Security - Security extension

[tdipisa]

The viewer must be integrated in the geOrchestra security tier with this extension (for this reason it can be activated/deactivated by the administrator in backoffice in the same way of other extensions)

• The authentication of an user by the geOrchestra security context that involves: Security proxy, CAS and LDAP
• The viewer only retrieves the information related to the user rights on extensions, layers and other protected information
• User rights are managed in backoffice by the administrator and are mapped to user roles

We need to implement this:

• backend authentication filter using security proxy headers
• backend authorization using user / roles data from authentication and ignoring on-db user and groups
• backend integration with LDAP to retrieve roles list
• frontend automatic login from backend authentication filter

[fvanderbiest]

This may help: https://github.com/georchestra/georchestra/blob/master/security-proxy/README.md#how-to-integrate-a-new-application-in-georchestra-

[mbarto]

We need this on the mapstore backend side:

• Introduce support for seamless external authentication geosolutions-it/geostore#190
• Introduce headers based authentication geosolutions-it/geostore#191
• LDAP based User and UserGroup DAO implementations geosolutions-it/geostore#195