[MS4W-Users] Hide Some Layer Data based on User

[Brent Fraser]

Hi Andrew,

I've solved similar requirements of showing user-specific data by using server-side
scripting like PHP or Python.

With this method:
1. Your login script presents a login page requiring username and password.
2. The user enters a valid username/password and submits them.
3. The scripting validates the username/password and creates a Session
variable (e.g. username) to indicate the user is logged in.  Note this is
only stored on the server side and is available to other scripts of the user's Session.
4. From the mapping HTML/JavaScript in the browser, map requests are sent to a 
"mapserv.php" script(not the mapserv CGI executable)  which uses the Mapserver PHP interface
5. The mapserv.php loads the map file, does any needed substitutions (e.g. username in a query),
requests the mapping data. and passes the result to the client browser.

Best Regards,
Brent Fraser

----------------------------------------

From: Andrew T via MS4W-Users <ms4w-users at lists.ms4w.com>
Sent: 1/19/21 8:34 AM
To: "Discussions for MS4W (MapServer for Windows)" <ms4w-users at lists.ms4w.com>
Cc: Andrew T <igis at interactivegis.com>
Subject: [MS4W-Users] Hide Some Layer Data based on User

We have some data in a PostGIS database and are using OpenLayers to show maps, and mostly using MapServer to create tiled and full images such as ImageWMS.  We're open to continuing that or other ideas using PostGIS and Openlayers.

We'd like to add user based filters so that "user1" only sees certain points and "user2" only sees other points on the same layer.  We can do this through filtering results in the PostGIS query with VALIDATION but are concerned about the security of passing a user ID or name through the querystring to MapServer.

I've looked around and maybe not searched on the right terms for alternative ideas, but is the VALIDATION and passing user info the best way to go about this, and is it secure?  Or is there a way to better show and hide data inside a layer based on the user?

Thanks,
Andrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ms4w.com/pipermail/ms4w-users/attachments/20210119/45582f6a/attachment.htm>