Running Fedora without authorization means that the REST API is available to any request coming from the container and lacks any finer-grained security. This is useful when Fedora is running behind another application that connects to Fedora and implements its own security checks. This configuration is also useful for temporary demonstrations and for running software tests that do not require security.
Disabling auth authorization in Fedora does not preclude the use of container authentication to secure Fedora. However, container roles are not used for any further authorization within Fedora. All requests are treated as superusers.
Auth is disabled by default in the Jetty one-click version of Fedora.
Tomcat
Add an entry to your server.xml that instructs the webapp to load a different web.xml. Assuming Fedora is deployed as the fcrepo webapp, the entry should look like this:
...
| language | xml |
|---|---|
| title | server.xml |
...
To disable authorization simple set the fcrepo.auth.enabled configuration property to false, using either a configuration file or -D argument.