{"action":"created","comment":{"url":"https://api.github.com/repos/geoserver/geoserver/pulls/comments/78216773","id":78216773,"diff_hunk":"@@ -0,0 +1,151 @@\n+.. _security_tutorials_oauth2:\n+\n+Authentication with OAuth2\n+==========================\n+\n+This tutorial introduces GeoServer OAuth2 support and walks through the process of\n+setting up authentication aganist an OAuth2 provider. It is recommended that the \n+:ref:`security_auth_chain` section be read before proceeding.\n+\n+OAuth2 Protocol and GeoServer OAuth2 core module\n+------------------------------------------------\n+\n+This module allows GeoServer to authenticate against the `OAuth2 Protocol <https://tools.ietf.org/html/rfc6749>`_.\n+\n+In order to let the module work, it's mandatory to setup and configure both ``oauth2`` and ``oauth2-xxxx-extension``.\n+\n+The first one contains the necessary dependencies of the OAuth2 core module. This module contains the implementation of the \n+GeoServer security filter, the base classes for the OAuth2 Token services and the GeoServer GUI panel.\n+\n+Since in almost all cases the only thing different between OAuth2 Providers are the endpoint URIs and the client connection\n+information (not only the keys - public and secret - but also the user profile representations), in order to allow GeoServer\n+connecting to a specific OAuth2 provider it is sufficient to install the OAuth2 Core module plugin (and correctly configure\n+the parameters through the GeoServer GUI - see next section for the details) and the concrete implementation of the OAuth2\n+REST token template and resource details.\n+\n+Currently this module is shipped with a sample extension for Google OAuth2 Provider. This is a particular case since the \n+Google JWT response is not standard and therefore we had to define and inject also a ``GoogleUserAuthenticationConverter`` taking\n+the Google REST response against a valid ``access_token`` and converting it to a OAuth2 standard one.\n+\n+Other than this the most interesting part is the implementation of the base class ``GeoServerOAuth2SecurityConfiguration``.\n+\n+The latter contains the Google implementation of the ``OAuth2RestTemplate``.\n+\n+In the next section we will see how to install and configure the OAuth2 security filter on GeoServer authenticating against \n+Google OAuth2 Provider.\n+\n+Configure the Google authentication provider\n+--------------------------------------------\n+\n+The first thing to do is to configure the OAuth2 Provider and obtain ``Client ID`` and ``Client Sectet`` keys.\n+\n+#. Obtain OAuth 2.0 credentials from the Google API Console.\n+\n+   Visit the `Google API Console <https://console.developers.google.com/>`_ to obtain OAuth 2.0 credentials such as a client ID and client secret \n+   that are known to both Google and your application. The set of values varies based on what type of application you are building. \n+   For example, a JavaScript application does not require a secret, but a web server application does.\n+   \n+    .. figure:: images/google1.jpg\n+       :align: center\n+\n+#. Create a new ``OAuth client ID``\n+\n+   Click on the ``Client credentials`` context menu as shown in the figure below.\n+   \n+    .. figure:: images/google2.jpg\n+       :align: center\n+\n+#. Configure a new ``Web application``\n+\n+   Add the ``Name`` and the ``Authorized redirect URIs`` like shown here below.\n+   \n+    .. note:: Always add two entries for each URI. One without the ending ``/`` and another one with it.\n+   \n+    .. figure:: images/google3.jpg\n+       :align: center\n+\n+#. Take note of the ``Client ID`` and the ``Client Sectet``.\n+\n+   At the end of the procedure Google will show-up a small dialog box with the ``Client ID`` and the ``Client Sectet``.\n+   Those info can be always accessed and updated from the `Google API Console <https://console.developers.google.com/>`_\n+   \n+    .. figure:: images/google4.jpg\n+       :align: center\n+\n+#. Optionally customize the ``OAuth consent screen``.\n+\n+   At any time it is possible to update and customize the ``OAuth consent screen``. You can put here your logo, app name, ToS and so on.\n+\n+    .. figure:: images/google5.jpg\n+       :align: center\n+\n+Configure the GeoServer OAuth2 filter\n+-------------------------------------\n+\n+#. Start GeoServer and login to the web admin interface as the ``admin`` user.