Page History

...

The security bypass for REST endpoint is accomplished by supplying an alternate ModeShape authentication provider for servlet credentials. This servlet authentication provider permits all actions at the Modeshape level and does not use a PEP (Policy Enforcement Point).

Step-by-Step Configuration

1. Open your Spring configuration file.
   1. Remove
   If you previously configured a PEP, open your repo.xml file and remove
   1. any beans that are instances of
   "
   1. org.fcrepo.auth.common.
   ServletContainerAuthenticationProvider"Remove the
   1. ShiroAuthenticationProvider.
2. Also remove the PEP bean, if one was configured.
3. 1. Remove the depends-on attribute
   on the
   1. from the modeshapeRepofactory bean, if there is one.
4. Open your web.xml file.
   1. Remove all occurences of "shiroFilter" (<filter> and <filter-mapping>)
   2. Comment out <security-constraint> and <login-config> sections
5. Open your Modeshape repository configuration file (repository.json file).
   1. Under security, configure the
   "
   1. BypassSecurityServletAuthenticationProvider
   "
   1. , as shown in the example below.

"security" : {
  "anonymous" : {
    "roles" : ["readonly","readwrite","admin"],
    "useOnFailedLogin" : false
  },
  "providers" : [
    { "classname" : "org.fcrepo.auth.commonscommon.BypassSecurityServletAuthenticationProvider" }
  ]
},

...