Page History

...

Fedora uses two container roles to determine its authorization behavior. The superuser role is fedoraAdmin. Users with this role are not subject to any further authorization checks, and thus can perform any operations on the repository. This is comparable to the fedoraAdmin superuser role in Fedora 3, used for Fedora 3 API-M operations. The regular user role is fedoraUser. Users with this role are subject to authorization checks by the Web Access Control system. The exact permissions any regular user has are determined per request by looking at the effective ACL of the requested resource, the requesting user's security principals, and the nature of the request (HTTP method, content-type, etc.).

If you add additional container roles, then you will need to add these roles to the auth-constraint element in your web.xml. For example:

<web-app>
  ...
  <security-constraint>
    ...
    <auth-constraint>
      <role-name>fedoraUser</role-name>
      <role-name>fedoraAdmin</role-name>
      <role-name>newRoleExample</role-name>
    </auth-constraint>
  </securty-constraint>
</web-app>

...

Configure Container Users and Roles

Jetty

• Create a $JETTY_BASE/etc/jetty-users.properties file.  This file contains entries in the format username:  password [, role, ...], where
  • username is the user's login id (the principal)
  • password is the user's password
  • role is the servlet role they are assigned upon login;  jetty allows you to specify any number of roles (or no role at all).
• Sample jetty-users.properties file that contains three users, two of whom are regular users, and the third of whom (fedoraAdmin) is a Fedora superuser:

...

• Configure your Tomcat login realm. Modify your file $CATALINA_HOME/conf/server.xml file to configure the login realm with the Fedora webapp context:

  Code Block
  language xml title server.xml
  <Context> ... <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" /> ... </Context>

  
  

• See the Tomcat Realms documentation for more details.

...