Overview
The Fedora 4 Authentication (AuthN) and Authorization (AuthZ) framework is designed to be flexible and extensible, to allow any organization to configure access to suit its needs.The following sections explain the Fedora 4 AuthN/Z framework, and provide instructions for configuring some out-of-the-box access controls.
For clarity's sake, a distinction is made between Authentication and Authorization:
- Authentication answers the question "who is the person, and how do I verify that they are who they say they are?" Fedora 4 relies on the web servlet container to answer this question.
- Authorization answers the question, "does this person have permission to do what they want to do?". Fedora 4 provides four different ways to answer this question:
- Bypass authorization. Anyone who has authenticated through the web application container (Tomcat, Jetty, WebSphere, etc.) has permission to do everything – in effect all, authenticated users are superusers.
- WebAC authorizations. Authenticated users' access to resources is mediated by WebAC Access Control Lists stored in the repository.
- [Deprecated] Basic Access Roles authorizations (RBACL). Authenticated users are mapped onto one or more preconfigured roles; a user's role determines what they have permission to do.
- [Deprecated] XACML authorizations. Policies created using the XACML framework are used to determine what operations are permissible to whom, using user and resource properties exposed to the XACML engine.
Servlet Container Authentication Configuration
Container Roles
Fedora uses two container roles to determine its authorization behavior. The superuser role is fedoraAdmin. Users with this role are not subject to any further authorization checks, and thus can perform any operations on the repository. This is comparable to the fedoraAdmin superuser role in Fedora 3, used for Fedora 3 API-M operations. The regular user role is fedoraUser. Users with this role are subject to authorization checks by the Web Access Control system. The exact permissions any regular user has are determined per request by looking at the effective ACL of the requested resource, the requesting user's security principals, and the nature of the request (HTTP method, content-type, etc.).
Configure your repo.xml file
See the sample Spring configuration for setting up a repo.xml to use servlet container authentication.
To specify a local repo.xml configuration, provide the system property as follows:
JAVA_OPTS="... -Dfcrepo.spring.repo.configuration=file:/local/repo.xml"
Configure your repository.json file
Modify the security section to enable both authenticated (via authentication provider) and internal sessions between Fedora and ModeShape.
It should contain a "security" element that matches this block:
"security" : { "anonymous" : { "roles" : ["readonly","readwrite","admin"], "useOnFailedLogin" : false }, "providers" : [ { "classname" : "org.fcrepo.auth.common.ShiroAuthenticationProvider" } ] },
To specify a local repository.json configuration, provide the system property as follows:
JAVA_OPTS="... -Dfcrepo.modeshape.configuration=file:/local/repository.json"
Configure your web.xml
Configure your web.xml. Modify fcrepo-webapp/src/main/webapp/WEB-INF/web.xml by uncommenting the security configuration:
<!--Uncomment section below to enable Basic-Authentication--> <security-constraint> <web-resource-collection> <web-resource-name>Fedora4</web-resource-name> <url-pattern>/*</url-pattern> <http-method>DELETE</http-method> <http-method>PUT</http-method> <http-method>HEAD</http-method> <http-method>OPTIONS</http-method> <http-method>PATCH</http-method> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>fedoraUser</role-name> <role-name>fedoraAdmin</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>NONE</transport-guarantee> </user-data-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>fcrepo</realm-name> </login-config>
Configure your web application container
Jetty
- Create your jetty-users.properties file. This file contains entries in the format username: password [, role, ...], where
- username is the user's login id (the principal)
- password is the user's password
- role is the servlet role they are assigned upon login; jetty allows you to specify any number of roles (or no role at all).
- Sample jetty-users.properties file that contains three users, two of whom are regular users, and the third of whom (fedoraAdmin) is a Fedora superuser:
testuser: password1,fedoraUser adminuser: password2,fedoraUser fedoraAdmin: secret3,fedoraAdmin
- Configure your Jetty login realm.
Standalone: Modify your jetty.xml file to configure the login realm and include the jetty-users.properties file:
jetty.xml login service<Configure class="org.eclipse.jetty.webapp.WebAppContext"> <!-- Set this to the webapp root of your Fedora 4 repository --> <Set name="contextPath">/</Set> <!-- Set this to the path of of fcrepo4 WAR file --> <Set name="war"><SystemProperty name="jetty.home" default="."/>/webapps/fcrepo4</Set> <Get name="securityHandler"> <Set name="loginService"> <New class="org.eclipse.jetty.security.HashLoginService"> <Set name="name">fcrepo4</Set> <!-- Set this to the path to your jetty-users.properties file --> <Set name="config"><SystemProperty name="jetty.home" default="."/>/path/to/jetty-users.properties</Set> </New> </Set> </Get> </Configure>
Embedded in Maven: The fcrepo-webapp Maven project includes jetty-maven-plugin. The property jetty.users.file sets the location of the jetty-users.properties file. Run the fcrepo-webapp server with the following system property:
-Djetty.users.file=/path/to/jetty-users.properties
- See the Jetty Authentication documentation for more details.
Tomcat
- Create or edit your
$CATALINA_HOME/conf/tomcat-users.xml
file. It has entries of the form<user name="principal" password="password" roles="role1, role2, ..." />
where:
- name is the user's login id (the principal)
- password is the user's password
- roles are the servlet roles they are assigned upon login; tomcat allows you to specify any number of roles (or no role at all).
Sample tomcat-users.xml file that contains three users, two of whom are regular users, and the third of whom (fedoraAdmin) is a Fedora superuser:
tomcat-users.xml<tomcat-users> <role rolename="fedoraUser" /> <role rolename="fedoraAdmin" /> <user name="testuser" password="password1" roles="fedoraUser" /> <user name="adminuser" password="password2" roles="fedoraUser" /> <user name="fedoraAdmin" password="secret3" roles="fedoraAdmin" /> </tomcat-users>
Configure your Tomcat login realm. Modify your file
$CATALINA_HOME/conf/server.xml
file to configure the login realm with the Fedora webapp context:server.xml<Context> ... <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" /> ... </Context>
- See the Tomcat Realms documentation for more details.
Bypass Authorization
This configuration does not preclude the use of container authentication to secure Fedora. However, container roles are not used for any further authorization within Fedora. All requests are treated as superusers.
The security bypass for REST endpoint is accomplished by supplying an alternate ModeShape authentication provider. This provider permits all actions at the Modeshape level.
Step-by-Step Configuration
- Open your Spring configuration file.
- Remove any beans that are instances of
org.fcrepo.auth.common.ShiroAuthenticationProvider
. - Remove the
depends-on
attribute from themodeshapeRepofactory
bean, if there is one.
- Remove any beans that are instances of
- Open your web.xml file.
- Remove all occurences of "shiroFilter" (<filter> and <filter-mapping>)
- Comment out <security-constraint> and <login-config> sections
- Open your Modeshape repository configuration file (repository.json).
- Under security, configure the
BypassSecurityServletAuthenticationProvider
, as shown in the example below.
- Under security, configure the
"security" : { "anonymous" : { "roles" : ["readonly","readwrite","admin"], "useOnFailedLogin" : false }, "providers" : [ { "classname" : "org.fcrepo.auth.common.BypassSecurityServletAuthenticationProvider" } ] },