Introduction
Fedora security configuration via spring was introduced in Fedora 3.5. In general, security in Fedora is provided by a series of servlet filters. Each filter provides some security-related purpose, such as policy enforcement, authentication, or ssl redirection. The set of active security-related filters and their individual configuration settings is determined by Spring, using configuration files present in FEDORA_HOME/server/config/spring/web/. This method of configuring security replaces the pre-3.5 technique of specifying security-related servlet filters directly in web.xml.
Important files and directories
FEDORA_HOME/server/config/spring/web/: Any spring xml file present in this directory will be loaded into the web application context. The web application context in 3.5 is distinct from the fedora server context, so all beans relevant to servlet filters must be present inFEDORA_HOME/server/config/spring/web/.FEDORA_HOME/server/config/spring/web/security.xml: Default spring bean xml file containing security configuration. The contents of this file are initially determined by the fedora installer.FEDORA_HOME/server/config/spring/web/web.properties: Contains properties and values that are substituted into any spring beans at runtime. All spring beans defined in the web application context are pre-processed with a PropertyPlaceholderConfigurer.
Unimportant files and directories
FEDORA_HOME/server/config/spring/web/alt: Directory containing additional or alternate configuration files that are not active by default. This directory is ignored by spring. Nothing in this directory will be parsed into the web application context.
FEDORA_HOME/server/config/spring/web/alt/security-complicated.xml: The existingsecurity.xmlfile tries to emulate the classic behaviour of Fedora with regard to SSL requirements on certain resources. In the process of doing so, the list of resources considered "access" or "management" for purposes of requiring SSL seemed inconsistent with their documentation as access or management methods, especially when considering the REST API. This file defines security behaviour that can be considered "more correct", but may not match the current expectations/assumptions of fedora clients and thus is disabled by default.
Configuration settings
As mentioned earlier, security in Fedora is achieved through the action of servlet filters. A single DelegatingFilterProxy filter for security is defined in web.xml. This filter is configured to delegate to a FilterChainProxy, which forms the core of spring security in Fedora. This FilterChainProxy can be configured to apply any number of servlet filters based upon certain criteria such as URL path. Configuring security in Fedora, then, is a matter of choosing which servlet filters are applied to which resource URLs. Each servlet filter is itself a bean which is instantiated through Spring, and may have its own configuration and collaborators defined through spring beans. The result is a flexible