\n+#. Click the ``Authentication`` link located under the ``Security`` section of\n+   the navigation sidebar.\n+\n+    .. figure:: images/filter1.jpg\n+       :align: center\n+\n+#. Scroll down to the ``Authentication Filters`` panel and click the ``Add new`` link.\n+\n+    .. figure:: images/filter2.jpg\n+       :align: center\n+\n+#. Click the ``OAuth2`` link.\n+\n+    .. figure:: images/filter3.jpg\n+       :align: center\n+\n+#. Fill in the fields of the settings form as follows:\n+\n+    .. figure:: images/filter4.jpg\n+       :align: center\n+   \n+    .. note:: \n+\t\n+\t   #. ``Scopes`` should be::\n+\t       \n+\t\t   https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile\n+\t\t\n+\t   #. ``Client ID`` and ``Client Secret`` are the ones Google provided\n+\t   \n+\t   #. Choose a ``Role Service`` able to recognize user emails as IDs. By default a connected user will have ``ROLE_USER`` role\n+\t\n+#. Update the filter chains by adding the new OAuth2 filter. \n+\n+   .. figure:: images/filter5.jpg\n+      :align: center\n+\n+#. Select the OAuth2 Filter for each filter chain you want to protect with OAuth2.\n+\n+   .. figure:: images/filter6.jpg\n+      :align: center\n+\n+   Be sure to select and order correctly the OAuth2 Filter.\n+\n+#. Save.\n+\n+Test a Google OAuth2 login\n+--------------------------\n+\n+#. Navigate to the GeoServer home page and log out of the admin account. ","path":"doc/en/user/source/community/oauth2/index.rst","position":134,"original_position":134,"commit_id":"83e3b87c1e1740282c183a5a5cf4205f1b1e2253","original_commit_id":"83e3b87c1e1740282c183a5a5cf4205f1b1e2253","user":{"login":"aaime","id":325433,"avatar_url":"https://avatars.githubusercontent.com/u/325433?v=3","gravatar_id":"","url":"https://api.github.com/users/aaime","html_url":"https://github.com/aaime","followers_url":"https://api.github.com/users/aaime/followers","following_url":"https://api.github.com/users/aaime/following{/other_user}","gists_url":"https://api.github.com/users/aaime/gists{/gist_id}","starred_url":"https://api.github.com/users/aaime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaime/subscriptions","organizations_url":"https://api.github.com/users/aaime/orgs","repos_url":"https://api.github.com/users/aaime/repos","events_url":"https://api.github.com/users/aaime/events{/privacy}","received_events_url":"https://api.github.com/users/aaime/received_events","type":"User","site_admin":false},"body":"Something went wrong here, and I cannot login anymore, google makes me login and then brings me to the account settings page instead of the geoserver page. My guess is that it's due to the redirect url. Some instructions to un-brick GeoServer would be useful.\r\nIn my case I went to modify GeoServer config at $GEOSERVER_DATA_DIR/release/security/filter/oauth2-google and set the redirect URI to one of the authorized ones, restarted and then I get automatically logged in.\r\nHowever, GeoServer is still \"bricked\", as I can only login with my google account now, no way to get to the home page as anonymous, and no way to get back as admin using the local authentication. I believe this needs to be solved, or instructions on how to make sure admin control is not lost.","created_at":"2016-09-09T17:22:51Z","updated_at":"2016-09-09T17:22:51Z","html_url":"https://github.com/geoserver/geoserver/pull/1800#discussion_r78216773","pull_request_url":"https://api.github.com/repos/geoserver/geoserver/pulls/1800","_links":{"self":{"href":"https://api.github.com/repos/geoserver/geoserver/pulls/comments/78216773"},"html":{"href":"https://github.com/geoserver/geoserver/pull/1800#discussion_r78216773"},"pull_request":{"href":"https://api.github.com/repos/geoserver/geoserver/pulls/1800"}}},"pull_request":{"url":"https://api.github.com/repos/geoserver/geoserver/pulls/1800","id":83989421,"html_url":"https://github.com/geoserver/geoserver/pull/1800","diff_url":"https://github.com/geoserver/geoserver/pull/1800.diff","patch_url":"https://github.com/geoserver/geoserver/pull/1800.patch","issue_url":"https://api.github.com/repos/geoserver/geoserver/issues/1800","number":1800,"state":"open","locked":false,"title":"[GEOS-7719] Communtiy Module: OAuth2 filter and Google OAuth2 