...
You also have the option of creating your own PEP implementation and performing security checks differently, possibly including calls to remote services. For guidelines on implementing the PEP extension point, please see How to implement a Fedora Policy Enforcement Point (PEP).
Two files contain the configuration options for the PEP extension:
- repo.xml: the global repository configuration file. Three beans enable the PEP extension:
- modeshapeRepoFactory: should contain a dependency on the authenticationProvider bean
- authenticationProvider: should specify the ServletContainerAuthenticationProvider class, so that the servlet container handles authentication
- This bean should have a property "pep" that points to the pep bean, to enable the servlet container authentication provider to use the PEP
- pep: should point to your class with the PEP implementation
- repository.json: the ModeShape configuration file. It contains a security section, where the internal session authentication between Fedora and the ModeShape storage layer is configured. Note that the roles configured here do not apply to end user authentication and authorization..
Step-by-step:
- Open the repo.xml file in your Fedora web application.
- Add your PEP implementation as a bean in this file and give it the id of "pep". Your PEP bean may include more specific configuration details than the example.
- Now add the Fedora ModeShape Authentication Provider bean. (see repo.xml example)
- Make sure that your modeshapeRepofactory bean has the depends-on attribute pointing at the authenticationProvider (see repo.xml example).
- Open your repository.json file.
- Add org.fcrepo.auth.ServletContainerAuthenticationProvider as a provider in the security section. (see repository.json example)
...