Overview

The following sections explain the Fedora AuthN/Z framework, and provide instructions for configuring some out-of-the-box access controls.

For clarity's sake, a distinction is made between Authentication and Authorization:

• Authentication answers the question "who is the person, and how do I verify that they are who they say they are?"  Fedora relies on the web servlet container to answer this question.
• Authorization answers the question, "does this person have permission to do what they want to do?".  Fedora provides two different ways to answer this question:
  • Bypass authorization: Anyone who has authenticated through the web application container (Tomcat, Jetty, WebSphere, etc.) has permission to do everything – in effect all, authenticated users are superusers.
  • WebAC authorization: Authenticated users' access to resources is mediated by WebAC Access Control Lists stored in the repository.

Servlet Container Authentication Configuration

Bypass Authorization

WebAC Authorization