Page History

This authorization delegate makes decisions based on the four basic roles of "metadata reader", "reader",  "writer", and  "admin".  These roles are assigned to principals on Fedora resources. Assigned roles are inherited through the repository tree until blocked by another assignment.

...

The permissions granted to these roles are fixed. Rather than consulting any declarative policy, this authorization delegate has hard-coded role-permission assignments in the source code.

Role/Permission Matrix

Configuring the Basic Role-Based Authorization Delegate

...

Edit your repo.xml file to configure the authentication provider.  The file should contain these three beans, as shown:

<bean name="modeshapeRepofactory" class="org.fcrepo.kernel.spring.ModeShapeRepositoryFactoryBean"
  depends-on="authenticationProvider">
    <property name="repositoryConfiguration" value="${fcrepo.modeshape.configuration:repository.json}" />
</bean>

<bean name="fad" class="org.fcrepo.auth.roles.basic.BasicRolesAuthorizationDelegate"/>

<bean name="authenticationProvider" class="org.fcrepo.auth.common.ServletContainerAuthenticationProvider">
    <property name="fad" ref="fad"/>
</bean>

Edit your repository.json file to enable an authenticated internal session between Fedora and ModeShape, so that the security section matches the example shown:

"security" : {
  "anonymous" : {
    "roles" : ["readonly","readwrite","admin"],
    "useOnFailedLogin" : false
  },
  "providers" : [
    { "classname" : "org.fcrepo.auth.common.ServletContainerAuthenticationProvider" }
  ]
},