Sign in to Gnos with OpenID Connect

Gnos signs GeoNetwork users in through the mapdojo Auth identity provider at https://auth.mapdojo.app by default. Users register once with mapdojo Auth and sign in to every mapdojo product, GeoNetwork included, with the same account.

How it works

GeoNetwork is registered on the Auth issuer as the public client gnos-geonetwork. It signs in with the OpenID Connect authorization code flow and PKCE, so there is no client secret to store or rotate on the Hive.

GeoNetwork's stock OpenID Connect provider selects a client-secret authentication method whenever the issuer advertises one, so Set-GnosGeoNetworkOpenIdConnectSecurity writes a Hive-local copy of the issuer's discovery document that advertises only none. GeoNetwork reads that file, uses PKCE, and never needs a secret. Nothing in the GeoNetwork web archive changes.

Auth issues identity only. A new user receives the GeoNetwork profile configured as MinimumProfile (RegisteredUser); existing users retain profiles assigned by GeoNetwork administrators. Profile and group refresh default to disabled so later OIDC logins preserve those local assignments. Pass -UpdateProfile $true or -UpdateGroup $true only when the issuer supplies authoritative role or group claims.

Configure a Hive

The Development configuration scripts under Hive\PowerShell\Development already default to openidconnect. The equivalent step-by-step commands are:

$TomcatSettings = Get-GnosTomcatSettings -PortAllocation $PortAllocation -SqlServerJdbcUrl $SqlServerJdbcUrl
$HiveEnvironment = New-GnosHiveEnvironment -HivePath $HivePath -TomcatPath $TomcatPath -TomcatSettings $TomcatSettings -ElasticsearchPath $ElasticsearchPath -ElasticsearchSettings $ElasticsearchSettings
$HiveEnvironment | Set-GnosTomcatConfiguration

$OpenIdConnectSettings = Get-GnosOpenIdConnectSecuritySettings -PublicBaseUrl "https://brad.mapdojo.net/Gnos/Development/GeoNetwork"
$HiveEnvironment | Set-GnosGeoNetworkOpenIdConnectSecurity -OpenIdConnectSecuritySettings $OpenIdConnectSettings

Get-GnosTomcatSettings defaults -SecurityType to openidconnect. Get-GnosOpenIdConnectSecuritySettings defaults to issuer https://auth.mapdojo.app, client gnos-geonetwork, and the None client authentication method. -PublicBaseUrl is the address users reach GeoNetwork on; the callback is always <PublicBaseUrl>/login/oauth2/code/geonetwork-oidc.

Set-GnosGeoNetworkOpenIdConnectSecurity writes to Hive\Config\<Hive>GeoNetwork\config:

Set-GnosTomcatConfiguration expands the GeoNetwork web archive into the Hive when the expanded directory is missing or has no WEB-INF/lib, so with Tomcat stopped enable the mode next:

$HiveEnvironment | Enable-GnosGeoNetworkOpenIdConnectSecurity

Enable-GnosGeoNetworkOpenIdConnectSecurity points the expanded deployment at the Hive-local files and checks that the metadata advertises only none. Start Tomcat afterwards.

Register the callback with Auth

The Auth issuer allows exact redirect URIs only. Each Hive's callback must be present on the gnos-geonetwork client, for example:

https://brad.mapdojo.net/Gnos/Development/GeoNetwork/login/oauth2/code/geonetwork-oidc

GeoNetwork's sign-out redirects to the issuer's end-session endpoint with the GeoNetwork base URL as the post-logout redirect, so that URL must be allowed on the client as well:

https://brad.mapdojo.net/Gnos/Development/GeoNetwork

Registration is a mapdojo Auth maintainer action on the issuer's OpenIddict:Clients configuration.

Azure Entra instead of mapdojo Auth

An Azure Entra app registration authenticates with a client secret. Select it with the tenant id and provide the secret through -ClientSecret or GNOS_OIDC_CLIENT_SECRET:

$OpenIdConnectSettings = Get-GnosOpenIdConnectSecuritySettings `
    -TenantId "<directory (tenant) id>" `
    -ClientId "<application (client) id>" `
    -PublicBaseUrl "https://brad.mapdojo.net/Gnos/Development/GeoNetwork" `
    -ClientSecret (Read-Host -AsSecureString "Client secret")

That path writes security.openidconnect.secret.properties next to the other files and reads the tenant's live metadata URL. Keep the secret out of source control.

Return to another provider

Set -SecurityType default or -SecurityType active-directory on Get-GnosTomcatSettings, rerun Set-GnosTomcatConfiguration, and restart Tomcat. The OpenID Connect files stay in place and are ignored until the mode is selected again.