Hi Andreas,
Catching up with developer activities - many weeks later. I am writing a
blog post for Q4 and wanted to mention the great work you are doing.
I note one topic did not get feedback:
- The Java package namespace of the existing modules is
> "org.geoserver.security.oauth2." Should we ke
vid Blasby
Gesendet: Donnerstag, 26. September 2024 02:53
An: Francesco Bartoli
Cc: jody.garn...@gmail.com; Watermeyer, Andreas
; geoserver-devel@lists.sourceforge.net;
Alessio Fabiani
Betreff: Re: [Geoserver-devel] Status Update OAuth2 migration
[Externe E-Mail] Vorsicht beim Öffnen von Link
...@gmail.com;
Watermeyer, Andreas ;
geoserver-devel@lists.sourceforge.net
Betreff: Re: [Geoserver-devel] Status Update OAuth2 migration
[Externe E-Mail] Vorsicht beim Öffnen von Links und Anhängen. / Be careful when
opening links and attachments.
In my opinion, prioritizing the OAuth2 module
regards,
Andreas
Von: David Blasby
Gesendet: Mittwoch, 25. September 2024 21:06
An: Watermeyer, Andreas
Cc: Jody Garnett ;
geoserver-devel@lists.sourceforge.net; Alessio Fabiani
Betreff: Re: [Geoserver-devel] Status Update OAuth2 migration
[Externe E-Mail] Vorsicht beim Öffnen von Links und
In my opinion, prioritizing the OAuth2 module functioning as a Resource
Server is not essential, as the JWT Token Community module can fully
replace its functionality.
We should consider investing effort into improving the documentation to
clearly present both approaches and their respective scopes
Hi, Francesco,
It's more difficult to know when to give a 401. You can have multiple
OAUTH providers at the same time. If one fails, you want it to allow
another OAUTH (or a different auth type) to succeed.
In GeoServer, what happens, if all auth mechanisms fail, is you get logged
on as Anonymo
Hi All,
Sorry for jumping into this discussion despite I’m not part of the GeoServer’s
dev team. I’ve seen the blog post from Jody and I’m pretty much interested to
contribute on this OIDC/OAuth2 development (btw we have been involved recently
by funding some improvements of this module).
From
- I also decided to implement the OAuth2 Resource Server role, following
Alessio’s response. This is working as well. However, after grepping
through the codebase, I found the JWT Headers community module, which I
believe has significant functional overlap with the OAuth2 Resource Server
role. I as
Hi Jody, hi all,
Here is a brief status update on the OAuth2 migration and a request for
feedback:
- I decided to re-implement the existing functionality rather than trying to
adapt the existing code. Reason: The Spring internals have changed too
fundamentally. Additionally, the new Spring API
