind regards Bjørn Ove Grøtan ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [MapServer-users] Link in SLD doc returns an exception
Brent Fraser: > Hi All, > > I'm experimenting with SLD and reading the MapServer doc. On the SLD page > under Server Side Support, it says "Test the remote SLD request" with a link > to > > https://demo.mapserver.org/cgi-bin/wms?SERVICE=wms=1.1.1=GetMap=country_bounds=png=400=300=EPSG:4326==-180.0,-90.0,180.0,90.0=TRUE=https://demo.mapserver.org/ogc-demos/map/sld/sld_line_simple.xml > > The link looks good but it returns an exception: > > > "http://schemas.opengis.net/wms/1.1.1/exception_1_1_1.dtd;> > > > msSLDApplySLDURL: WMS server error. Could not open SLD > https://demo.mapserver.org/ogc-demos/map/sld/sld_line_simple.xml and save it > in a temporary file. Please make sure that the sld url is valid and that the > temporary path is set. The temporary path can be defined for example by > setting TEMPPATH in the map file. Please check the MapServer documentation on > temporary path settings. > msHTTPExecuteRequests(): HTTP request error. HTTP GET request failed with > status 404 () for > https://demo.mapserver.org/ogc-demos/map/sld/sld_line_simple.xml > > > > Is the demo in a repo somewhere or does someone have some insight? Thanks! The error message is correct, https://demo.mapserver.org/ogc-demos/map/sld/sld_line_simple.xml returns a 404 Page not found, The root folder at /ogc-demos/ has been removed at some point. Be aware though, that not all WMS-servers allow (by configuration) external hosted SLD-files due to potential XXE (XML eXternal Entity) vulnerability, Also might be of interrest: the Mapserver implementation of GetStyle-request (return SLD for a given layer) has some limitations on line-symbols where images (png) are placed along the line symbol, and same with polygon fills using a repeated png-file as fill - but simple polygon symbologies with a solid fill color works as expected. -- Kind regards Bjørn Ove Grøtan ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [MapServer-users] WMS GetCapabilities map minx, miny etc transposed
Jody Klymak: > Hi, > > I am a new user, using mapserver 8.0.0: > > I have been going through the tutorials and have trouble making rasters work > on my WMS server. The same map file works fine in QGIS, so I think there is > a bug in mapserver, but wanted to write here in case I am doing anything > silly. > > If I query the server I get layers that have minx miny in the BoundingBox > that are transposed with respect to lat and lon: > > ``` > > modis > modis > EPSG:4326 > > -97.238976 > -82.122902 > 41.619778 > 49.385620 > > > maxx="49.385620" maxy="-82.122902"/> > > > text/xml > http://www.w3.org/1999/xlink; > xlink:type="simple" > xlink:href="https://cproof.uvic.ca/cgi-bin/mapserv?map=/usr/local/opt/mapserver/cproof/mapserver_raster.map=GetMetadata=modis"/> > > > ``` > > If I query the wms server with > > `https://cproof.uvic.ca/cgi-bin/mapserv?map=/usr/local/opt/mapserver/cproof/mapserver_raster.map=WMS=1.3=Map=modis=EPSG:4326=-97.238976,41.619778,-82.122902,49.385620=png=360=270` It's "request=GetMap" not "request=Map". > > I get a blank image > > If I swap lat for lon in the BBOX=41.619778,-97.238976,49.385620,-82.122902, > then it works, but is of course distorted. > > Maybe I’m really mis-understanding the BBOX parameter, but it seems that > there is a bug where someone has said x is equivalent to latitude, where they > meant longitude. > > Again, this map works fine in QGIS, I assume because it doesn’t look at the > BoundingBox and just uses the etc. > > The map file is > > ``` > MAP > NAME "MAPSERVER_RASTER" > IMAGETYPE PNG24 > EXTENT-97.238976 41.619778 -82.122902 49.385620 > SIZE 360 270 > SHAPEPATH "./data/" > IMAGECOLOR 200 200 200 > > PROJECTION > "init=epsg:4326" > END > > WEB > METADATA > ows_title "MapServer Raster" > ows_enable_request "*" > ows_srs "EPSG:4326" > ows_onlineresource > "https://cproof.uvic.ca/cgi-bin/mapserv?map=/usr/local/opt/mapserver/cproof/mapserver_raster.map; > END > END > LAYER # MODIS raster layer begins here > NAME "modis" > DATA "ugl_ref2.png" > STATUS DEFAULT > TYPE RASTER > EXTENT-97.238976 41.619778 -82.122902 49.385620 > OFFSITE 71 74 65 > PROJECTION > "init=epsg:4326" > END > END # MODIS raster layer ends here > END > ``` > > Thanks, Jody > > ___ > MapServer-users mailing list > MapServer-users@lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapserver-users -- Kind regards Bjørn Ove Grøtan ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [MapServer-users] Mapserver x k8s issue
