[GeoNetwork-devel] SAML authentication/Shibboleth

GeoNetwork GeoNetwork Developer
1

Hi,

I am trying to make a SAML authentication on GN. Is the Shibboleth[1]
authentication still compatible with latest Spring authentication
changes? If not, is someone implementing this? (to not duplicate
efforts).

[1]http://geonetwork-opensource.org/manuals/trunk/eng/users/admin/authentication/index.html#shibboleth-authentication

Regards,
María.

2

Hi

Is anyone using Shibboleth with GeoNetwork 2.10.X? Seem the “old” method that doesn’t use Spring Security is available still at least in the System Configuration.

Does anyone has a real configuration example to use Shibboleth? If so, would be really appreciated to share it.

Thanks and regards,
Jose García

···

On Thu, Jul 25, 2013 at 1:02 PM, María Arias de Reyna <delawen@anonymised.com> wrote:

Hi,

I am trying to make a SAML authentication on GN. Is the Shibboleth[1]
authentication still compatible with latest Spring authentication
changes? If not, is someone implementing this? (to not duplicate
efforts).

[1]http://geonetwork-opensource.org/manuals/trunk/eng/users/admin/authentication/index.html#shibboleth-authentication

Regards,
María.

See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

GeoNetwork-devel mailing list
GeoNetwork-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geonetwork-devel
GeoNetwork OpenSource is maintained at http://sourceforge.net/projects/geonetwork

–

GeoCat Bridge for ArcGIS allows instant publishing of data and metadata on GeoServer and GeoNetwork. Visit http://geocat.net for details.

Jose García
GeoCat bv
Veenderweg 13
6721 WD Bennekom
The Netherlands
http://GeoCat.net

3

Hi Maria and Jose,

I'm working on this topic at the moment.
Have you any news on this?

It seems that the "old" service just adds the user in the DB (as it used to
do), but it does not keep the user context, so the user will not really get
into the system.

Will post in the list any news I'll have.

   Cheers,
   Emanuele

Alle 17:37:47 di Wednesday 12 March 2014, Jose Garcia ha scritto:

Hi

Is anyone using Shibboleth with GeoNetwork 2.10.X? Seem the "old" method
that doesn't use Spring Security is available still at least in the System
Configuration.

Does anyone has a real configuration example to use Shibboleth? If so,
would be really appreciated to share it.

Thanks and regards,
Jose García

On Thu, Jul 25, 2013 at 1:02 PM, María Arias de Reyna

<delawen@anonymised.com>wrote:

> Hi,
>
> I am trying to make a SAML authentication on GN. Is the Shibboleth[1]
> authentication still compatible with latest Spring authentication
> changes? If not, is someone implementing this? (to not duplicate
> efforts).
>
> [1]
> http://geonetwork-opensource.org/manuals/trunk/eng/users/admin/authentica
> tion/index.html#shibboleth-authentication
>
>
> Regards,
> María.
>
>
> -------------------------------------------------------------------------
> ----- See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clkt
> rk _______________________________________________
> GeoNetwork-devel mailing list
> GeoNetwork-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/geonetwork-devel
> GeoNetwork OpenSource is maintained at
> http://sourceforge.net/projects/geonetwork

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Emanuele Tajariol
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 380 2116282

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

4

On Thu, Jun 12, 2014 at 12:49 PM, Emanuele Tajariol <etj@anonymised.com>
wrote:

Hi Maria and Jose,

I'm working on this topic at the moment.
Have you any news on this?

It seems that the "old" service just adds the user in the DB (as it used to
do), but it does not keep the user context, so the user will not really get
into the system.

Will post in the list any news I'll have.

   Cheers,
   Emanuele

Hi Emanuele,

We haven't made much more work on this part. My last attempt didn't work
and I left it to work on other issues.

Regards,
María.

Alle 17:37:47 di Wednesday 12 March 2014, Jose Garcia ha scritto:
> Hi
>
> Is anyone using Shibboleth with GeoNetwork 2.10.X? Seem the "old" method
> that doesn't use Spring Security is available still at least in the
System
> Configuration.
>
> Does anyone has a real configuration example to use Shibboleth? If so,
> would be really appreciated to share it.
>
> Thanks and regards,
> Jose García
>
> On Thu, Jul 25, 2013 at 1:02 PM, María Arias de Reyna
<delawen@anonymised.com>wrote:
> > Hi,
> >
> > I am trying to make a SAML authentication on GN. Is the Shibboleth[1]
> > authentication still compatible with latest Spring authentication
> > changes? If not, is someone implementing this? (to not duplicate
> > efforts).
> >
> > [1]
> >
http://geonetwork-opensource.org/manuals/trunk/eng/users/admin/authentica
> > tion/index.html#shibboleth-authentication
> >
> >
> > Regards,
> > María.
> >
> >
> >
-------------------------------------------------------------------------
> > ----- See everything from the browser to the database with AppDynamics
> > Get end-to-end visibility with application monitoring from AppDynamics
> > Isolate bottlenecks and diagnose root cause in seconds.
> > Start your free trial of AppDynamics Pro today!
> >
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clkt
> > rk _______________________________________________
> > GeoNetwork-devel mailing list
> > GeoNetwork-devel@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/geonetwork-devel
> > GeoNetwork OpenSource is maintained at
> > http://sourceforge.net/projects/geonetwork

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Emanuele Tajariol
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 380 2116282

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

5

Hi all,

I opened a ticket about the shibboleth authorization issue:
   https://github.com/geonetwork/core-geonetwork/issues/592

I performed some development, and the status at the moment is documented on
this wiki page:
https://github.com/geosolutions-it/core-geonetwork/wiki/Shibboleth-setup-
on-2.10.x

If you want to test the current implementation, you can use this pull request
   https://github.com/geonetwork/core-geonetwork/pull/593

Once pulled, follow these steps to configure your GeoNetwork:
https://github.com/geosolutions-it/core-geonetwork/wiki/Shibboleth-setup-
on-2.10.x#configure-shibboleth-login-on-your-system

I'll merge the pullreq once all the use cases and issues will be resolved.

