...
The security bypass for REST endpoint is accomplished by supplying an alternate ModeShape authentication provider for servlet credentials. This servlet authentication provider permits all actions at the Modeshape level and does not use a PEP (Policy Enforcement Point).
Step-by-Step Configuration
- Open your Spring configuration file.
- Remove
- any beans that are instances of
org.fcrepo.auth.common.
ShiroAuthenticationProvider
.
- Also remove the PEP bean, if one was configured.
- Remove the
depends-on
attribute
- from the
modeshapeRepofactory
bean, if there is one.
- Remove the
- Open your web.xml file.
- Remove all occurences of "shiroFilter" (<filter> and <filter-mapping>)
- Comment out <security-constraint> and <login-config> sections
- Open your Modeshape repository configuration file (repository.json file).
- Under security, configure the
BypassSecurityServletAuthenticationProvider
- , as shown in the example below.
Code Block | ||||
---|---|---|---|---|
| ||||
"security" : { "anonymous" : { "roles" : ["readonly","readwrite","admin"], "useOnFailedLogin" : false }, "providers" : [ { "classname" : "org.fcrepo.auth.commonscommon.BypassSecurityServletAuthenticationProvider" } ] }, |
...