[GIP] Gateway: method for reconciliation between an external ID provider and the geOrchestra LDAP

[pierrejego]

Who ?

JDev - pi-GeoSolutions - CampToCamp

Target Module

Gateway

What ?

The aim is to adapt the geOrchestra gateway to be able to use an identity provider (such as ProConnect) to connect to geOrchestra.

In concrete terms, georchestra will be compatible with OpenIDConnect (OAuth2) authentication.

Most of this work has already be done and with FranceConnect provider integration.

Why ?

To let people access to connected features easily without creating a new user on several platforms.
To be able to use many OAuth2/OpenIDConnect provider.

What will change ?

Some modifications are required but should be optional ( chosen in configuration files ) :

• Automatic integration of new Organization (e.g SIRET is organization UUID for ProConnect provider)
• Mapping user organisation if user already exists ( e.g Unique ID is the professional mail address for ProConnect provider )
• Account creation if no existing user with this mail

How ?

Implementation to be done in :

• https://github.com/georchestra/georchestra-gateway/tree/main/gateway

Configuration modification should be updated in datadir and ansible project

Any potential pitfalls and ways to circumvent them ?

How to update/not update User information ?

• If information differs between provider and current user, what should be done ?
• How to make sure several Organization won't be created with nearly the same name ?
• When creating a new user, if no account exist, should we create him a password to connect without the provider ?
• Should this "new" user be integrated via pending user or not ?
• Which field returned by the supplier is to be used to map with geOrchestra organization ?

About the last request and ProConnect example, should we use SIREN, SIRET or organizational_unit to map with geOrchestra organization ? ( SIRET is the only mandatory field ).

Note that There are not possible mapping for geOrchestra GROUPS since no ROLE/PROFIL/GROUP are available in many provider (such as ProConnect).

About ProConnect

Note that for this work, we will only use ProConnect (OAuth2 - OpenID) provider.
FranceConnect provider should also works without any regression.

List of data that will come with this provider can be found here :

• https://github.com/numerique-gouv/agentconnect-documentation/blob/main/doc_fs/donnees_fournies.md#le-champ-sub
• https://github.com/numerique-gouv/moncomptepro/tree/master?tab=readme-ov-file#22--exemple-des-donn%C3%A9es-retourn%C3%A9es-par-lendpoint-get-userinfo-du-serveur-openid

Documentation on Agent Connect integration can be found here :

• https://github.com/france-connect/Documentation-AgentConnect/blob/main/doc_fs.md
• https://github.com/numerique-gouv/proconnect-documentation/blob/main/doc_fs/implementation_technique.md

When ?

Before December 2024

State of the vote:

PSC members	vote
Fabrice Phung
François Van Der Biest
Pierre Mauduit
Landry Breuil
Stéphane Mével-Viannay
Maël Reboux
Pierre Jégo
Jean Pommier
Catherine Piton-Morales

[jeanpommier]

Some notes I took during the meeting on September 30th: meeting notes

[Gaetanbrl]

additional notes:

@MaelREBOUX ask this day if a schema exists to describe use cases and geOrchestra's behavior (between gateway / console / ...).

@landryb share some use cases from @bchartier works :

https://github.com/bchartier/cicclo-ogcapi-agentconnect/wiki/Cas-d%27usage#cas-dusage-pour-proconnect

[fphg]

hello, thanks for the GIP

since georchestra is "free, modular, interoperable, community driven", we shall ensure that georchestra is not fr only. problem, *connect is fr only, letting the reader think that this GIP breaks international compatibility.

in fact, this GIP deals with external openid id providers and reconciliation with georchestra's own directory. *Connect integration shall only be a consequence and a first achievement of this GIP.

could you refactor the GIP's goal and focus on openid and reconciliation ?

this morning the PSC changed the title to match these expectations, but of course feel free to provide a better title !

[Gaetanbrl]

@fphg I've modified the text. Please, confirm that this is what you have in mind.