Marcin Niemyjski via MapServer-users: > Hello, > > I'm involved in the development of a project connecting Mapserver with > capabilities of Kubernetes like scalability, load balancing etc. > > We've run into problem wich I think can be solved on the side o Mapserver, > namely: > > The k8s external IP cannot immediately be placed in "wms_onlineresource" > because it takes time to generate it. Up to now I have checked the WMS > operation by GetCapabilites, GetMap queries, and set "wms_onlineresource" to > http://localhost:80/?map=/etc/mapserver/map1-test.map. I've made requests > (GetMap GetCapabilites) via http:// Address>/?map=/etc/mapserver/map1-test.map - everything was working. However, > when loading the layer into QGIS nothing happened. I believe this is because > even though the queries work using url with external IP, the information that > comes in the XML file contains localhost:80 and QGIS is trying to connect to > a layer that does not exist locally. > > Is there any way for the mapserver to know that localhost:80 must be replaced > with the external ip address from the query? Comment out the ows_onlineresource configuration, and Mapserver will utilize whatever hostname you reached it at. That way, the same mapfile can be used in local development, test/qa and production without need for changing ows_onlineresource when moving between environments. One caveat we came across, having a reverse proxy in front of our mapserver (w/apache). http->http => wms_onlineresource will use http https->https => wms_onlineresource will use https https->http => wms_onlineresource will use http, even though http headers for forward port and forward proto is set. Other than that, you will be fine with not configuring ows/wms_onlineresource in your mapfile. -- Kind regards Bjørn Ove Grøtan ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [MapServer-users] Content of WMS based on attribute
You can also use Dimensions: https://mapserver.org/ogc/wms_dimension.html#enabling-dimension-support-in-mapserver Which is supported outside vendor specific parameters. Dimensions can be e.g. a codelist of values (text), and not just time or elevation dimension. Dimensions will be reflected in GetCapabilities-document, so you can build your user interface on top of that. -Bjørn Ove Jörg Thomsen (WhereGroup): > Hello Marcin, > > no problem, you can achieve this with vendor specific parameters and > run-time-substitution: > https://mapserver.org/cgi/runsub.html > > Jörg > > > > > > Am 19.08.22 um 14:30 schrieb Marcin Niemyjski via MapServer-users: > > Hello, > > > > I am wondering if it is possible to modify the GetMap request so that it > > displays elements of the Postgresql database based on the value of their > > attributes, e.g., having a set of polygons representing fields by > > writing crop = sunflower in the GetMap request, the polygons > > representing that crop will be returned. > > > > Thanks, > > Marcin > > > > > > ___ > > MapServer-users mailing list > > MapServer-users@lists.osgeo.org > > https://lists.osgeo.org/mailman/listinfo/mapserver-users > > > -- > Viele Grüße, > Jörg Thomsen > > - > Aufwind durch Wissen! > Jetzt neu: Web-Seminare und Online-Schulungen > bei der www.foss-academy.com > - > > Jörg Thomsen > WhereGroup GmbH > Bundesallee 23 > 10717 Berlin > Germany > > Tel: +49 (0)30 / 5130 278 74 > Fax: +49 (0)30 / 5130 278 11 > > joerg.thom...@wheregroup.com > www.wheregroup.com > > Geschäftsführer: > Olaf Knopp, Peter Stamm > Amtsgericht Bonn, HRB 9885 > > --- > Folgen Sie der WhereGroup auf twitter: http://twitter.com/WhereGroup_com > ___ > MapServer-users mailing list > MapServer-users@lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapserver-users ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [mapserver-users] dynamic ows_serviceurl
