Old Release

This documentation covers an old version of Fedora. Looking for another version? See all documentation.

By default, most deployments of Fedora have WebAC enabled. In order to disable WebAC, you will need to update two configuration files.


The spring context file used by Fedora needs to be updated to disable all of the shiro and WebAC related beans. See the following gist for the default fcrepo-config.xml overridden to disable WebAC:


See the revisions view for a comparison of the changes.

To configure fedora to use the updated version of fcrepo-config.xml, see the Configuration Options Inventory documentation.


Next, the web.xml file must be overridden to remove the webac components. See the following version of the file, which is used by the jetty console version of Fedora:


Additionally, basic authentication can be enabled with WebAC turned off but uncommenting the basic auth section of this file.

For comparison, here is the default version of this file included in most deployments.

Overriding web.xml in Jetty

Jetty provides a mechanism for overriding the web.xml in a war file without having to modify the war file. This can be done using a WebAppContext configuration file, using the descriptor tag as in the example below:

<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
<Configure class="org.eclipse.jetty.webapp.WebAppContext">
  <Set name="contextPath">/fcrepo</Set>
  <Set name="descriptor">/path/to/new/web.xml</Set>

  • No labels