Basic Role-based PEP

This policy enforcement point (PEP) makes decisions based on the four basic roles of "metadata reader", "reader", "writer", and "admin". These roles are assigned to principals on Fedora objects and datastreams. Assigned roles are inherited through the repository tree until blocked by another assignment.

This PEP makes use of the Access Roles Module to assign and query roles in the repository.

Roles

• metadata reader - can retrieve information about Fedora objects, but cannot retrieve content
• reader - can retrieve information about Fedora objects, including content
• writer - all permissions of reader; can create, modify and delete Fedora objects
• admin - all permissions of writer; can modify the roles assigned to Fedora objects

Policy

The permissions granted to these roles are fixed. This PEP makes decisions in Java code, rather than consulting any kind of declarative policy. If more nuanced roles or policies are required, then you can switch to the Local XACML Role-based PEP and reuse the roles you have already assigned in your repository.

Role/Permission Matrix

Configuring the Basic Role-Based PEP

See Authorization Delegates for more information on how a PEP is configured.

Edit your repo.xml file to configure the Basic Role-based PEP authentication provider.  The file should contain these three beans, as shown:

<bean name="modeshapeRepofactory" class="org.fcrepo.kernel.spring.ModeShapeRepositoryFactoryBean"
  depends-on="authenticationProvider">
    <property name="repositoryConfiguration" value="${fcrepo.modeshape.configuration:repository.json}" />
</bean>

<bean name="pep" class="org.fcrepo.auth.roles.basic.BasicRolesPEP"/>

<bean name="authenticationProvider" class="org.fcrepo.auth.ServletContainerAuthenticationProvider ">
  <property name="pep" ref="pep"/>
</bean>

Edit your repository.json file to enable an authenticated internal session between Fedora and ModeShape, such that the security section matches the example shown:

"security" : {
  "anonymous" : {
    "roles" : ["readonly","readwrite","admin"],
    "useOnFailedLogin" : false
  },
  "providers" : [
    { "classname" : "org.fcrepo.auth.ServletContainerAuthenticationProvider" }
  ]
},