GreenDIGIT access documentation

The platform accepts environmental-impact metrics and presents public or group-scoped dashboards.

Sign-in and authorisation

EGI Check-in is the primary institutional sign-in method. Local email/password sign-in remains a fallback for existing accounts. Authentication confirms who you are; local roles and memberships determine what you may do.

How to sign in with EGI Check-in

Open the GreenDIGIT sign-in page.
Select Sign in with EGI Check-in.
Authenticate with your institutional or EGI identity.
EGI returns you securely to GreenDIGIT. Users with dashboards_view continue to the private dashboards; other valid users see the access-request page.

publish: submit metrics to a group you belong to.
dashboards_view: view private dashboards, filtered to current memberships.
admin: administer platform roles and groups.

public is the fallback group. greendigit is private. A submission must include "group": "greendigit" (or another authorised group); the server derives the publisher identity.

EGI configuration

Variable	Source / sensitivity	Used by	Change
`EGI_OIDC_ISSUER`	EGI; public	auth proxy	restart proxy
`EGI_OIDC_CLIENT_ID`	EGI registration; identifier	auth proxy	restart proxy
`EGI_OIDC_CLIENT_SECRET`	EGI registration; secret when issued	auth proxy	restart proxy
`EGI_OIDC_REDIRECT_URI`, `EGI_OIDC_POST_LOGOUT_URI`	registration/deployment; public	auth proxy	restart proxy
`EGI_OIDC_SCOPE`	deployment; public	auth proxy	restart proxy
`EGI_GROUP_CLAIM`, `EGI_GROUP_MAPPINGS`	confirmed EGI claim and JSON mapping; public authorisation configuration	auth proxy	confirm first, then restart proxy
`EGI_REQUIRED_ENTITLEMENT`	optional confirmed EGI entitlement; public identifier	auth proxy	restart proxy
`JWT_GEN_SEED_TOKEN`	generated locally with a CSPRNG; secret	auth API and proxy	coordinated restart; invalidates sessions

Troubleshooting

“Invalid identity response” means signature, issuer, audience, expiry, nonce, or subject validation failed. “Temporarily unavailable” indicates discovery, token, JWKS, or UserInfo could not be reached. A confirmed identity sent here for access lacks a local role; contact support.

Recover an existing client in EGI client management: verify the exact callback URI and reuse the client ID. If the secret cannot be viewed, rotate it only through the authorised interface, store it only in the secret store or .env, test before revoking the old secret when overlap is supported, restart only the proxy, and record who rotated it and when—not the value.