Any feedback is welcome.

   Cheers,
   Emanuele
   
Alle 12:59:34 di Thursday 12 June 2014, María Arias de Reyna ha scritto:

On Thu, Jun 12, 2014 at 12:49 PM, Emanuele Tajariol <etj@anonymised.com>

wrote:
> Hi Maria and Jose,
>
> I'm working on this topic at the moment.
> Have you any news on this?
>
> It seems that the "old" service just adds the user in the DB (as it used
> to do), but it does not keep the user context, so the user will not
> really get into the system.
>
> Will post in the list any news I'll have.
>
> Cheers,
> Emanuele

Hi Emanuele,

We haven't made much more work on this part. My last attempt didn't work
and I left it to work on other issues.

Regards,
María.

> Alle 17:37:47 di Wednesday 12 March 2014, Jose Garcia ha scritto:
> > Hi
> >
> > Is anyone using Shibboleth with GeoNetwork 2.10.X? Seem the "old"
> > method that doesn't use Spring Security is available still at least in
> > the
>
> System
>
> > Configuration.
> >
> > Does anyone has a real configuration example to use Shibboleth? If so,
> > would be really appreciated to share it.
> >
> > Thanks and regards,
> > Jose García
> >
> > On Thu, Jul 25, 2013 at 1:02 PM, María Arias de Reyna
>
> <delawen@anonymised.com>wrote:
> > > Hi,
> > >
> > > I am trying to make a SAML authentication on GN. Is the Shibboleth[1]
> > > authentication still compatible with latest Spring authentication
> > > changes? If not, is someone implementing this? (to not duplicate
> > > efforts).
> > >
> > > [1]
>
> http://geonetwork-opensource.org/manuals/trunk/eng/users/admin/authentica
>
> > > tion/index.html#shibboleth-authentication
> > >
> > >
> > > Regards,
> > > María.

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Emanuele Tajariol
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 380 2116282

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

6

Hi all,

work on the shibboleth authentication has been completed.

Updates:
- Use case b) is now working.
- Shibboleth HTTP headers are now parsed only when shib.user.login service is
called.

Documentation on
https://github.com/geosolutions-it/core-geonetwork/wiki/Shibboleth-setup-
on-2.10.x
has been updated.

As a (good) side effect for the username/password authentication, now when
requesting a protected page, after being successfully logged in, the user is
redirected to the initially requested page instead of the home page.

A new commit has been added to the pull request.
In a few days I'll merge the pull req if no one objects.

   Cheers,
   Emanuele

Alle 20:41:44 di Tuesday 15 July 2014, Emanuele Tajariol ha scritto:

Hi all,

I opened a ticket about the shibboleth authorization issue:
   https://github.com/geonetwork/core-geonetwork/issues/592

I performed some development, and the status at the moment is documented on
this wiki page:
https://github.com/geosolutions-it/core-geonetwork/wiki/Shibboleth-setup-
on-2.10.x

If you want to test the current implementation, you can use this pull
request https://github.com/geonetwork/core-geonetwork/pull/593

Once pulled, follow these steps to configure your GeoNetwork:
https://github.com/geosolutions-it/core-geonetwork/wiki/Shibboleth-setup-
on-2.10.x#configure-shibboleth-login-on-your-system

I'll merge the pullreq once all the use cases and issues will be resolved.

Any feedback is welcome.

   Cheers,
   Emanuele

Alle 12:59:34 di Thursday 12 June 2014, María Arias de Reyna ha scritto:
> On Thu, Jun 12, 2014 at 12:49 PM, Emanuele Tajariol
> <etj@anonymised.com>
>
> wrote:
> > Hi Maria and Jose,
> >
> > I'm working on this topic at the moment.
> > Have you any news on this?
> >
> > It seems that the "old" service just adds the user in the DB (as it
> > used to do), but it does not keep the user context, so the user will
> > not really get into the system.
> >
> > Will post in the list any news I'll have.
> >
> > Cheers,
> > Emanuele
>
> Hi Emanuele,
>
> We haven't made much more work on this part. My last attempt didn't work
> and I left it to work on other issues.
>
> Regards,
> María.
>
> > Alle 17:37:47 di Wednesday 12 March 2014, Jose Garcia ha scritto:
> > > Hi
> > >
> > > Is anyone using Shibboleth with GeoNetwork 2.10.X? Seem the "old"
> > > method that doesn't use Spring Security is available still at least
> > > in the
> >
> > System
> >
> > > Configuration.
> > >
> > > Does anyone has a real configuration example to use Shibboleth? If
> > > so, would be really appreciated to share it.
> > >
> > > Thanks and regards,
> > > Jose García
> > >
> > > On Thu, Jul 25, 2013 at 1:02 PM, María Arias de Reyna
> >
> > <delawen@anonymised.com>wrote:
> > > > Hi,
> > > >
> > > > I am trying to make a SAML authentication on GN. Is the
> > > > Shibboleth[1] authentication still compatible with latest Spring
> > > > authentication changes? If not, is someone implementing this? (to
> > > > not duplicate efforts).
> > > >
> > > > [1]
> >
> > http://geonetwork-opensource.org/manuals/trunk/eng/users/admin/authenti
> > ca
> >
> > > > tion/index.html#shibboleth-authentication
> > > >
> > > >
> > > > Regards,
> > > > María.

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Emanuele Tajariol
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 380 2116282

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------