New Group Sync for GN by f-necas · Pull Request #350 · georchestra/geonetwork

f-necas · 2025-12-18T21:50:09Z

I introduce here a new synchronization for geonetwork in georchestra in order to solve the current situation of:

Org based sync is not granular enough to be able to give a user rights in different groups
Role based sync is not understable enough and we easily lose track of what is synced between georchestra's console and GN

How does it work

This new sync works (almost) like Org based sync. Organization in georchestra are mapped to GN groups.

But, we can also create new roles in georchestra like PSC:GN_REVIEWER which will allow user to be REVIEWER of PSC group.

In this way, we can set multiple and differents rights for user like PSC:GN_REVIEWER, C2C:GN_EDITOR and so on.

Top level roles like GN_EDITOR, GN_REVIEWER set this role for organization/group where user belongs to (just as org based sync).

Requires: georchestra/georchestra#4616
and georchestra/georchestra#4656

Examples

User	Profile in GN	Roles in GN
Organization PSC, Roles: ROLE_USER	Guest	No group attribution
No Organization , Roles: GN_EDITOR	Editor	No group attribution
Organization PSC , Roles: GN_EDITOR	Editor	Editor in PSC Group
Organization PSC , Roles: GN_EDITOR, C3P:GN_REVIEWER	Reviewer	Editor in PSC Group, Reviewer in C3P Group
No Org, Roles: GN_ADMIN	Administrator	Admin in all groups

GIP: georchestra/improvement-proposals#16

fvanderbiest · 2025-12-19T07:50:27Z

I like the fact that this is an extension of the org-based sync.
As I understand it, it changes nothing for those who do not need it.

Can you explain whether this will be be a new option for the geonetwork.syncMode setting or a replacement of the orgs sync mode ?
https://github.com/georchestra/datadir/blob/92dd72bd7911f38da0779ea8474572af89abed9a/geonetwork/geonetwork.properties#L25-L32

fvanderbiest · 2025-12-19T07:51:33Z

If the community agrees on this move, it has to be properly documented in addition to this PR.

jeanpommier · 2025-12-19T08:22:33Z

Looks very interesting indeed.
Sorry, I won't have time to look at the code right now

landryb · 2025-12-19T10:12:13Z

i dont understand much of it but i dont have the time to properly look, but shouldnt the 'profile in GN' be Editor in the 4th line in the example ? per 'Organization PSC , Roles: GN_EDITOR, C3P:GN_REVIEWER'.. or it has to be 'the higher profile' ?

f-necas · 2025-12-19T12:29:39Z

i dont understand much of it but i dont have the time to properly look, but shouldnt the 'profile in GN' be Editor in the 4th line in the example ? per 'Organization PSC , Roles: GN_EDITOR, C3P:GN_REVIEWER'.. or it has to be 'the higher profile' ?

We compute the highest profile in order for the user to have the right minimal profile according to their roles.

If the community agrees on this move, it has to be properly documented in addition to this PR.

Yep wanted to do so but I didn't remembered some things I did. It was a shot i gave a few months ago...

Can you explain whether this will be be a new option for the geonetwork.syncMode setting or a replacement of the orgs sync mode ? georchestra/datadir@92dd72b/geonetwork/geonetwork.properties#L25-L32

Sure will do, if community agrees

fvanderbiest · 2025-12-19T12:32:15Z

I think this deserves a GIP :-)

Copilot

Pull request overview

Adds a new role_per_org group synchronization strategy for GeoNetwork/geOrchestra integration to support granular per-organization group privileges via prefixed roles (e.g. PSC:GN_REVIEWER), while keeping org-based mapping for “root” roles.

