How to Configure Servlet Container Authentication

Fedora 4 uses servlet container authentication (Realms) to provide minimal protection for your repository with a master "superuser" user and password.  The superuser credentials are configured in your web application container's properties file;  once configured, all management (write) operations will require authentication.  This document describes how to set up Fedora to enable HTTP Basic Authentication.

The superuserrole is fedoraAdmin.  This is comparable to the fedoraAdmin superuser role in Fedora 3, used for Fedora 3 API-M operations.

1. Configure your repo.xml file

   Add the beans authenticationProvider and pep to your repo.xml file, and make the modeshapeRepofactory bean dependent on authenticationProvider.  Use the class org.fcrepo.auth.ServletContainerAuthenticationProvider as your authentication provider.  Here is an example repo.xml that configures authentication and authorization using the Basic Roles PEP:

   repo.xml with authentication configured

       <bean name="modeshapeRepofactory"
           class="org.fcrepo.kernel.spring.ModeShapeRepositoryFactoryBean"                                                                                        
           p:repositoryConfiguration="${fcrepo.modeshape.configuration:classpath:/config/rest-sessions/repository.json}"                                          
           depends-on="authenticationProvider"/>                                                                                                                  
                                                                                                                                                                  
       <bean name="pep" class="org.fcrepo.auth.roles.basic.BasicRolesPEP"/>                                                                                       
                                                                                                                                                                  
       <bean name="authenticationProvider" class="org.fcrepo.auth.ServletContainerAuthenticationProvider">                                                        
           <property name="pep" ref="pep"/>                                                                                                                       
       </bean>
   
   

2. Configure your repository.json file

   Add or modify the security section to enable an authenticated internal session between Fedora and ModeShape.  It should match this block:

   repository.json security

   "security" : {        
           "anonymous" : {
               "roles" : ["readonly","readwrite","admin"],
               "useOnFailedLogin" : false
           },
           "providers" : [
               { "classname" : "org.fcrepo.auth.ServletContainerAuthenticationProvider" }
           ]
       },

3. Configure your web application container

• Jetty

  • Create your jetty-users.properties file.  This file contains entries in the format username:  password [, role, ...], where

    • username is the user's login id (the principal)
    • password is the user's password
    • role is the servlet role they are assigned upon login;  jetty allows you to specify any number of roles (or no role at all).  Fedora currently supports two roles:  fedoraAdmin, which is the superuser role, and has rights to do everything;  and fedoraUser, which is a user role, and must be granted permissions to perform actions.

    Sample jetty-users.properties file that contains three users, two of whom are regular users, and the third of whom (fedoraAdmin) is a Fedora superuser:

    jetty-users.properties

    testuser: password1,fedoraUser
    adminuser: password2,fedoraUser
    fedoraAdmin: secret3,fedoraAdmin

  • Configure your Jetty login realm.

    • Standalone
      Modify your jetty.xml file to configure the login realm and include the jetty-users.properties file:

      jetty.xml login service

      <Configure class="org.eclipse.jetty.webapp.WebAppContext">
        
        <!-- Set this to the webapp root of your Fedora 4 repository -->
        <Set name="contextPath">/</Set>
        <!-- Set this to the path of of fcrepo4 WAR file -->
        <Set name="war"><SystemProperty name="jetty.home" default="."/>/webapps/fcrepo4</Set>
       
        <Get name="securityHandler">
          <Set name="loginService">
            <New class="org.eclipse.jetty.security.HashLoginService">
              <Set name="name">fcrepo4</Set>
              <!-- Set this to the path to your jetty-users.properties file -->
              <Set name="config"><SystemProperty name="jetty.home" default="."/>/path/to/jetty-users.properties</Set>
            </New>
          </Set>
        </Get>
       
      </Configure>
      
      
      

Fedora4 uses the org.eclipse.jetty.security.HashLoginService Jetty login service.

See the Jetty Authentication documentation for more details. 

Tomcat

Related articles