Hi community,

this is a pull request for https://osgeo-org.atlassian.net/browse/GEOS-11272.

This is currently work in progress and not ready to be merged.
PR is intended for sharing the current state of the implementation.

Checklist

• I have read the contribution guidelines.
• I have sent a Contribution Licence Agreement (not required for small changes, e.g., fixing typos in documentation).
• First PR targets the main branch (backports managed later; ignore for branch specific issues).
• All the build checks are green (see automated QA checks).

For core and extension modules:

• New unit tests have been added covering the changes.
• Documentation has been updated (if change is visible to end users).
• The REST API docs have been updated (when changing configuration objects or the REST controllers).
• There is an issue in the GeoServer Jira (except for changes that do not affect administrators or end users in any way).
• Commit message(s) must be in the form [GEOS-XYZWV] Title of the Jira ticket.
• Bug fixes and small new features are presented as a single commit.
• Each commit has a single objective (if there are multiple commits, each has a separate JIRA ticket describing its goal).

Current status

• compiling and running
• Working with Auth Providers Google, Github, Microsoft and one custom OIDC provider
• compared to the previous impl it is not yet feature complete
• also contains code for "Ressource Server" use case, which turned out to be covered by other community module (~ gs-sec-jwt) . might be removed here.

Installation

• contains assembly project, put jars into WEB-INF/lib

Configuration

• Requires setup with Auth Provider (Google, Github, Microsoft, custom OIDC provider), as usual and as before
• use configuration in Filter UI in GeoServer Web UI

Open Tasks (incomplete list)

• codebase is WIP and needs refactoring, especially in the configuration Web-UI
• complete configuration UI and support or remove remaining config options from previous impl
• review automatic redirect to auth provider if not authenticated
• support environment configuration?
• support token verification?
• Oauth logout
• cleanup i18n ressources
• unit tests
• integration tests
• Simplify newly introduced RoleResolver in gs-main
• compare with prior code base to find open issues/tasks
• have to look at resolved issues for prior implementation and check if current might be affected
• check keycloak extension
• check geonode integration
• offer new overview class diagrams for publication (draw.io)