Changes:

Introduces GroupSyncMode.role_per_org and a new RolePerOrgBasedGroupSynchronizer implementation, wired via GroupSynchronizerProxy.
Deprecates the existing roles-based group synchronizer class (annotation) and adjusts integration test support to compute user profile using “root roles” provided by the active synchronizer.
Adds a new integration test covering the new sync mode.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
georchestra-integration/externalized-accounts/src/test/java/org/geonetwork/security/external/integration/RolePerOrgBasedSynchronizationIT.java	New integration test exercising the new sync mode and prefixed role behavior.
georchestra-integration/externalized-accounts/src/test/java/org/geonetwork/security/external/integration/IntegrationTestSupport.java	Updates profile assertion to use synchronizer-provided “root roles” for profile resolution.
georchestra-integration/externalized-accounts/src/main/java/org/geonetwork/security/external/model/GroupSyncMode.java	Adds the `role_per_org` sync mode (and marks `roles` as deprecated in a comment).
georchestra-integration/externalized-accounts/src/main/java/org/geonetwork/security/external/integration/RolesBasedGroupSynchronizer.java	Marks the old roles-based synchronizer class as `@Deprecated`.
georchestra-integration/externalized-accounts/src/main/java/org/geonetwork/security/external/integration/RolePerOrgBasedGroupSynchronizer.java	New synchronizer implementing org group mapping + prefixed-role per-group privileges.
georchestra-integration/externalized-accounts/src/main/java/org/geonetwork/security/external/integration/IntegrationConfiguration.java	Registers the new synchronizer as a Spring bean.
georchestra-integration/externalized-accounts/src/main/java/org/geonetwork/security/external/integration/GroupSynchronizerProxy.java	Routes `role_per_org` mode to the new synchronizer and delegates `getRootRolesForUser`.
georchestra-integration/externalized-accounts/src/main/java/org/geonetwork/security/external/integration/GroupSynchronizer.java	Adds `getRootRolesForUser` to the interface.
georchestra-integration/externalized-accounts/src/main/java/org/geonetwork/security/external/integration/AbstractGroupSynchronizer.java	Provides a default `getRootRolesForUser` implementation (returns raw roles).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

f-necas changed the title ~~roles-org~~ New Group Sync for GN Dec 18, 2025

f-necas requested review from a team, jeanpommier, landryb and pmauduit December 19, 2025 07:13

f-necas marked this pull request as ready for review December 19, 2025 07:13

f-necas requested review from fvanderbiest and pierrejego December 19, 2025 07:14

f-necas mentioned this pull request Dec 19, 2025

feat: allow colon in roles for ldap and console georchestra/georchestra#4616

Merged

f-necas mentioned this pull request Dec 23, 2025

[GIP] New Geonetwork users/groups sync georchestra/improvement-proposals#16

Open

f-necas force-pushed the roles-org branch from 816e6f8 to 671edeb Compare January 27, 2026 12:09

f-necas requested a review from Copilot May 7, 2026 09:24

Copilot started reviewing on behalf of f-necas May 7, 2026 09:25 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

f-necas force-pushed the georchestra-gn4.4.x branch from 3ccd214 to d9c1071 Compare May 13, 2026 12:16

f-necas and others added 7 commits May 13, 2026 16:47

feat: create a new sync type

eb73d6f

feat add tests

38191b9

feat: deprecate roles based sync and update rolePerOrg one

4c35b80

Apply suggestions from code review

6fadd27

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Apply suggestions from code review

2ea88cc

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

refactor: optimize userRoles method by reusing compiled pattern

304ea84

fix: update georchestra version to 25.0.3 in pom.xml

9f35f72

f-necas force-pushed the roles-org branch from ba695b3 to 9f35f72 Compare May 13, 2026 14:48

pmauduit approved these changes May 15, 2026

View reviewed changes

docs: add class-level documentation for RolePerOrgBasedGroupSynchronizer

2036d03

f-necas merged commit 9cdc0b1 into georchestra-gn4.4.x May 20, 2026
1 check passed

f-necas deleted the roles-org branch May 20, 2026 07:07

Uh oh!

Uh oh!

Conversation

f-necas commented Dec 18, 2025 • edited by pmauduit Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How does it work

Examples

Uh oh!

fvanderbiest commented Dec 19, 2025

Uh oh!

fvanderbiest commented Dec 19, 2025

Uh oh!

jeanpommier commented Dec 19, 2025

Uh oh!

landryb commented Dec 19, 2025

Uh oh!

f-necas commented Dec 19, 2025 • edited by pmauduit Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fvanderbiest commented Dec 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

f-necas commented Dec 18, 2025 •

edited by pmauduit

Loading

f-necas commented Dec 19, 2025 •

edited by pmauduit

Loading