Sign in with NobleID on DSpace

Register on NobleID

1. In Dashboard → OAuth apps, register a confidential app. You need two-step login on your NobleID to do this.
2. Add this redirect URI, with your own host:
   https://repo.example.org/server/api/authn/oidc
   Register exactly the value your dspace.server.url produces, followed by /api/authn/oidc.
3. Tick these scopes: OpenID (always on), Profile profile, Email email. The platform asks for these, and sign-in stops if it asks for a scope the app does not have.
4. Copy the client ID and the client secret. The secret is shown once.

The app works at once. Until NobleID verifies it, people see a “not verified” notice on the consent screen.

How DSpace's OIDC login behaves

Read this before you turn it on:

• It sends the client secret in the request body (client_secret_post), then reads the person from the userinfo endpoint. It does not read the ID token, so ES256 needs no setting.
• It sends no state, nonce or PKCE, and nothing can be configured to add them.
• It finds the DSpace account (EPerson) by email, not by sub, and does not read email_verified. A NobleID account with an unconfirmed email would sign in as the EPerson with that address. That includes administrators.
• If the person unticks email on NobleID's consent screen, DSpace refuses the sign-in.
• Signing out ends the DSpace session only.

Recommended: put Keycloak in front (Keycloak guide). Keycloak runs the sign-in with state, nonce and PKCE. It keeps unconfirmed emails out only if you turn on Trust Email on the NobleID identity provider and Realm settings → Login → Verify email in the realm DSpace uses. Then point DSpace at Keycloak, not NobleID: set the three endpoints below to https://sso.example.org/realms/<realm>/protocol/openid-connect/auth, …/token and …/userinfo. DSpace's defaults use the old /auth/realms/ path, which Keycloak 17 and later do not use by default.

Connect DSpace to NobleID directly only where no existing EPerson matters: a test instance, or a repository with no local accounts (and no administrators) whose email someone else could use.

Configure

Add to [dspace]/config/local.cfg, then restart the backend. The Angular UI shows the OIDC login option once the REST API reports it.

# Keep password login and add OIDC. Repeating the key appends a method.
plugin.sequence.org.dspace.authenticate.AuthenticationMethod = org.dspace.authenticate.PasswordAuthentication
plugin.sequence.org.dspace.authenticate.AuthenticationMethod = org.dspace.authenticate.OidcAuthentication

# Full endpoint URLs. Leave auth-server-url and auth-server-realm unset.
authentication-oidc.authorize-endpoint = https://www.nobleid.org/oauth/authorize
authentication-oidc.token-endpoint = https://id.nobleid.org/oauth/token
authentication-oidc.user-info-endpoint = https://id.nobleid.org/oauth/userinfo

authentication-oidc.client-id = nbcl_your_client_id
# Better: leave this out of local.cfg and set the environment variable
#   authentication__D__oidc__P__client__D__secret=nbcs_your_client_secret
authentication-oidc.client-secret = nbcs_your_client_secret

# Must match the redirect URI registered with NobleID exactly.
authentication-oidc.redirect-url = ${dspace.server.url}/api/authn/oidc

# Comma-separated in DSpace config; sent space-separated.
authentication-oidc.scopes = openid,email,profile

# true: the first NobleID sign-in creates an EPerson. false: existing EPersons only.
authentication-oidc.can-self-register = false

authentication-oidc.user-info.email = email
authentication-oidc.user-info.first-name = given_name
authentication-oidc.user-info.last-name = family_name

• The class name is case-sensitive: OidcAuthentication, not OIDCAuthentication.
• Setting plugin.sequence… in local.cfg replaces the list in authentication.cfg, so list every method you want to keep.
• DSpace has no discovery URL, issuer, JWKS or logout setting. It uses only the three endpoints above.
• orcid, works and affiliations add nothing in DSpace. It maps only email, first name and last name.

Fill the profile from NobleID

DSpace reads only these three. Ticking ORCID iD or Affiliations on your app adds nothing here.

Every claim, and how to fill a profile without overwriting what people edit: Fill your app's profile from NobleID.

Before you go live

• Sign in once with your own NobleID. People need a first and last name on their NobleID profile to sign in; NobleID asks for it if it is missing.
• Key accounts on sub. Link to an existing account by email only when email_verified is true.
• Remove any localhost redirect URIs from the app.
• Keep the client secret out of version control.

NobleID values