Sign in with NobleID on Dataverse

Register on NobleID

1. In Dashboard → OAuth apps, register a confidential app. You need two-step login on your NobleID to do this.
2. Add this redirect URI, with your own host:
   https://dataverse.example.org/oauth2/callback.xhtml
   Your dataverse.siteUrl followed by /oauth2/callback.xhtml, including any port, unless the :OAuth2CallbackUrl setting overrides it.
3. Tick these scopes: OpenID (always on), Profile profile, Email email. The platform asks for these, and sign-in stops if it asks for a scope the app does not have.
4. Copy the client ID and the client secret. The secret is shown once.

The app works at once. Until NobleID verifies it, people see a “not verified” notice on the consent screen.

How Dataverse's OIDC login behaves

• It reads NobleID's discovery document from the issuer, so it finds the authorization endpoint on www.nobleid.org itself.
• It asks for openid email profile. The list is fixed in code.
• It authenticates with client_secret_basic. With PKCE on, it also sends the S256 challenge. It sends state and a nonce.
• It reads the person from the userinfo endpoint and does not check the ID token, so ES256 needs no setting. For the same reason the nonce is never checked.
• The account is keyed on sub. Name, username and email prefill the account-creation page on the first sign-in. It does not link to an existing local account by email.
• Signing out is local. No logout setting is needed.

Option A: JVM or environment settings (one provider)

The simplest route for a single provider. Changes need a restart.

As JVM options the names are dataverse.auth.oidc.enabled, .auth-server-url, .client-id, .client-secret, .pkce.enabled, .pkce.method, .title and .subtitle. The server URL is the issuer, without /.well-known/…: Dataverse adds it.

Option B: admin API (one of several providers)

{
  "id": "nobleid",
  "factoryAlias": "oidc",
  "title": "NobleID",
  "subtitle": "Sign in with NobleID",
  "factoryData": "type: oidc | issuer: https://id.nobleid.org | clientId: nbcl_your_client_id | clientSecret: nbcs_your_client_secret | pkceEnabled: true | pkceMethod: S256",
  "enabled": true
}

curl -X POST -H 'Content-type: application/json' \
  --upload-file nobleid.json \
  http://localhost:8080/api/admin/authenticationProviders

The file holds the client secret: delete it after loading. Watch the server log. Dataverse fetches the discovery document on load and turns the provider off if it cannot.

orcid, works and affiliations cannot be requested, because the scope list is fixed. If the person unticks email, they type an email on Dataverse's account-creation page instead.

Fill the profile from NobleID

Dataverse fills these on the account-creation page at the first sign-in. The person can change them there.

Its scope list is fixed, so its Affiliation and ORCID fields are not filled from NobleID.

Every claim, and how to fill a profile without overwriting what people edit: Fill your app's profile from NobleID.

Before you go live

• Sign in once with your own NobleID. People need a first and last name on their NobleID profile to sign in; NobleID asks for it if it is missing.
• Key accounts on sub. Link to an existing account by email only when email_verified is true.
• Remove any localhost redirect URIs from the app.
• Keep the client secret out of version control.

NobleID values