Skip to content

GN5 / Add sign in/out support #8981

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

GN5 / Add sign in/out support #8981

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe03bea
GN5 / Add sign in/out support
fxprunayre Aug 7, 2025
caf4327
GN5 / Add sign in/out support / Add loginType for JWT security provider.
fxprunayre Oct 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 24 additions & 9 deletions core/src/main/java/org/fao/geonet/kernel/security/jwtheaders/JwtHeadersSecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,10 @@
*/
package org.fao.geonet.kernel.security.jwtheaders;

import org.fao.geonet.exceptions.BadParameterEx;
import org.fao.geonet.kernel.security.SecurityProviderConfiguration;
import static org.fao.geonet.kernel.security.SecurityProviderConfiguration.LoginType.AUTOLOGIN;
import static org.fao.geonet.kernel.security.SecurityProviderConfiguration.LoginType.parse;

/**
* GeoNetwork only allows one SecurityProviderConfiguration bean.
Expand All @@ -32,8 +35,8 @@
*/
public class JwtHeadersSecurityConfig implements SecurityProviderConfiguration {

private String loginType = AUTOLOGIN.toString();

public SecurityProviderConfiguration.LoginType loginType = SecurityProviderConfiguration.LoginType.AUTOLOGIN;
/**
* true -> update the DB with the information from OIDC (don't allow user to edit profile in the UI)
* false -> don't update the DB (user must edit profile in UI).
Expand All @@ -50,7 +53,27 @@ public class JwtHeadersSecurityConfig implements SecurityProviderConfiguration {


public JwtHeadersSecurityConfig() {
}

@Override
public String getLoginType() {
return loginType;
}

public void setLoginType(String loginType) {
LoginType parsedLoginType = parse(loginType);
switch(parsedLoginType) {
case FORM:
case AUTOLOGIN:
break;
case DEFAULT:
parsedLoginType= AUTOLOGIN;
break;
default:
// Currently don't support anything else
throw new BadParameterEx("loginType", parsedLoginType.toString());
}
this.loginType = parsedLoginType.toString();
}

public boolean isUpdateProfile() {
Expand All @@ -72,11 +95,6 @@ public void setUpdateGroup(boolean updateGroup) {
this.updateGroup = updateGroup;
}

//@Override
public String getLoginType() {
return loginType.toString();
}

// @Override
public String getSecurityProvider() {
return "JWT-HEADERS";
Expand All @@ -88,12 +106,9 @@ public boolean isUserProfileUpdateEnabled() {
return !updateProfile;
}

//========================================================================

// @Override
public boolean isUserGroupUpdateEnabled() {
// If updating group from the security provider then disable the group updates in the interface
return !updateGroup;
}

}
6 changes: 3 additions & 3 deletions web-ui/src/main/resources/catalog/components/toolbar/partials/menu-signin.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@
data-ng-if="!authenticated && service !== 'catalog.signin' && service !== 'new.account' && isShowLoginAsLink"
>
<a
href="{{signInFormAction}}?_csrf={{csrf}}&redirectUrl={{redirectUrlAfterSign}}"
href="{{gnCfg.mods.authentication.signinUrl}}?_csrf={{csrf}}&redirectUrl={{redirectUrlAfterSign}}"
title="{{'signIn'|translate}}"
class="gn-menuheader-xs"
data-ng-keypress="$event"
Expand All @@ -86,7 +86,7 @@
data-ng-if="!authenticated && service !== 'catalog.signin' && service !== 'new.account' && !isShowLoginAsLink && !isDisableLoginForm"
>
<a
href="{{gnCfg.mods.authentication.signinUrl | signInLink}}"
href="{{signInFormLinkWithHash}}"
title="{{'signIn'|translate}}"
class="dropdown-toggle gn-menuheader-xs"
data-ng-keypress="$event"
Expand All @@ -102,7 +102,7 @@
<form
name="gnSigninForm"
class="navbar-form"
action="{{signInFormAction}}"
action="{{signInFormActionWithHash}}"
method="post"
role="form"
>
Expand Down
11 changes: 9 additions & 2 deletions web-ui/src/main/resources/catalog/js/CatController.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1265,7 +1265,11 @@
authentication: {
enabled: true,
signinUrl: "../../{{node}}/{{lang}}/catalog.signin",
signinAPI: "../../signin",
signoutUrl: "../../signout"
// GN5 configuration
// signinAPI: "../../api/user/signin",
// signoutUrl: "../../api/user/signout"
},
page: {
enabled: true,
Expand Down Expand Up @@ -1838,8 +1842,11 @@
}
});

