Configuration de l’authentication¶

LDAP¶

# Map user information to LDAP attributes and default values
# ldapUserContextMapper.mapping[name]=ldap_attribute,default_value
ldapUserContextMapper.mapping[name]=cn,
ldapUserContextMapper.mapping[surname]=givenName,
ldapUserContextMapper.mapping[mail]=mail,data@myorganization.org
ldapUserContextMapper.mapping[organisation]=,myorganization
ldapUserContextMapper.mapping[kind]=,
ldapUserContextMapper.mapping[address]=,
ldapUserContextMapper.mapping[zip]=,
ldapUserContextMapper.mapping[state]=,
ldapUserContextMapper.mapping[city]=,
ldapUserContextMapper.mapping[country]=,

ldap.privilege.import=false

ldap.privilege.import=true

ldap.privilege.create.nonexisting.groups=false

ldapUserContextMapper.mapping[privilege]=groups,sample
# If not set, the default profile is RegisteredUser
# Valid profiles are http://geonetwork-opensource.org/manuals/trunk/eng/developer/apidocs/geonetwork/org/fao/geonet/constants/Geonet.Profile.html
ldapUserContextMapper.mapping[profile]=privileges,RegisteredUser

# Map LDAP custom profiles to catalog profiles. Not used if ldap.privilege.pattern is defined.
ldapUserContextMapper.profilMapping[Admin]=Administrator
ldapUserContextMapper.profilMapping[Editeur]=Reviewer
ldapUserContextMapper.profilMapping[Public]=RegisteredUser

# In config-security-overrides.properties
ldapUserContextMapper.mapping[privilege]=cat_privileges,sample

# In config-security.properties
ldap.privilege.pattern=CAT_(.*)_(.*)
ldap.privilege.pattern.idx.group=1
ldap.privilege.pattern.idx.profil=2

-- Define a catalog admin:
cat_privileges=CAT_ALL_Administrator

-- Define a reviewer for the group GRANULAT
cat_privileges=CAT_GRANULAT_Reviewer

-- Define a reviewer for the group GRANULAT and editor for MIMEL
cat_privileges=CAT_GRANULAT_Reviewer
cat_privileges=CAT_MIMEL_Editor

-- Define a reviewer for the group GRANULAT and editor for MIMEL and RegisteredUser for NATURA2000
cat_privileges=CAT_GRANULAT_Reviewer
cat_privileges=CAT_MIMEL_Reviewer
cat_privileges=CAT_NATURA2000_RegisterdUser

-- Only a registered user for GRANULAT
cat_privileges=CAT_GRANULAT_RegisteredUser

# Run LDAP sync every day at 23:30
ldap.sync.cron=0 30 23 * * ?

log4j.logger.geonetwork.ldap          = DEBUG
log4j.logger.org.springframework = DEBUG, console, jeeves
log4j.logger.org.springframework.* = DEBUG
log4j.logger.org.springframework.security.ldap = DEBUG

CAS¶

Pour activer le support de CAS :

1. ajouter l’URL du serveur CAS dans le fichier config-security.properties

   cas.baseURL=https://localhost:8443/cas
   cas.ticket.validator.url=${cas.baseURL}
   cas.login.url=${cas.baseURL}/login
   cas.logout.url=${cas.baseURL}/logout?url=${geonetwork.https.url}/
   

2. activer dans config-security.xml

   <import resource="config-security-cas.xml"/>
   <import resource="config-security-cas-ldap.xml"/>
   

Shibboleth authentication¶

When using either the GeoNetwork database or LDAP for authentication, you can also configure shibboleth to allow authentication against access federations.

The Shibboleth configuration options

Shibboleth authentication requires interaction with Apache web server. In particular, the apache web server must be configured to require Shibboleth authentication to access the path entered in the configuration. The apache web server configuration will contain the details of the shibboleth server that works out where a user is located (sometimes called a ‘where are you from’ server).

The remainder of the shibboleth login configuration describes how shibboleth authentication attributes are mapped to GeoNetwork user database fields as once a user is authenticated against shibboleth, their details are copied to the local GeoNetwork database.

User Self-Registration¶

From Administration, system configuration, GeoNetwork has a self-registration function which allows a user to request a login which provides access to ‘registered-user’ functions. By default this capability is switched off. To configure this capability you must complete the following sections in the ‘System configuration’ menu:

• configure the site name and organization name as these will be used in emails from this GeoNetwork site to newly registered users. An example of how to config these fields at the top of the system configuration form is:

• configure feedback email address, SMTP host and SMTP port. The feedback email address will be sent an email when a new user registers and requests a profile other than ‘Registered User’. An example of how to config these fields in the system configuration form is:

• check the box, enable user self-registration in the Authentication section of the system configuration form as follows:

When you save the system configuration form, return to the home page and log out as admin, your banner menu should now include two new options, ‘Forgot your password?’ and ‘Register’ (or their translations into your selected language) as follows:

You should also configure the xml file that includes contact details to be displayed when an error occurs in the registration process. This file is localized - the english version is located in INSTALL_DIR/web/geonetwork/loc/en/xml/registration-sent.xml.

Finally, if you want to change the content of the email that contains registration details for new users, you should modify INSTALL_DIR/web/geonetwork/xsl/registration-pwd-email.xsl.