filter","user":{"login":"afabiani","id":1278021,"avatar_url":"https://avatars.githubusercontent.com/u/1278021?v=3","gravatar_id":"","url":"https://api.github.com/users/afabiani","html_url":"https://github.com/afabiani","followers_url":"https://api.github.com/users/afabiani/followers","following_url":"https://api.github.com/users/afabiani/following{/other_user}","gists_url":"https://api.github.com/users/afabiani/gists{/gist_id}","starred_url":"https://api.github.com/users/afabiani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afabiani/subscriptions","organizations_url":"https://api.github.com/users/afabiani/orgs","repos_url":"https://api.github.com/users/afabiani/repos","events_url":"https://api.github.com/users/afabiani/events{/privacy}","received_events_url":"https://api.github.com/users/afabiani/received_events","type":"User","site_admin":false},"body":"JIRA\r\n\r\nhttps://osgeo-org.atlassian.net/browse/GEOS-7719","created_at":"2016-09-05T11:37:46Z","updated_at":"2016-09-09T17:22:51Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7efcfab871c607ca9e03d574f276c95f8f52e971","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/geoserver/geoserver/pulls/1800/commits","review_comments_url":"https://api.github.com/repos/geoserver/geoserver/pulls/1800/comments","review_comment_url":"https://api.github.com/repos/geoserver/geoserver/pulls/comments{/number}","comments_url":"https://api.github.com/repos/geoserver/geoserver/issues/1800/comments","statuses_url":"https://api.github.com/repos/geoserver/geoserver/statuses/83e3b87c1e1740282c183a5a5cf4205f1b1e2253","head":{"label":"geosolutions-it:oauth2-filter","ref":"oauth2-filter","sha":"83e3b87c1e1740282c183a5a5cf4205f1b1e2253","user":{"login":"geosolutions-it","id":775710,"avatar_url":"https://avatars.githubusercontent.com/u/775710?v=3","gravatar_id":"","url":"https://api.github.com/users/geosolutions-it","html_url":"https://github.com/geosolutions-it","followers_url":"https://api.github.com/users/geosolutions-it/followers","following_url":"https://api.github.com/users/geosolutions-it/following{/other_user}","gists_url":"https://api.github.com/users/geosolutions-it/gists{/gist_id}","starred_url":"https://api.github.com/users/geosolutions-it/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geosolutions-it/subscriptions","organizations_url":"https://api.github.com/users/geosolutions-it/orgs","repos_url":"https://api.github.com/users/geosolutions-it/repos","events_url":"https://api.github.com/users/geosolutions-it/events{/privacy}","received_events_url":"https://api.github.com/users/geosolutions-it/received_events","type":"Organization","site_admin":false},"repo":{"id":5143126,"name":"geoserver","full_name":"geosolutions-it/geoserver","owner":{"login":"geosolutions-it","id":775710,"avatar_url":"https://avatars.githubusercontent.com/u/775710?v=3","gravatar_id":"","url":"https://api.github.com/users/geosolutions-it","html_url":"https://github.com/geosolutions-it","followers_url":"https://api.github.com/users/geosolutions-it/followers","following_url":"https://api.github.com/users/geosolutions-it/following{/other_user}","gists_url":"https://api.github.com/users/geosolutions-it/gists{/gist_id}","starred_url":"https://api.github.com/users/geosolutions-it/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geosolutions-it/subscriptions","organizations_url":"https://api.github.com/users/geosolutions-it/orgs","repos_url":"https://api.github.com/users/geosolutions-it/repos","events_url":"https://api.github.com/users/geosolutions-it/events{/privacy}","received_events_url":"https://api.github.com/users/geosolutions-it/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/geosolutions-it/geoserver","description":"Official GeoServer repository","fork":true,"url":"https://api.github.com/repos/geosolutions-it/geoserver","forks_url":"https://api.github.com/repos/geosolutions-it/geoserver/forks","keys_url":"https://api.github.com/repos/geosolutions-it/geoserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/geosolutions-it/geoserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/geosolutions-it/geoserver/teams","hooks_url":"https://api.github.com/repos/geosolutions-it/geoserver/hooks","issue_events_url":"https://api.github.com/repos/geosolutions-it/geoserver/issues/events{/number}","events_url":"https://api.github.com/repos/geosolutions-it/geoserver/events","assignees_url":"https://api.github.com/repos/geosolutions-it/geoserver/assignees{/user}","branches_url":"https://api.github.com/repos/geosolutions-it/geoserver/branches{/branch}","tags_url":"https://api