// login url for inline signin form in top toolbar
$scope.signInFormAction = "../../signin#" + $location.url();
// login url and form action with hash reference to the current page
$scope.signInFormLinkWithHash =
$scope.gnCfg.mods.authentication.signinUrl + "#" + $location.url();
$scope.signInFormActionWithHash =
$scope.gnCfg.mods.authentication.signinAPI + "#" + $location.url();

// when the login input have focus, do not close the dropdown/popup
$scope.focusLoginPopup = function () {
Expand Down
1 change: 0 additions & 1 deletion web-ui/src/main/resources/catalog/js/LoginController.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,6 @@
$q,
gnLangs
) {
$scope.formAction = "../../signin#" + $location.url();
$scope.registrationStatus = null;
$scope.sendPassword = false;
$scope.password = null;
Expand Down
2 changes: 1 addition & 1 deletion web-ui/src/main/resources/catalog/templates/signin.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ <h1 data-translate="">loginTitle</h1>
<form
class="form-horizontal"
name="gnSigninForm"
action="{{formAction}}"
action="{{signInFormActionWithHash}}"
method="post"
role="form"
data-ng-if="::user"
Expand Down
2 changes: 1 addition & 1 deletion web-ui/src/main/resources/catalog/views/default/templates/recordView/recordView.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
<span
data-ng-hide="user"
data-translate=""
data-translate-values="{signInFormAction: '{{signInFormAction}}', csrf: '{{csrf}}', redirectUrlAfterSign: '{{redirectUrlAfterSign}}'}"
data-translate-values="{signInFormAction: '{{signInFormLinkWithHash | signInLink}}}', csrf: '{{csrf}}', redirectUrlAfterSign: '{{redirectUrlAfterSign}}'}"
>
trySignIn
</span>
Expand Down
1 change: 1 addition & 0 deletions web/src/main/webapp/WEB-INF/config-security/config-security-gn5-overrides.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,5 +47,6 @@ jwtheadersConfiguration.JwtConfiguration.validateTokenAudienceClaimValue=${JWTHE
jwtheadersConfiguration.JwtConfiguration.validateTokenSignature=${JWTHEADERS_ValidateTokenSignature:true}
jwtheadersConfiguration.JwtConfiguration.validateTokenSignatureURL=${JWTHEADERS_ValidateTokenSignatureURL:""}

jwtHeadersSecurityConfig.loginType=form
jwtHeadersSecurityConfig.UpdateProfile=${JWTHEADERS_UpdateProfile:false}
jwtHeadersSecurityConfig.UpdateGroup=${JWTHEADERS_UpdateGroup:false}
5 changes: 4 additions & 1 deletion web/src/main/webapp/WEB-INF/config-security/config-security-jwt-headers-base.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,10 @@
http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd">

<bean id ="jwtHeadersSecurityConfig" class="org.fao.geonet.kernel.security.jwtheaders.JwtHeadersSecurityConfig"/>
<bean id="jwtHeadersSecurityConfig"
class="org.fao.geonet.kernel.security.jwtheaders.JwtHeadersSecurityConfig">
<property name="loginType" value="${jwtHeadersSecurityConfig.loginType}"/>
</bean>

<bean id ="jwtheadersConfiguration" class="org.fao.geonet.kernel.security.jwtheaders.JwtHeadersConfiguration">
<constructor-arg ref ="jwtHeadersSecurityConfig" />
Expand Down
1 change: 1 addition & 0 deletions web/src/main/webapp/WEB-INF/config-security/config-security-jwt-headers-overrides.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,5 +47,6 @@ jwtheadersConfiguration.JwtConfiguration.validateTokenAudienceClaimValue=${JWTHE
jwtheadersConfiguration.JwtConfiguration.validateTokenSignature=${JWTHEADERS_ValidateTokenSignature:true}
jwtheadersConfiguration.JwtConfiguration.validateTokenSignatureURL=${JWTHEADERS_ValidateTokenSignatureURL:""}

jwtHeadersSecurityConfig.loginType=autologin
jwtHeadersSecurityConfig.UpdateProfile=${JWTHEADERS_UpdateProfile:true}
jwtHeadersSecurityConfig.UpdateGroup=${JWTHEADERS_UpdateGroup:true}
Loading