Login window when interacting with map

[gisdata-es]

Hello,
I have seen that when viewing a map without being authenticated, when you interact with the map, a pop-up window appears asking me to authenticate. I close the window and it lets me continue interacting, at the same time the window appears again asking me to authenticate.
Can anyone understand why this is happening?

Steps to Reproduce the Problem

1. Open Map https://development.demo.geonode.org/catalogue/#/map/54
2. Navigate the map by zooming in or zoom out
3. At some point a window will appear asking you to log in.

Specifications

• GeoNode version: 4.2.0.dev0
• Installation type (vanilla, geonode-project): https://development.demo.geonode.org/version.txt
• Installation method (manual, docker):

[mattiagiupponi]

Thanks for opening the issue, we will take a look at it since is someting unexpected

[etj]

It seems that one request in a while asks for auth.
Pls note that the screenshotted requests all ask for the same layer:

Also, repeating the very same request later it retrurns the image with a 200

[etj]

@afabiani reported this is always requesting authentication:
https://development.demo.geonode.org/geoserver/gwc/service/wmts?service=WMTS&REQUEST=DescribeDomains&version=1.0.0&layer=geonode:simulation_clusters&tileMatrixSet=EPSG:4326&expandLimit=10

GeoServer log reports this:

15 Dec 11:02:47 DEBUG  [geoserver.geofence] - ResourceInfo filter: RuleFilter[user:"anonymous"+ role:ANY inst:name+:default-gs ip:"92.222.205.36"+ serv:"WMS"+ req:"GETCAPABILITIES"+ sub:ANY ws:"geonode"+ layer:"simulation_clusters"+]
15 Dec 11:02:47 DEBUG  [geofence.cache] - Request for RuleFilter[user:"anonymous"+ role:ANY inst:name+:default-gs ip:"92.222.205.36"+ serv:"WMS"+ req:"GETCAPABILITIES"+ sub:ANY ws:"geonode"+ layer:"simulation_clusters"+]
15 Dec 11:02:47 DEBUG  [geofence.cache] - Loading RuleFilter[user:"anonymous"+ role:ANY inst:name+:default-gs ip:"92.222.205.36"+ serv:"WMS"+ req:"GETCAPABILITIES"+ sub:ANY ws:"geonode"+ layer:"simulation_clusters"+]
15 Dec 11:02:47 INFO   [services.RuleReaderServiceImpl] - Requesting access for RuleFilter[user:"anonymous"+ role:ANY inst:name+:default-gs ip:"92.222.205.36"+ serv:"WMS"+ req:"GETCAPABILITIES"+ sub:ANY ws:"geonode"+ layer:"simulation_clusters"+]
15 Dec 11:02:47 DEBUG  [util.FilterUtils] - ADDED Rule[id:43193 pri:31774 srv:WMS ws:geonode l:simulation_clusters acc:ALLOW]
15 Dec 11:02:47 DEBUG  [util.FilterUtils] - ADDED Rule[id:43200 pri:31781 ws:geonode l:simulation_clusters acc:ALLOW]
15 Dec 11:02:47 DEBUG  [services.RuleReaderServiceImpl] - Filter RuleFilter[user:"anonymous"+ role:ANY inst:name+:default-gs ip:"92.222.205.36"+ serv:"WMS"+ req:"GETCAPABILITIES"+ sub:ANY ws:"geonode"+ layer:"simulation_clusters"+] is matching the following Rules:
15 Dec 11:02:47 DEBUG  [services.RuleReaderServiceImpl] -     Role:ROLE_ANONYMOUS
15 Dec 11:02:47 DEBUG  [services.RuleReaderServiceImpl] -     Role:ROLE_ANONYMOUS ---> Rule[id:43193 pri:31774 srv:WMS ws:geonode l:simulation_clusters acc:ALLOW]
15 Dec 11:02:47 DEBUG  [services.RuleReaderServiceImpl] -     Role:ROLE_ANONYMOUS ---> Rule[id:43200 pri:31781 ws:geonode l:simulation_clusters acc:ALLOW]
15 Dec 11:02:47 DEBUG  [services.RuleReaderServiceImpl] - Filter RuleFilter[user:"anonymous"+ role:ANY inst:name+:default-gs ip:"92.222.205.36"+ serv:"WMS"+ req:"GETCAPABILITIES"+ sub:ANY ws:"geonode"+ layer:"simulation_clusters"+] on role ROLE_ANONYMOUS has access AccessInfoInternal[grant:ALLOW]
15 Dec 11:02:47 INFO   [services.RuleReaderServiceImpl] - Returning AccessInfo[grant:ALLOW admin:false] for RuleFilter[user:"anonymous"+ role:ANY inst:name+:default-gs ip:"92.222.205.36"+ serv:"WMS"+ req:"GETCAPABILITIES"+ sub:ANY ws:"geonode"+ layer:"simulation_clusters"+]
15 Dec 11:02:47 DEBUG  [geoserver.geofence] - Returning mode HIDE for resource FeatureTypeInfoImpl[simulation_clusters]
15 Dec 11:02:47 DEBUG  [geoserver.geofence] - Returning VectorAccessLimits [readAttributes=null, writeAttributes=null, writeFilter=Filter.INCLUDE, readFilter=Filter.INCLUDE, mode=HIDE] for layer simulation_clusters and user anonymous

