Can not create new user with REST API

Description

The usergroup API is working as expected when issuing a GET request like:
curl -X GET http://admin:geoserver@localhost:8080/geoserver/rest/security/usergroup/users/

I get {{com.thoughtworks.xstream.mapper.CannotResolveClassException: userName }} when issuing a POST to the same endpoint like this:
curl -X POST http://admin:geoserver@localhost:8080/geoserver/rest/security/usergroup/users/ -H "content-type: application/json" -d "{ \"userName\": \"foo\", \"password\": \"bAr1@345\", \"enabled\": true}"

I am getting the same result (GET is working and POST is not working) when trying to issue a new user using /rest/security/usergroup/service/myUserGroup/users/

I am getting the same results when I change the POST to use xml instead of json: content-type: application/xml &
<user>
<userName>Jim</userName>
<password>password</password>
<enabled>true</enabled>
</user>

Please also see the gis.stackexchange: https://gis.stackexchange.com/questions/256891/creating-new-geoserver-user-through-rest-api

Environment

GeoServer running in a Docker

Activity

Show:
Radoslav Chudý
March 14, 2018, 1:59 PM

Hi,

is there some progress on this bug? We are also facing the same problem. Thanks.

Mateusz Kacprzak
March 23, 2018, 12:58 PM
Edited

Hi,

I have found temporary solution for this.

The reason of this is that the XStream cannot map XML/JSON to org.geoserver.rest.security.xml.JaxbUser because there is no alias "user" for this.

There are two solutions for it.

1. Use full class name with package in your XML/JSON.

Something like this:

If you use XML there is propably the same way

2. Edit org.geoserver.rest.security.UsersRestController class.

Add super class org.geoserver.rest.RestBaseController to it and override two methods

After one of those solutions you need to add JaxbUser.class to XStream whitelist. The simplest way to do it is adding system/environment/context variable GEOSERVER_XSTREAM_WHITELIST like GEOSERVER_DATA_DIR.

E.g -DGEOSERVER_XSTREAM_WHITELIST=org.geoserver.rest.security.xml.JaxbUser

I hope this will be fixed in next versions of Geoserver. By the way the GeoServer Documentation is full of lack and needs to be polished.

Brad Hards
November 11, 2018, 9:30 PM

Please feel free to submit a PR to correct the problem or to update the documentation.

https://docs.geoserver.org/latest/en/user/introduction/gettinginvolved.html is a great place to start.

Fixed

Assignee

Imran Rajjad

Reporter

Ben Wyss

Triage

Fix versions

Affects versions

Time remaining

0m

Components

Priority

Medium
Configure