.github.com/repos/geosolutions-it/geoserver/tags","blobs_url":"https://api.github.com/repos/geosolutions-it/geoserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/geosolutions-it/geoserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/geosolutions-it/geoserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/geosolutions-it/geoserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/geosolutions-it/geoserver/statuses/{sha}","languages_url":"https://api.github.com/repos/geosolutions-it/geoserver/languages","stargazers_url":"https://api.github.com/repos/geosolutions-it/geoserver/stargazers","contributors_url":"https://api.github.com/repos/geosolutions-it/geoserver/contributors","subscribers_url":"https://api.github.com/repos/geosolutions-it/geoserver/subscribers","subscription_url":"https://api.github.com/repos/geosolutions-it/geoserver/subscription","commits_url":"https://api.github.com/repos/geosolutions-it/geoserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/geosolutions-it/geoserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/geosolutions-it/geoserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/geosolutions-it/geoserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/geosolutions-it/geoserver/contents/{+path}","compare_url":"https://api.github.com/repos/geosolutions-it/geoserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/geosolutions-it/geoserver/merges","archive_url":"https://api.github.com/repos/geosolutions-it/geoserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/geosolutions-it/geoserver/downloads","issues_url":"https://api.github.com/repos/geosolutions-it/geoserver/issues{/number}","pulls_url":"https://api.github.com/repos/geosolutions-it/geoserver/pulls{/number}","milestones_url":"https://api.github.com/repos/geosolutions-it/geoserver/milestones{/number}","notifications_url":"https://api.github.com/repos/geosolutions-it/geoserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/geosolutions-it/geoserver/labels{/name}","releases_url":"https://api.github.com/repos/geosolutions-it/geoserver/releases{/id}","deployments_url":"https://api.github.com/repos/geosolutions-it/geoserver/deployments","created_at":"2012-07-22T17:04:22Z","updated_at":"2016-02-19T20:18:07Z","pushed_at":"2016-09-07T12:52:46Z","git_url":"git://github.com/geosolutions-it/geoserver.git","ssh_url":"git@github.com:geosolutions-it/geoserver.git","clone_url":"https://github.com/geosolutions-it/geoserver.git","svn_url":"https://github.com/geosolutions-it/geoserver","homepage":"http://geoserver.org","size":147968,"stargazers_count":6,"watchers_count":6,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":41,"forks":2,"open_issues":41,"watchers":6,"default_branch":"master"}},"base":{"label":"geoserver:master","ref":"master","sha":"c7c6273fad454f2971456050a674af87af974c33","user":{"login":"geoserver","id":186522,"avatar_url":"https://avatars.githubusercontent.com/u/186522?v=3","gravatar_id":"","url":"https://api.github.com/users/geoserver","html_url":"https://github.com/geoserver","followers_url":"https://api.github.com/users/geoserver/followers","following_url":"https://api.github.com/users/geoserver/following{/other_user}","gists_url":"https://api.github.com/users/geoserver/gists{/gist_id}","starred_url":"https://api.github.com/users/geoserver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoserver/subscriptions","organizations_url":"https://api.github.com/users/geoserver/orgs","repos_url":"https://api.github.com/users/geoserver/repos","events_url":"https://api.github.com/users/geoserver/events{/privacy}","received_events_url":"https://api.github.com/users/geoserver/received_events","type":"Organization","site_admin":false},"repo":{"id":2751199,"name":"geoserver","full_name":"geoserver/geoserver","owner":{"login":"geoserver","id":186522,"avatar_url":"https://avatars.githubusercontent.com/u/186522?v=3","gravatar_id":"","url":"https://api.github.com/users/geoserver","html_url":"https://github.com/geoserver","followers_url":"https://api.github.com/users/geoserver/followers","following_url":"https://api.github.com/users/geoserver/following{/other_user}","gists_url":"https://api.github.com/users/geoserver/gists{/gist_id}","starred_url":"https://api.github.com/users/geoserver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoserver/subscriptions","organizations_url":"https://api.github.com/users/geoserver/orgs","repos_url":"https://api.github.com/users/geoserver/repos","events_url":"https://api.github.com/users/geoserver/events{/privacy}","received_events_url":"https://api.github.com/users/geoserver/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/geoserver/geoserver","description":"Official