From 8571521e2bd23172bb170ef0adc6d3f641b8d526 Mon Sep 17 00:00:00 2001 From: "david.blasby" Date: Tue, 26 Mar 2024 10:49:10 -0700 Subject: [PATCH] changes from jose's review --- core/pom.xml | 3 +-- .../authentication-mode.md | 24 +++++++++---------- pom.xml | 22 +++++++++++++++++ services/pom.xml | 1 - 4 files changed, 35 insertions(+), 15 deletions(-) diff --git a/core/pom.xml b/core/pom.xml index 167b88ab8e9..87f55650ddf 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -39,7 +39,7 @@ org.geoserver.community.jwt-headers jwt-headers-util - 2.25-SNAPSHOT + 2.26-SNAPSHOT @@ -314,7 +314,6 @@ com.jayway.jsonpath json-path - 2.4.0 org.locationtech.jts diff --git a/docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md b/docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md index 476f8aed044..ece4cebbc50 100644 --- a/docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md +++ b/docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md @@ -821,7 +821,7 @@ A similar setup is described for geoserver in the [geoserver documentation](http ## Configurating JWT/JSON Headers {#jwt-headers} -The JWT Headers module provides a security module for header based security. It is equivalent to GeoServer's JWT Headers Module (both GeoServer and GeoNetwork share a code library to make them equivelent). +The JWT Headers module provides a security module for header based security. It is equivalent to GeoServer's JWT Headers Module (both GeoServer and GeoNetwork share a code library to make them equivalent). This module allows [JSON-based](https://en.wikipedia.org/wiki/JSON) headers (for username and roles) as well as [JWT-based](https://en.wikipedia.org/wiki/JSON_Web_Token>) headers (for username and roles). It also allows for validating JWT-Based AccessTokens (i.e. via [OAUTH2](https://en.wikipedia.org/wiki/OAuth>)/[OpenID Connect](ttps://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)). @@ -830,7 +830,7 @@ If you are using something like [Apache's mod_auth_openidc](https://github.com/O 1. Get the username from an Apache-provided `OIDC_*` header (either as simple-strings or as a component of a JSON object). 2. Get the user's roles from an Apache-provided `OIDC_*` header (as a component of a JSON object). -3. The user's roles can also be from any of the standard GeoServer providers (i.e. User Group Service, Role Service, or Request Header). +3. The user's roles can also come from the GeoNetwork Database (managed by the administrator in the GeoNetwork GUI). If you are using [OAUTH2/OIDC Access Tokens](https://www.oauth.com/oauth2-servers/access-tokens/): @@ -843,7 +843,7 @@ If you are using [OAUTH2/OIDC Access Tokens](https://www.oauth.com/oauth2-server * Validate the token against a token verifier URL ("userinfo_endpoint") and check that subjects match * Validate components of the Access Token (like [aud (audience)](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-claims>)) -4. The user's roles can also be from any of the standard GeoServer providers (i.e. User Group Service, Role Service, or Request Header). +4. The user's roles can also come from the GeoNetwork Database (managed by the administrator in the GeoNetwork GUI). 5. You can also extract roles from the JWT Access Token (via a JSON path). ### JWT Headers configuration @@ -980,22 +980,22 @@ In this JSON set of claims (mirrored in the JWT claims of the Access Token), and #### Role Conversion -The JWT Headers module also allows for converting roles (from the external IDP) to the GeoServer internal role names. +The JWT Headers module also allows for converting roles (from the external IDP) to the GeoNetwork internal role names. -| Environment Variable | Meaning | -| ------------- | ------- | -|JWTHEADERS_RoleConverterString| Role Converter Map from External Roles to Geoserver Roles.
This is a ";" delimited map in the form of:
`ExternalRole1=GeoServerRole1;ExternalRole2=GeoServerRole2`| -|JWTHEADERS_OnlyExternalListedRoles | Only allow External Roles that are explicitly named above.
If true, external roles that are not mentioned in the conversion map will be ignored. If false, those external roles will be turned into GeoServer roles of the same name.| +| Environment Variable | Meaning | +| ------------- |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|JWTHEADERS_RoleConverterString| Role Converter Map from External Roles to GeoNetwork Roles.
This is a ";" delimited map in the form of:
`ExternalRole1=GeoNetworkRole1;ExternalRole2=GeoNetworkRole2` | +|JWTHEADERS_OnlyExternalListedRoles | Only allow External Roles that are explicitly named above.
If true, external roles that are not mentioned in the conversion map will be ignored. If false, those external roles will be turned into GeoNetwork roles of the same name.
These roles should either be a Profile ("Administrator", "Reviewer", etc..) or group-based permissions ("GroupName:ProfileName") | -For example, a conversion map like `GeonetworkAdministrator=ADMINISTRATOR` will convert our IDP "GeonetworkAdministrator" to the "ADMINISTRATOR" Profile.. +For example, a conversion map like `GeonetworkAdministrator=ADMINISTRATOR` will convert our IDP "GeonetworkAdministrator" to the "ADMINISTRATOR" Profile... -In our example, the user has two roles "GeoserverAdministrator" and "GeonetworkAdministrator". If the "Only allow External Roles that are explicitly named above" is true, then GeoServer will only see the "ADMINISTRATOR" role. If true, it will see "ADMINISTRATOR" and "GeoserverAdministrator". In neither case will it see the converted "GeonetworkAdministrator" roles. +In our example, the user has two roles "GeoserverAdministrator" and "GeonetworkAdministrator". If the "Only allow External Roles that are explicitly named above" is true, then GeoNetwork will only see the "ADMINISTRATOR" role. If true, it will see "ADMINISTRATOR" and "GeoserverAdministrator". In neither case will it see the converted "GeonetworkAdministrator" roles. ##### Groups -As equivelent with the OIDC and Keycloak providers, specify group permissions in the `:` format. +As equivalent with the OIDC and Keycloak providers, specify group permissions in the `:` format. ### JWT Validation @@ -1003,7 +1003,7 @@ As equivelent with the OIDC and Keycloak providers, specify group permissions in If you are using Apache's `mod_auth_openidc` module, then you do *not* have to do JWT validation - Apache will ensure they are valid when it attaches the headers to the request. -However, if you are using robot access to GeoServer, you can attach an Access Token to the request header for access. +However, if you are using robot access to GeoNetwork, you can attach an Access Token to the request header for access. ``` Authentication: Bearer `base64 JWT Access Token` diff --git a/pom.xml b/pom.xml index 47993745350..38240048676 100644 --- a/pom.xml +++ b/pom.xml @@ -897,6 +897,13 @@ + + com.jayway.jsonpath + json-path + 2.4.0 + + + junit @@ -1414,6 +1421,21 @@ jmeter + + macOS-M-series + + + mac + aarch64 + + + + darwin-aarch64 + kibana.sh + darwin-aarch64 + tar.gz + + macOS diff --git a/services/pom.xml b/services/pom.xml index 949daa40507..0960e2312b3 100644 --- a/services/pom.xml +++ b/services/pom.xml @@ -130,7 +130,6 @@ com.jayway.jsonpath json-path - 2.4.0 com.jayway.jsonpath