Paul via MapServer-users: > Thanx for the suggestions Kaido, Seth, Steve. Updating the mapfile at > deployment indeed is a better option then the querystring approach, let me > verify what scripting options (sed?) i have on our docker image. If you omit setting the ows_onlineresource (just try to commend it out) in the .map-file, mapserver will dynamically use the path (e.g. domain) it was reached by. Thus you can have the same mapfile on dev, test, qa or production and they will have individual domains. If you reach the server-instance, it will use the server-name (and port) rather than the proxied domain, but then it will be easier to problem shoot individual server instances using plain gis-tools that utilize metadata such as ows_onlineresource. We tested this some years ago, and have the following expereience using a reverse proxy in front of a mapserver cluster: http -> http ows_onlineresource will use http://whatever.domain.reached.by.frontend.com/path/to/mapservice https -> https will use https://whatever.domain.reached.by.frontend.com/path/to/mapservice https -> http (ssl-offloading) will unfortunately use http://blablabla, even if we set forward proto and forwarded port on the proxy-end. It would be nice if mapserver could use an ssl-offloading proxy, be it haproxy, nginx or something else. So, the ows_onlineresource-problem was solved for us by having a fail-over frontend holding the domains, and different mapserver-clusters for load balancing and fail-over - we just had to live with configuring certificates also for the backend servers for the different environments (domains). -- Kind regards Bjørn Ove Grøtan ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [mapserver-users] security problem?
Uhm - guess not many are using the Mapscript Java-binding then? (I don't, so haven't tested) https://mapserver.org/ogc/mapscript.html But as Jukka said, Mapserver in itself is not written in Java. If you are using Mapscript w/Java bindings, you have to check for yourself what you do in your own code. According to https://trac.osgeo.org/mapserver/wiki/JavaMapscriptUsing commons-logging is being used, not log4j - if you are indeed using Mapscript-Java. -Bjørn Rahkonen Jukka (MML): > Hi, > > Log4j is a Java library, Mapserver is not Java. You can feel safe with this > issue. > > -Jukka Rahkonen- > > Lähettäjä: MapServer-users Puolesta > Zimmer Rene > Lähetetty: tiistai 14. joulukuuta 2021 15.36 > Vastaanottaja: 'mapserver-users@lists.osgeo.org' > > Aihe: [mapserver-users] security problem? > > Hello everybody, > > when using Mapserver, is there also a security problem with log4j? > > Is it used? > > If so, how can the gap be closed? > > > Thanks, > > Rene > > > > > -- > > This email was Anti Virus checked by Astaro Security Gateway. > > > > Geprüft und getestet > ___ > MapServer-users mailing list > MapServer-users@lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapserver-users ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [mapserver-users] mapcache behind nginx with ssl
I had the same issue with HAProxy in front and Mapserver on Apache in the back. 1. http->http (returns http-urls) 2. https->http (returns http-urls) 3. https->https (returns https-urls) Even if I tell the backend that the client request protocol was https on port 443 (forwardfor,forwardport,forwardprotocol). It would be nice if Mapserver could utilize information from forwardport/forwardprotocol, so we could do ssl-offloading instead of ssl-passthrough - if we wanted to. My solution was to serve a dummy-certificate on the backend, and configure alt. 1 and 2. -Bjørn Ove Trygve Aspenes: > Hi there > > I have put up a mapserver behind nginx with ssl and a curl like this > > curl -s > "https://mapserver/cgi-bin/mapserv?map=/data/mapserver/map-files/mapserver-8505ad3e-f9e3-4de3-a080-8253443ac954-20210908T120432Z.map=WMS=GetCapabilities; > | grep OnlineResource > > Gives me like: > > http://www.w3.org/1999/xlink; > xlink:href="https://mapserver/cgi-bin/mapserv?map=/data/mapserver/map-files/mapserver-8505ad3e-f9e3-4de3-a080-8253443ac954-20210908T120432Z.map"/> > http://www.w3.org/1999/xlink; > xlink:href="https://mapserver/cgi-bin/mapserv?map=/data/mapserver/map-files/mapserver-8505ad3e-f9e3-4de3-a080-8253443ac954-20210908T120432Z.map"/> > http://www.w3.org/1999/xlink; > xlink:href="https://mapserver/cgi-bin/mapserv?map=/data/mapserver/map-files/mapserver-8505ad3e-f9e3-4de3-a080-8253443ac954-20210908T120432Z.map"/> > http://www.w3.org/1999/xlink; > xlink:href="https://mapserver/cgi-bin/mapserv?map=/data/mapserver/map-files/mapserver-8505ad3e-f9e3-4de3-a080-8253443ac954-20210908T120432Z.map"/> > http://www.w3.org/1999/xlink; > xlink:href="https://mapserver/cgi-bin/mapserv?map=/data/mapserver/map-files/mapserver-8505ad3e-f9e3-4de3-a080-8253443ac954-20210908T120432Z.map"/> > > Yeah you get the idea. Everything perfect with https in the href link. > Thanks! > > So I put up a mapcache which I intend to put up i front of mapserver. When I > do a similar curl like: > > curl -s > "https://mapcache/mapcache?Overview=/data/mapserver/map-files/mapserver-8505ad3e-f9e3-4de3-a080-8253443ac954-20210908T120432Z.map=WMS=GetCapabilities; > | xmllint --format - | grep OnlineResource > > I get: > > http://www.w3.org/1999/xlink; > xlink:href="http://mapcache:8090/mapcache?"/> > http://www.w3.org/1999/xlink; > xlink:href="http://mapcache:8090/mapcache?"/> > http://www.w3.org/1999/xlink; > xlink:href="http://mapcache:8090/mapcache?"/> > http://www.w3.org/1999/xlink; > xlink:href="http://mapcache:8090/mapcache?"/> > > I here starts the problems. If I do this in eg QGIS, QGIS are told to go to > the http address with port 8090(mapcache is setup to run on port 8090 behind > the scenes) which is not reachable. It should return https (with no > specified port, ie. using standard https port) if I understands correctly. > > And I just cant figure put why. > > The configuration for the two are almost identical and I have double and > tripple check my config. > > Any idea what I should check next? > > If it could be of any help I could open access to my mapcache server > running. > > Thanks > > Trygve > > PS: when I test mapcache and mapserver setup locally without ssl and nginx > in front it works fine. > ___ > MapServer-users mailing list > MapServer-users@lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapserver-users ___ MapServer-users mailing list MapServer-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [mapserver-users] Possible override class-generated legend graphic?
By the way, we ended up using regexps and in apache to fetch getlegendgraphic requests to the layers in question. It would be nice if GetLegendGraphic on a given layer returned the same image (or html) as overriden in Layer metadata (GetCapabilitites) though. Desktop GIS (QGIS, ESRI etc) all use the metadata from GetCapabilities to render the legend, but web-gis doing a GetLegendGraphic directly on the layer would not render the same image/html. -Bjørn Ove Bjørn Ove Grøtan: > That would possibly work if I had one or two classes for the given layers. > Will check out, thanks. > > By the way, I'm also looking into using overriden legends for line symbology, > for which I have a lot of classes for. > Splitting up the current composite legend png in individual png is of course > possible, but tedious work. > > -- > Kind regards > > Bjørn Ove Grøtan > > Jörg Thomsen (WhereGroup): > > Hello Björn, > > > > would KEYIMAGE help? > > > > -> https://mapserver.org/mapfile/class.html > > > > Am 12.01.21 um 10:36 schrieb Bjørn Ove Grøtan: > > > Hello > > > > > > I am familiar with how I can override legend urls (1) in the > > > GetCapabilities-document, > > > but when calling GetLegendGraphic directly on the layer the layer > > > metadata for > > > legend graphic is not affected. > > > > > > The issue I'm having is some cartographies will not generate a > > > representative legend > > > e.g. piecharts and v-line-shift style node-cartography (2) > > > > > > Anyone have any input on how (if possible) to override the