Versions Compared

Old Version 22

changes.mady.by.user Eric James

Saved on

compared with

New Version 23

changes.mady.by.user Andrew Woods

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Configure your repo.xml file

    Add the beans authenticationProvider and fad to your repo.xml file, and make the modeshapeRepofactory bean dependent on authenticationProvider.  Use the class org.fcrepo.auth.ServletContainerAuthenticationProvider as your authentication provider.  Here is an example repo.xml that configures authentication and authorization using the Basic Roles authorization delegate:

    Code Block
    languagexml
    titlerepo.xml with authentication configured
        <bean name="modeshapeRepofactory"
        class="org.fcrepo.kernel.spring.ModeShapeRepositoryFactoryBean"                                                                                        
        p:repositoryConfiguration="${fcrepo.modeshape.configuration:classpath:/config/rest-sessions/repository.json}"                                          
        depends-on="authenticationProvider"/>                                                                                                                  
                                             
    <!-- Optional PrincipalProvider that will inspect the request header, "some-header", for user role                                                                                                   values -->
    <bean name="fadheaderProvider" class="org.fcrepo.auth.rolescommon.basic.BasicRolesAuthorizationDelegateHttpHeaderPrincipalProvider"/>
      <property name="headerName" value="some-header"/>
      <property name="separator" value=","/>
    </bean>

    <util:set id="principalProviderSet">
      <ref bean="headerProvider"/>
                                                       
                                                                                                                                                               </util:set>

    <bean name="authenticationProvider" 
		class="org.fcrepo.auth.common.ServletContainerAuthenticationProvider">                                                        
        <property name="fad" ref="fad"/>
      <property                                                                                                                 name="principalProviders" ref="principalProviderSet"/>
    </bean>

  2. Configure your repository.json file

    Modify the security section to enable both authenticated (via authentication provider) and internal sessions between Fedora and ModeShape.  It should match this block:

    Code Block
    languageruby
    titlerepository.json security
    "security" : {        
        "anonymous" : {
            "roles" : ["readonly","readwrite","admin"],
            "useOnFailedLogin" : false
        },
        "providers" : [
            { "classname" : "org.fcrepo.auth.common.ServletContainerAuthenticationProvider" }
        ]
    },

  3. Configure your web.xml

    Configure your web.xml. If you are using the pre-packaged authorization war file (fcrepo-webapp-<version>-auth.war) then skip this step.

    Modify fcrepo-webapp/src/main/webapp/WEB-INF/web.xml by uncommenting the security configuration

    Code Block
      <!--Uncomment section below to enable Basic-Authentication-->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Fedora4</web-resource-name>
      <url-pattern>/*</url-pattern>
      <http-method>DELETE</http-method>
      <http-method>PUT</http-method>
      <http-method>HEAD</http-method>
      <http-method>OPTIONS</http-method>
      <http-method>PATCH</http-method>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>fedoraUser</role-name>
      <role-name>fedoraAdmin</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>fcrepo</realm-name>
  </login-config>

    Note, the "auth-constraint" element must contain the roles defined as your users (see below for jetty and tomcat).

  4. Configure your web application container

...