@geogirafe/lib-geoportal/tools/auth/gmfconnectmanager.js

GeoGirafe is a flexible application to build online geoportals.

import AbstractConnectManager from './abstractconnectmanager.js';
/**
 * For diverse reasons, this could NOT be done using the oAuth2 mechanisms of GMF:
 * 1. There is no .well-know discovery endpoint
 * 2. The token endpoint needs a client_secret, and for security reasons it has to be called from the backend itself.
 *    There is not custom backend for GeoGirafe and we cannot do this.
 * 3. The redirect url is limited to exact matches, and we cannot pass the state of the application in the redirect_uri
 * 4. Using GMF oAuth2 routes for authentification does not authenticate the user to the backend.
 *    It just tells the client that you have a correct user in GMF.
 *    But you do not get any valid cookie for the GMF Backend.
 *
 * For all those reasons, we cannot use the geomapfish oAuth process
 * Instead we delegate the login to the backend, which is a Backend-For-Frontend (BFF) pattern:
 * the frontend only ever holds a session cookie, and never needs any OIDC-specific configuration
 * (no clientId, no issuer url) -- the identity provider is only known to the backend.
 *
 * Two `gmfauth.loginMode` flavors are supported, both delegating entirely to the backend:
 * - 'form' (default): the backend's login.html page, a standard GMF username/password login form.
 *   There is no oAuth process at all in this mode.
 * - 'oidc': the backend's oidc/login route (c2cgeoportal_geoportal's OpenID Connect integration).
 *   The browser is redirected to oidc/login, which itself redirects to the identity provider;
 *   after the user authenticates there, the backend's oidc/callback exchanges the code for tokens
 *   (server-side, using the client_secret) and redirects back here with the auth_tkt session cookie
 *   set. This is exactly how ngeo authenticates against a GMF backend with
 *   `authentication.openid_connect` enabled: the browser never talks to the identity provider
 *   directly, and gg-viewer needs no more configuration for this mode than for 'form'.
 *
 * Once the redirect comes back (either flavor), everything below is identical: we only ever
 * trust the session cookie and poll the backend's loginuser endpoint to know who is logged in.
 *
 * NOTE: If the geogirafe client is not running on the same domain as the GMF backend,
 * the GMF Backend needs to be configured with :
 * - CORS with credentials for specific domain (this can be done for example with an lua script at the in the haproxy configuration)
 * - The frontend domain has to be allowed as referer in the vars.yaml file.
 * - The variable AUTHTKT_SAMESITE has to be set to None, to allow authentication cookies to be sent to the backend from another domain
 * These constraints apply identically to both loginMode flavors.
 */
export default class GMFConnectManager extends AbstractConnectManager {
    gmfManager;
    constructor(context, gmfManager) {
        super(context);
        this.gmfManager = gmfManager;
    }
    get authConfig() {
        return this.context.configManager.Config.gmfauth;
    }
    isAuthentified() {
        return new URL(window.location.href).searchParams.get('authentified') === 'true';
    }
    async initialize() {
        if (this.isAuthentified()) {
            // We are back from GMF authentication.
            // Go to the next step with the backend authentication
            await this.handleLoggedInToIssuer();
        }
    }
    async login() {
        console.debug('Auth: 1. Issuer login');
        this.redirectToIssuerLogin();
    }
    async silentLogin() {
        await this.gmfManager.getUserInfo();
        this.state.oauth.status = this.state.oauth.userInfo?.username ? 'loggedIn' : 'loggedOut';
    }
    async logout() {
        // Nothing more to do here, just mark as loggedOut
        this.context.sessionManager.saveStateToSession();
        console.debug('Auth: 5. Issuer logout');
        this.state.oauth.status = 'loggedOut';
    }
    redirectToIssuerLogin() {
        this.context.sessionManager.saveStateToSession();
        this.redirectUrl = this.getLoginRedirectUrl(false);
        const loginPath = this.authConfig.loginMode === 'oidc' ? 'oidc/login' : 'login.html';
        const authorizationUrl = new URL(`${this.authConfig.url}${loginPath}`);
        authorizationUrl.searchParams.set('came_from', this.redirectUrl);
        window.open(authorizationUrl, '_self');
    }
    async handleLoggedInToIssuer() {
        console.debug('Auth: 2. Issuer login handle');
        this.state.oauth.status = 'issuer.loggedIn';
        this.state.oauth.audience = this.authConfig.audience;
        // Prepare refresh login
        await this.refreshToken();
    }
    async refreshToken() {
        console.debug('Refreshing token');
        const userInfoUrl = `${this.authConfig.url}loginuser`;
        this.state.oauth.userInfo = await fetch(userInfoUrl).then((r) => r.json());
        if (!this.state.oauth.userInfo?.username) {
            this.loggedOutFromBackend();
        }
        else {
            const expiresInMs = 600000; // 10 min
            setTimeout(() => this.refreshToken(), expiresInMs);
        }
    }
}