Fedora 4 uses servlet container authentication (Realms) to provide minimal protection for your repository with a master "superuser" user and password. The superuser credentials are configured in your web application container's properties file; once configured, all management (write) operations will require authentication. This document describes how to set up Fedora to enable HTTP Basic Authentication, using simple file-based users. Consult your web application server documentation for other ways to configure and manage users; Fedora can handle any principal passed to it by the servlet container, as provisioned by any of the container's supported authentication mechanisms.
The superuserrole is fedoraAdmin. This is comparable to the fedoraAdmin superuser role in Fedora 3, used for Fedora 3 API-M operations.
Add the beans authenticationProvider and pep to your repo.xml file, and make the modeshapeRepofactory bean dependent on authenticationProvider. Use the class org.fcrepo.auth.ServletContainerAuthenticationProvider as your authentication provider. Here is an example repo.xml that configures authentication and authorization using the Basic Roles PEP:
<bean name="modeshapeRepofactory" class="org.fcrepo.kernel.spring.ModeShapeRepositoryFactoryBean" p:repositoryConfiguration="${fcrepo.modeshape.configuration:classpath:/config/rest-sessions/repository.json}" depends-on="authenticationProvider"/> <bean name="pep" class="org.fcrepo.auth.roles.basic.BasicRolesPEP"/> <bean name="authenticationProvider" class="org.fcrepo.auth.ServletContainerAuthenticationProvider"> <property name="pep" ref="pep"/> </bean> |
Add or modify the security section to enable an authenticated internal session between Fedora and ModeShape. It should match this block:
"security" : { "anonymous" : { "roles" : ["readonly","readwrite","admin"], "useOnFailedLogin" : false }, "providers" : [ { "classname" : "org.fcrepo.auth.ServletContainerAuthenticationProvider" } ] }, |
Create your jetty-users.properties file. This file contains entries in the format username: password [, role, ...], where
Sample jetty-users.properties file that contains three users, two of whom are regular users, and the third of whom (fedoraAdmin) is a Fedora superuser:
testuser: password1,fedoraUser adminuser: password2,fedoraUser fedoraAdmin: secret3,fedoraAdmin |
Standalone
Modify your jetty.xml file to configure the login realm and include the jetty-users.properties file:
<Configure class="org.eclipse.jetty.webapp.WebAppContext"> <!-- Set this to the webapp root of your Fedora 4 repository --> <Set name="contextPath">/</Set> <!-- Set this to the path of of fcrepo4 WAR file --> <Set name="war"><SystemProperty name="jetty.home" default="."/>/webapps/fcrepo4</Set> <Get name="securityHandler"> <Set name="loginService"> <New class="org.eclipse.jetty.security.HashLoginService"> <Set name="name">fcrepo4</Set> <!-- Set this to the path to your jetty-users.properties file --> <Set name="config"><SystemProperty name="jetty.home" default="."/>/path/to/jetty-users.properties</Set> </New> </Set> </Get> </Configure> |
Embedded in Maven
-Djetty.users.file=/path/to/jetty-users.properties
See the Jetty Authentication documentation for more details.
$CATALINA_HOME/conf/tomcat-users.xml
file. It has entries of the form<user name="principal" password="password" roles="role1, role2, ..." />
where:
Sample tomcat-users.xml file that contains three users, two of whom are regular users, and the third of whom (fedoraAdmin) is a Fedora superuser:
<tomcat-users> <user name="testuser" password="password1" roles="fedoraUser" /> <user name="adminuser" password="password2" roles="fedoraUser" /> <user name="fedoraAdmin" password="secret3" roles="fedoraAdmin" /> </tomcat-users> |
Configure your Tomcat login realm.
Modify your file $CATALINA_HOME/conf/server.xml
file to configure the login realm with the Fedora 4 webapp context:
<Context> ... <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" /> </Context> |
Related articles appear here based on the labels you select. Click to edit the macro and add or change labels.