@geogirafe/lib-geoportal 1.2.0-dev.2763713312 → 1.2.0-dev.2763717854

package/package.json

@@ -5,7 +5,7 @@
     "name": "GeoGirafe PSC",
     "url": "https://doc.geogirafe.org"
   },
-  "version": "1.2.0-dev.2763713312",
+  "version": "1.2.0-dev.2763717854",
   "type": "module",
   "engines": {
     "node": ">=20.19.0"

package/templates/public/about.json

@@ -1 +1 @@
-{"version":"1.2.0-dev.2763713312", "build":"2763713312", "date":"16/08/2026"}
+{"version":"1.2.0-dev.2763717854", "build":"2763717854", "date":"16/08/2026"}

package/tools/auth/gmfconnectmanager.d.ts

@@ -12,15 +12,30 @@ import GMFManager from './gmfmanager.js';
  *    But you do not get any valid cookie for the GMF Backend.
  *
  * For all those reasons, we cannot use the geomapfish oAuth process
- * Instead we will use the login.html page of the backend to delegate the login to the backend
- * This will be a standard GMF login, there is no oAuth Process here.
+ * Instead we delegate the login to the backend, which is a Backend-For-Frontend (BFF) pattern:
+ * the frontend only ever holds a session cookie, and never needs any OIDC-specific configuration
+ * (no clientId, no issuer url) -- the identity provider is only known to the backend.
+ *
+ * Two `gmfauth.loginMode` flavors are supported, both delegating entirely to the backend:
+ * - 'form' (default): the backend's login.html page, a standard GMF username/password login form.
+ *   There is no oAuth process at all in this mode.
+ * - 'oidc': the backend's oidc/login route (c2cgeoportal_geoportal's OpenID Connect integration).
+ *   The browser is redirected to oidc/login, which itself redirects to the identity provider;
+ *   after the user authenticates there, the backend's oidc/callback exchanges the code for tokens
+ *   (server-side, using the client_secret) and redirects back here with the auth_tkt session cookie
+ *   set. This is exactly how ngeo authenticates against a GMF backend with
+ *   `authentication.openid_connect` enabled: the browser never talks to the identity provider
+ *   directly, and gg-viewer needs no more configuration for this mode than for 'form'.
+ *
+ * Once the redirect comes back (either flavor), everything below is identical: we only ever
+ * trust the session cookie and poll the backend's loginuser endpoint to know who is logged in.
  *
  * NOTE: If the geogirafe client is not running on the same domain as the GMF backend,
  * the GMF Backend needs to be configured with :
  * - CORS with credentials for specific domain (this can be done for example with an lua script at the in the haproxy configuration)
  * - The frontend domain has to be allowed as referer in the vars.yaml file.
  * - The variable AUTHTKT_SAMESITE has to be set to None, to allow authentication cookies to be sent to the backend from another domain
- * There is no need for any oAuth2 configuration in the admin tool.
+ * These constraints apply identically to both loginMode flavors.
  */
 export default class GMFConnectManager extends AbstractConnectManager {
     private readonly gmfManager;

package/tools/auth/gmfconnectmanager.js

@@ -10,15 +10,30 @@ import AbstractConnectManager from './abstractconnectmanager.js';
  *    But you do not get any valid cookie for the GMF Backend.
  *
  * For all those reasons, we cannot use the geomapfish oAuth process
- * Instead we will use the login.html page of the backend to delegate the login to the backend
- * This will be a standard GMF login, there is no oAuth Process here.
+ * Instead we delegate the login to the backend, which is a Backend-For-Frontend (BFF) pattern:
+ * the frontend only ever holds a session cookie, and never needs any OIDC-specific configuration
+ * (no clientId, no issuer url) -- the identity provider is only known to the backend.
+ *
+ * Two `gmfauth.loginMode` flavors are supported, both delegating entirely to the backend:
+ * - 'form' (default): the backend's login.html page, a standard GMF username/password login form.
+ *   There is no oAuth process at all in this mode.
+ * - 'oidc': the backend's oidc/login route (c2cgeoportal_geoportal's OpenID Connect integration).
+ *   The browser is redirected to oidc/login, which itself redirects to the identity provider;
+ *   after the user authenticates there, the backend's oidc/callback exchanges the code for tokens
+ *   (server-side, using the client_secret) and redirects back here with the auth_tkt session cookie
+ *   set. This is exactly how ngeo authenticates against a GMF backend with
+ *   `authentication.openid_connect` enabled: the browser never talks to the identity provider
+ *   directly, and gg-viewer needs no more configuration for this mode than for 'form'.
+ *
+ * Once the redirect comes back (either flavor), everything below is identical: we only ever
+ * trust the session cookie and poll the backend's loginuser endpoint to know who is logged in.
  *
  * NOTE: If the geogirafe client is not running on the same domain as the GMF backend,
  * the GMF Backend needs to be configured with :
  * - CORS with credentials for specific domain (this can be done for example with an lua script at the in the haproxy configuration)
  * - The frontend domain has to be allowed as referer in the vars.yaml file.
  * - The variable AUTHTKT_SAMESITE has to be set to None, to allow authentication cookies to be sent to the backend from another domain
- * There is no need for any oAuth2 configuration in the admin tool.
+ * These constraints apply identically to both loginMode flavors.
  */
 export default class GMFConnectManager extends AbstractConnectManager {
     gmfManager;
@@ -56,7 +71,8 @@ export default class GMFConnectManager extends AbstractConnectManager {
     redirectToIssuerLogin() {
         this.context.sessionManager.saveStateToSession();
         this.redirectUrl = this.getLoginRedirectUrl(false);
-        const authorizationUrl = new URL(`${this.authConfig.url}login.html`);
+        const loginPath = this.authConfig.loginMode === 'oidc' ? 'oidc/login' : 'login.html';
+        const authorizationUrl = new URL(`${this.authConfig.url}${loginPath}`);
         authorizationUrl.searchParams.set('came_from', this.redirectUrl);
         window.open(authorizationUrl, '_self');
     }

package/tools/configuration/girafeconfig.d.ts

@@ -201,6 +201,7 @@ declare class GirafeConfig {
         checkSessionOnLoad: boolean;
         audience: string[];
         authMode: 'cookie';
+        loginMode: 'form' | 'oidc';
         alwaysSendCookies: boolean;
         refererPolicy: ReferrerPolicy;
         audienceExcludedPaths: string[];

package/tools/configuration/girafeconfig.js

@@ -376,12 +376,18 @@ class GirafeConfig {
         if (!config.gmfauth.audience) {
             throw new Error(`Configuration for gmfauth.audience is required. See https://doc.geogirafe.org/docs/configuration.`);
         }
+        if (config.gmfauth.loginMode !== undefined &&
+            config.gmfauth.loginMode !== 'form' &&
+            config.gmfauth.loginMode !== 'oidc') {
+            throw new Error(`Configuration for gmfauth.loginMode must be 'form' or 'oidc'. See https://doc.geogirafe.org/docs/configuration.`);
+        }
         return {
             url: gmfauthUrl,
             audience: config.gmfauth.audience,
             loginRequired: config.gmfauth.loginRequired ?? false,
             checkSessionOnLoad: config.gmfauth.checkSessionOnLoad ?? true,
             authMode: 'cookie',
+            loginMode: config.gmfauth.loginMode ?? 'form',
             alwaysSendCookies: config.gmfauth.alwaysSendCookies ?? false,
             refererPolicy: config.gmfauth.refererPolicy ?? 'strict-origin-when-cross-origin',
             audienceExcludedPaths: config.gmfauth.audienceExcludedPaths ?? []