Security configuration

Select authentication provider

Geoportal Server supports 3 types of authentication providers: simple, LDAP, or ArcGIS Enterprise. Only one provider can be used. in WEB-INF/classes/config/app-security.xml comment out the unused providers, leaving the desired provider active.

For further details on configuring each provider see:

• Simple
• LDAP
• ArcGIS Enterprise

Configure a custom index name

The default index names in Geoportal Server are metadata (for metadata/STAC items) and collections (for collections). You can rename these in WEB-INF/classes/config/app-context.xml. If you do, you will need to update the /elastic/ proxy intercepts, replacing metadata with the name of your item index.

    <!-- /elastic/ - proxied to the Elasticsearch cluster -->
    <security:intercept-url pattern="/elastic/<your_index_name>/_count/**" access="permitAll" />
    <security:intercept-url pattern="/elastic/<your_index_name>/*/_count/**" access="permitAll" />
    <security:intercept-url pattern="/elastic/<your_index_name>/_search/**" access="permitAll" />
    <security:intercept-url pattern="/elastic/<your_index_name>/*/_search/**" access="permitAll" />
    <security:intercept-url pattern="/elastic/<your_index_name>/_mappings/**" method="GET" access="permitAll" />
    <security:intercept-url pattern="/elastic/<your_index_name>/*/_mappings/**" method="GET" access="permitAll" />
    <security:intercept-url pattern="/elastic/_search/scroll/**" access="permitAll" />
    <security:intercept-url pattern="/elastic/**" access="hasRole('ADMIN')" />

Change access to API

In app-security.xml in the various security:intercept-url lines, you will find the access attribute. This attribute allows you to specify what role gets access to the specified URL pattern. The value of access can take one of two forms:

• permitAll - as expected, this allows any principal to access the endpoint, anonymous and authenticated. This is by default set for the read-only API endpoints.
• a comma-separated list of hasRole values, where the roles are one of USER, PUBLISHER, or ADMIN. The roles are assigned to users either in authentication-simple.xml if simple authentication is used, or in LDAP/ArcGIS Enterprise if one those authentication providers are used.