[Fixes #14177] Implement storage and handling of authentications for external resources by sijandh35 · Pull Request #14192 · GeoNode/geonode

sijandh35 · 2026-05-04T15:36:00Z

Checklist

Reviewing is a process done by project maintainers, mostly on a volunteer basis. We try to keep the overhead as small as possible and appreciate if you help us to do so by completing the following items. Feel free to ask in a comment if you have troubles with any of them.

For all pull requests:

Confirm you have read the contribution guidelines
You have sent a Contribution Licence Agreement (CLA) as necessary (not required for small changes, e.g., fixing typos in the documentation)
Make sure the first PR targets the master branch, eventual backports will be managed later. This can be ignored if the PR is fixing an issue that only happens in a specific branch, but not in newer ones.

The following are required only for core and extension modules (they are welcomed, but not required, for contrib modules):

There is a ticket in https://github.com/GeoNode/geonode/issues describing the issue/improvement/feature (a notable exemption is, changes not visible to end-users)
The issue connected to the PR must have Labels and Milestone assigned
PR for bug fixes and small new features are presented as a single commit
PR title must be in the form "[Fixes #<issue_number>] Title of the PR"
New unit tests have been added covering the changes, unless there is an explanation on why the tests are not necessary/implemented

Submitting the PR does not require you to check all items, but by the time it gets merged, they should be either satisfied or inapplicable.

gemini-code-assist · 2026-05-04T15:40:19Z

Warning

Gemini is experiencing higher than usual traffic and was unable to create the review. Please try again in a few hours by commenting /gemini review.

codecov · 2026-05-04T15:48:53Z

Codecov Report

❌ Patch coverage is 79.56403% with 75 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.96%. Comparing base (32ab42e) to head (f984ab4).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #14192      +/-   ##
==========================================
+ Coverage   64.82%   64.96%   +0.13%     
==========================================
  Files         960      967       +7     
  Lines       58865    59208     +343     
  Branches     8069     8104      +35     
==========================================
+ Hits        38159    38462     +303     
- Misses      19083    19115      +32     
- Partials     1623     1631       +8

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

giohappy · 2026-05-05T08:01:37Z

    return custom_services_types
+
+
+def get_basic_auth_credentials(auth_config):


@sijandh35 I would move these utils under the security module

giohappy · 2026-05-06T08:45:16Z

+    def clean(self):
+        cleaned_data = super().clean()
+
+        if cleaned_data.get("type") == "basic" and not self.instance.pk and not cleaned_data.get("password"):


Call the registry to obtain the handler for the type, and deledate payload validation to t handler classmethod, like AuthHandler.validate(cleaned_data)

giohappy · 2026-05-06T08:46:09Z

+    def save(self, commit=True):
+        instance = super().save(commit=False)
+
+        if instance.type == "basic":


Let's avoid conditions on specific types. This couples the Admin to the implemented handlers.
For safety and simplicity, let's encrypt/decrypt the entire payload.

giohappy · 2026-05-06T08:46:40Z

+auth_handler_registry = AuthHandlerRegistry()
+
+
+def build_auth_handler(config):


we don't need this util. The caller can just use auth_handler_registry.build(config) itself.

giohappy · 2026-05-06T08:52:28Z

+    return (auth_handler.username, auth_handler.password)
+
+
+def create_basic_auth_config(username, password):


This can be a class method on the AuthBasicHandler

giohappy · 2026-05-06T08:54:14Z

 logger = logging.getLogger(__name__)


+def get_basic_auth_credentials(auth_config):


This can be a class methos on BasicAuthHandler.
However, see my comment inside services...

giohappy · 2026-05-06T09:03:48Z

            service.id,
-            username=service.username if service.needs_authentication else None,
-            password=service.get_password() if service.needs_authentication else None,
+            username=username,


I wouldn't pass username/password around anymore.
owslib.WebMapService supports passing an auth object (see the signature here). So here and here we can pass an auth object.
I suggest adapting the handler to handle an auth object in place of username and password.

…external resources

gitguardian · 2026-05-07T14:21:40Z

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
32555648	Triggered	Authentication Tuple	`eebd47c`	geonode/security/tests.py	View secret
32555648	Triggered	Authentication Tuple	`eebd47c`	geonode/services/tests.py	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

cla-bot Bot added the cla-signed CLA Bot: community license agreement signed label May 4, 2026

sijandh35 marked this pull request as draft May 4, 2026 16:07

sijandh35 marked this pull request as ready for review May 4, 2026 16:14

sijandh35 requested review from giohappy and mattiagiupponi May 5, 2026 05:55

sijandh35 assigned mattiagiupponi May 5, 2026

sijandh35 requested a review from Gpetrak May 5, 2026 05:56

sijandh35 assigned sijandh35 and unassigned sijandh35 May 5, 2026

giohappy reviewed May 5, 2026

View reviewed changes

sijandh35 requested a review from giohappy May 5, 2026 11:03

giohappy requested changes May 6, 2026

View reviewed changes

sijandh35 added 2 commits May 7, 2026 12:34

[Fixes #14177] Implement storage and handling of authentications for …

eebd47c

…external resources

[Fixes #14177] add get and set payload on AuthConfig

85f7dd1

sijandh35 force-pushed the ISSUE_14177 branch from dde362e to 85f7dd1 Compare May 7, 2026 14:21

sijandh35 requested a review from giohappy May 7, 2026 14:41

sijandh35 added 2 commits May 8, 2026 06:37

Merge branch 'master' into ISSUE_14177

34651e5

[Fixes #14177] Refactor auth config payload handling

f984ab4

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Fixes #14177] Implement storage and handling of authentications for external resources#14192

[Fixes #14177] Implement storage and handling of authentications for external resources#14192
sijandh35 wants to merge 4 commits intomasterfrom
ISSUE_14177

sijandh35 commented May 4, 2026

Uh oh!

gemini-code-assist Bot commented May 4, 2026

Uh oh!

codecov Bot commented May 4, 2026 •

edited

Loading

Uh oh!

giohappy May 5, 2026

Uh oh!

sijandh35 May 5, 2026

Uh oh!

giohappy May 6, 2026

Uh oh!

giohappy May 6, 2026

Uh oh!

giohappy May 6, 2026

Uh oh!

giohappy May 6, 2026

Uh oh!

giohappy May 6, 2026

Uh oh!

giohappy May 6, 2026

Uh oh!

gitguardian Bot commented May 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		return custom_services_types


		def get_basic_auth_credentials(auth_config):

		auth_handler_registry = AuthHandlerRegistry()


		def build_auth_handler(config):

		return (auth_handler.username, auth_handler.password)


		def create_basic_auth_config(username, password):

		logger = logging.getLogger(__name__)


		def get_basic_auth_credentials(auth_config):

Conversation

sijandh35 commented May 4, 2026

Checklist

Uh oh!

gemini-code-assist Bot commented May 4, 2026

Uh oh!

codecov Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gitguardian Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented May 4, 2026 •

edited

Loading

gitguardian Bot commented May 7, 2026 •

edited

Loading