legend when > > > calling > > > GetLegendGraphic on individual layers? > > > > > > (1) wms_style__legendurl_href > > > (https://mapserver.org/ogc/wms_server.html) > > > (2) v-line-shift > > > (https://mapserver.org/mapfile/symbology/construction.html#changing-the-center-of-a-point-symbol) > > > > > > > > > Viele Grüße, > > Jörg Thomsen > > > > -- > > - > > Aufwind durch Wissen! > > Web-Seminare und Online-Schulungen > > bei der www.foss-academy.com > > - > > > > Jörg Thomsen > > WhereGroup GmbH > > Bundesallee 23 > > 10717 Berlin > > Germany > > > > Fon: +49 (0)30 / 5130 278 74 > > Fax: +49 (0)30 / 5130 278 11 > > > > joerg.thom...@wheregroup.com > > www.wheregroup.com > > > > Geschäftsführer: > > Olaf Knopp, Peter Stamm > > Amtsgericht Bonn, HRB 9885 > > > > --- > > Folgen Sie der WhereGroup auf twitter: http://twitter.com/WhereGroup_com > > ___ > > mapserver-users mailing list > > mapserver-users@lists.osgeo.org > > https://lists.osgeo.org/mailman/listinfo/mapserver-users > > ___ > mapserver-users mailing list > mapserver-users@lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapserver-users ___ mapserver-users mailing list mapserver-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
Re: [mapserver-users] Possible override class-generated legend graphic?
That would possibly work if I had one or two classes for the given layers. Will check out, thanks. By the way, I'm also looking into using overriden legends for line symbology, for which I have a lot of classes for. Splitting up the current composite legend png in individual png is of course possible, but tedious work. -- Kind regards Bjørn Ove Grøtan Jörg Thomsen (WhereGroup): > Hello Björn, > > would KEYIMAGE help? > > -> https://mapserver.org/mapfile/class.html > > Am 12.01.21 um 10:36 schrieb Bjørn Ove Grøtan: > > Hello > > > > I am familiar with how I can override legend urls (1) in the > > GetCapabilities-document, > > but when calling GetLegendGraphic directly on the layer the layer metadata > > for > > legend graphic is not affected. > > > > The issue I'm having is some cartographies will not generate a > > representative legend > > e.g. piecharts and v-line-shift style node-cartography (2) > > > > Anyone have any input on how (if possible) to override the legend when > > calling > > GetLegendGraphic on individual layers? > > > > (1) wms_style__legendurl_href > > (https://mapserver.org/ogc/wms_server.html) > > (2) v-line-shift > > (https://mapserver.org/mapfile/symbology/construction.html#changing-the-center-of-a-point-symbol) > > > > > Viele Grüße, > Jörg Thomsen > > -- > - > Aufwind durch Wissen! > Web-Seminare und Online-Schulungen > bei der www.foss-academy.com > - > > Jörg Thomsen > WhereGroup GmbH > Bundesallee 23 > 10717 Berlin > Germany > > Fon: +49 (0)30 / 5130 278 74 > Fax: +49 (0)30 / 5130 278 11 > > joerg.thom...@wheregroup.com > www.wheregroup.com > > Geschäftsführer: > Olaf Knopp, Peter Stamm > Amtsgericht Bonn, HRB 9885 > > --- > Folgen Sie der WhereGroup auf twitter: http://twitter.com/WhereGroup_com > ___ > mapserver-users mailing list > mapserver-users@lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapserver-users ___ mapserver-users mailing list mapserver-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
[mapserver-users] Possible override class-generated legend graphic?
Hello I am familiar with how I can override legend urls (1) in the GetCapabilities-document, but when calling GetLegendGraphic directly on the layer the layer metadata for legend graphic is not affected. The issue I'm having is some cartographies will not generate a representative legend e.g. piecharts and v-line-shift style node-cartography (2) Anyone have any input on how (if possible) to override the legend when calling GetLegendGraphic on individual layers? (1) wms_style__legendurl_href (https://mapserver.org/ogc/wms_server.html) (2) v-line-shift (https://mapserver.org/mapfile/symbology/construction.html#changing-the-center-of-a-point-symbol) -- Kind regards Bjørn Ove Grøtan ___ mapserver-users mailing list mapserver-users@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-users