GeoServer repository","fork":false,"url":"https://api.github.com/repos/geoserver/geoserver","forks_url":"https://api.github.com/repos/geoserver/geoserver/forks","keys_url":"https://api.github.com/repos/geoserver/geoserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/geoserver/geoserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/geoserver/geoserver/teams","hooks_url":"https://api.github.com/repos/geoserver/geoserver/hooks","issue_events_url":"https://api.github.com/repos/geoserver/geoserver/issues/events{/number}","events_url":"https://api.github.com/repos/geoserver/geoserver/events","assignees_url":"https://api.github.com/repos/geoserver/geoserver/assignees{/user}","branches_url":"https://api.github.com/repos/geoserver/geoserver/branches{/branch}","tags_url":"https://api.github.com/repos/geoserver/geoserver/tags","blobs_url":"https://api.github.com/repos/geoserver/geoserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/geoserver/geoserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/geoserver/geoserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/geoserver/geoserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/geoserver/geoserver/statuses/{sha}","languages_url":"https://api.github.com/repos/geoserver/geoserver/languages","stargazers_url":"https://api.github.com/repos/geoserver/geoserver/stargazers","contributors_url":"https://api.github.com/repos/geoserver/geoserver/contributors","subscribers_url":"https://api.github.com/repos/geoserver/geoserver/subscribers","subscription_url":"https://api.github.com/repos/geoserver/geoserver/subscription","commits_url":"https://api.github.com/repos/geoserver/geoserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/geoserver/geoserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/geoserver/geoserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/geoserver/geoserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/geoserver/geoserver/contents/{+path}","compare_url":"https://api.github.com/repos/geoserver/geoserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/geoserver/geoserver/merges","archive_url":"https://api.github.com/repos/geoserver/geoserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/geoserver/geoserver/downloads","issues_url":"https://api.github.com/repos/geoserver/geoserver/issues{/number}","pulls_url":"https://api.github.com/repos/geoserver/geoserver/pulls{/number}","milestones_url":"https://api.github.com/repos/geoserver/geoserver/milestones{/number}","notifications_url":"https://api.github.com/repos/geoserver/geoserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/geoserver/geoserver/labels{/name}","releases_url":"https://api.github.com/repos/geoserver/geoserver/releases{/id}","deployments_url":"https://api.github.com/repos/geoserver/geoserver/deployments","created_at":"2011-11-10T19:56:06Z","updated_at":"2016-09-08T17:33:59Z","pushed_at":"2016-09-09T13:09:02Z","git_url":"git://github.com/geoserver/geoserver.git","ssh_url":"git@github.com:geoserver/geoserver.git","clone_url":"https://github.com/geoserver/geoserver.git","svn_url":"https://github.com/geoserver/geoserver","homepage":"http://geoserver.org/","size":174294,"stargazers_count":661,"watchers_count":661,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":722,"mirror_url":null,"open_issues_count":20,"forks":722,"open_issues":20,"watchers":661,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/geoserver/geoserver/pulls/1800"},"html":{"href":"https://github.com/geoserver/geoserver/pull/1800"},"issue":{"href":"https://api.github.com/repos/geoserver/geoserver/issues/1800"},"comments":{"href":"https://api.github.com/repos/geoserver/geoserver/issues/1800/comments"},"review_comments":{"href":"https://api.github.com/repos/geoserver/geoserver/pulls/1800/comments"},"review_comment":{"href":"https://api.github.com/repos/geoserver/geoserver/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/geoserver/geoserver/pulls/1800/commits"},"statuses":{"href":"https://api.github.com/repos/geoserver/geoserver/statuses/83e3b87c1e1740282c183a5a5cf4205f1b1e2253"}}}}
{"actor":{"display_login":"aaime"}}