Skip to content

Security Configuration 4.x

Jump to bottom
Ankita Srivastava edited this page Jun 18, 2026 · 5 revisions

Configure Geoportal Authorization Server

This is mandatory configuration and it is done in WEB-INF/classes/config/config.properties. It is recommended to use Environment variables. Replace localhost with Geoportal Server hostname. If Geoportal is deployed in Beanstalk, do not use port number

  security.issuer=${GPT_ISSUER:http://localhost:9000}
  security.ui.redirectUri=${GPT_UI_REDIRECTURI:http://localhost:8080/geoportal/callback.html}

Configure client credentials for Geoportal API access.

  • Admin client for API Access
 security.api.admin.clientId=${GPT_API_ADMIN_CLIENTID:admin}
  • Use the {bcrypt} prefix when storing a BCrypt-hashed secret, and {noop} when the value is stored in plain text.
 security.api.admin.clientSecret=${GPT_API_ADMIN_CLIENTSECRET:}
  • Read-only client for API Access
security.api.read.clientId=${GPT_API_READ_CLIENTID:user}
  • Use the {bcrypt} prefix when storing a BCrypt-hashed secret, and {noop} when the value is stored in plain text
   - security.api.read.clientSecret=${GPT_API_READ_CLIENTSECRET:}

Select authentication provider

Geoportal Server supports 3 types of authentication providers: simple, LDAP, or ArcGIS Enterprise. Only one provider can be used. in WEB-INF/classes/config/app-context.xml comment out the unused providers, leaving the desired provider active.

For further details on configuring each provider see:

Configure a custom index name

The default index names in Geoportal Server are metadata (for metadata/STAC items) and collections (for collections). You can rename these in WEB-INF/classes/config/config.properties. If you do, you will need to update the /elastic/ proxy intercepts, replacing metadata with the name of your item index.

# /elastic/ - proxied to the Elasticsearch cluster
security.secured-endpoints[16].pattern=/elastic/<index_name>/_count/**
security.secured-endpoints[16].roles=permitAll

security.secured-endpoints[17].pattern=/elastic/<index_name>/*/_count/**
security.secured-endpoints[17].roles=permitAll

security.secured-endpoints[18].pattern=/elastic/<index_name>/_search/**
security.secured-endpoints[18].roles=permitAll

security.secured-endpoints[19].pattern=/elastic/<index_name>/*/_search/**
security.secured-endpoints[19].roles=permitAll

security.secured-endpoints[20].pattern=/elastic/<index_name>/_mappings/**
security.secured-endpoints[20].roles=permitAll

security.secured-endpoints[21].pattern=/elastic/<index_name>/*/_mappings/**
security.secured-endpoints[21].roles=permitAll

Change access to API

In config.properties in the various security.secured-endpoints lines, you will find the roles attribute. This attribute allows you to specify what role gets access to the specified URL pattern. The value of roles can take one of two forms:

  • permitAll - as expected, this allows any principal to access the endpoint, anonymous and authenticated. This is by default set for the read-only API endpoints.
  • a comma-separated list of roles values, where the roles are one of USER, PUBLISHER, or ADMIN. The roles are assigned to users either in authentication-simple.xml if simple authentication is used, or in LDAP/ArcGIS Enterprise if one those authentication providers are used.

RSA Key Configuration for JWT Signing (Load Balancer / Multi-Instance Deployments)

For production with multiple server instances behind a load balancer, you MUST configure shared RSA keys. Without these, each instance generates its own keys at startup, causing JWT validation failures when requests hit different instances.

To generate RSA keys, run geoportal-server-catalog/geoportal/doc/jwt_rsa_key/generate-rsa-keys.bat and set the resulting public and private keys as environment variables.

Set via environment variables (recommended for production):

  GPT_JWT_RSA_PUBLICKEY=
  GPT_JWT_RSA_PRIVATEKEY=
  GPT_JWT_RSA_KEYID=

If not configured, keys are generated dynamically (suitable for single instance only).

Clone this wiki locally