...
| Excerpt |
|---|
| Fedora 4 authorization is designed to be fine grained, while at the same time manageable by administrators and end users. Authentication is tied to managed by the servlet container or OAuth tokensexternally, but authorization mechanisms are open to extension and many reference implementations are included. Roles-based access control is an included feature that makes permissions more manageable and at the same time easier for external applications to retrieve, index and enforce. Finer grained security checks have no impact on the performance of requests that have a Fedora administrator role. |
Use Cases
- Researcher Researchers control the polices on their own objects
- Distributed authentication and authorization
- University of North Carolina at Chapel Hill
- Unified Authorization
- Setting Individual Permissions
- Yale University
- Fedora managing access conditions
- Programmers use API for access condition support in external systems, i.e. HydraTitle (goal)
- Applications use API for updating access conditions stored in Fedora
- University of Wisconsin - Madison
- Islandora
- Hydra
- Avalon Media System
...
Fedora supports both end users and application users. It is helpful to feed both local and forwarded security credentials into a same pipeline for extracting security principals that are the basis for authorization.
The ability to forward credentials in request headers must be restricted to specific users:
- In servlet container authentication, forwarding with require the container role of fedoraProxy.
- In OAuth token authentication, the token must include the scope forward credentials.
Access Roles API
The access roles API allows you manage the assignment of access roles throughout the repository tree. For details, please see the Access Roles Module.
...
| Info | ||
|---|---|---|
| ||
A policy enforcement point enforces appropriate access for fedora Fedora users and their proxies, i.e. applications acting on their behalf. One policy enforcement point may be configured at a time. |
...
| Info | ||
|---|---|---|
| ||
In Development: The XACML PEP forwards authorization requests to a XACML policy decision point. It is aware of access roles and may also make determinations on the basis of a wide range of Fedora object and datastream resource properties. Policy sets may be customized for different part of the repository tree. For detail please see the XACML Authorization Delegate. |
Authorization for Non-Node REST API
These endpoints in the REST API will require the fedoraAdmin container role or the fedora administrator OAuth token scope:
...
/rest/fcr:tx
...
* or OAuth token with equivalent scope
OAuth 2.0
...
. |
...