By default, most deployments of Fedora have WebAC enabled. In order to disable WebAC, you will need to update two configuration files.
fcrepo-config.xml
The spring context file used by Fedora needs to be updated to disable all of the shiro and WebAC related beans. See the following gist for the default fcrepo-config.xml overridden to disable WebAC:
https://gist.github.com/bbpennel/852344543eb3c54a01a20a7768fb04d4
See the revisions view for a comparison of the changes.
To configure fedora to use the updated version of fcrepo-config.xml, see the Configuration Options Inventory documentation.
web.xml
Next, the web.xml file must be overridden to remove the webac components. See the following version of the file, which is used by the jetty console version of Fedora:
Additionally, basic authentication can be enabled with WebAC turned off but uncommenting the basic auth section of this file.
For comparison, here is the default version of this file included in most deployments.
Overriding web.xml in Jetty
Jetty provides a mechanism for overriding the web.xml in a war file without having to modify the war file. This can be done using a WebAppContext configuration file, using the descriptor tag as in the example below:
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd"> <Configure class="org.eclipse.jetty.webapp.WebAppContext"> <Set name="contextPath">/fcrepo</Set> <Set name="descriptor">/path/to/new/web.xml</Set> </Configure>