so GeoFence is allowing the access for such a layer.

[etj]

Log when accessing https://development.demo.geonode.org/catalogue/#/map/3287

simulations.log

The only part related to to error seems to be:

  9267  15 Dec 11:19:59 DEBUG  [geoserver.security] - Matched Path: /gwc/service/wmts, QueryString: service=WMTS&REQUEST=DescribeDomains&version=1.0.0&layer=geonode:simulation_clusters&tileMatrixSet=EPSG:4326&expandLimit=10 with /gwc/**
  9268  15 Dec 11:19:59 DEBUG  [geoserver.security] - Inspecting the http request looking for the Custom Session ID.
  9269  15 Dec 11:19:59 DEBUG  [geoserver.security] - Found 4 cookies!
  9270  15 Dec 11:19:59 DEBUG  [geoserver.security] - Found Custom Session cookie: 1endd9o6m9dr9aoo40ppagefpqfx9djj
  9271  15 Dec 11:19:59 DEBUG  [geoserver.security] - preAuthenticatedPrincipal = null, trying to authenticate

This are the snippets where such string appear:

 find -name *.java | xargs grep "trying to authenticate"
./src/main/src/main/java/org/geoserver/security/filter/GeoServerPreAuthenticationFilter.java:                "preAuthenticatedPrincipal = " + principal + ", trying to authenticate");
./src/community/security/oauth2/oauth2-core/src/main/java/org/geoserver/security/oauth2/GeoServerOAuthAuthenticationFilter.java:                "preAuthenticatedPrincipal = " + principal + ", trying to authenticate");
./src/community/security/oauth2/oauth2-core/src/main/java/org/geoserver/security/oauth2/GeoServerOAuthAuthenticationFilter.java:                            "Error while trying to authenticate to OAuth2 Provider with the following Exception cause:",
./src/extension/authkey/src/main/java/org/geoserver/security/GeoServerAuthenticationKeyFilter.java:        LOGGER.log(Level.FINE, "found user: = " + user.getUsername() + ", trying to authenticate");

[afabiani]

Plese check the GWC Filter Chain and make sure it has been correctly configured

[giohappy]

@gisdata-es did you have the chance to test the fix proposed by @afabiani?

[gisdata-es]

Hello,
I have tried again and the problem persists.

I have modified the filter chain and the problem persists.

[giohappy]

the datadir for Geoserver 2.23.3 with the fix has been published.

[gisdata-es]

Hello,

Tested at https://stable.demo.geonode.org/

and notice that the problem persists

I have created the following map:

1.- https://stable.demo.geonode.org/catalogue/#/map/9179

2.- I zoom in and zoom out several times and at some point the authentication prompt appears.

Any solution?