Workaround implementations.
The stock org.fcrepo.server.security.jaas.auth.module.XmlUsersFileModule class uses the Xerces XML parser between multiple thread; however, this parser is not thread safe. This results in a race condition that can prevent users specific in the XML file from being able to login.
FEDORA_VERSION="3.6.2"
# We are dependent on the islandora_drupal_filter, so install into the local
# Maven repo.
git clone git@github.com:Islandora/islandora_drupal_filter.git
cd islandora_drupal_filter
mvn -Dfedora.version=$FEDORA_VERSION install
cd ..
# Now, let's get ourselves built.
git clone git@github.com:discoverygarden/fcrepo3-security-jaas.git
cd fcrepo3-security-jaas
mvn package -Dfedora.version=$FEDORA_VERSIONBuilds against 3.6.2 and generates a JAR in fcrepo3-security-jaas/target.
- Drop both built JARs (from both
islandora_drupal_filterandfcrepo3-security-jaas) into your$CATALINA_HOME/webapps/fedora/WEB-INF/lib
After installing the JAR:
- Update references in your
$FEDORA_HOME/server/config/jaas.conffromorg.fcrepo.server.security.jaas.auth.module.XmlUsersFileModuletoca.discoverygarden.fcrepo3.security.jaas.module.XmlUsersFileModule. - If Fedora is running, restart it so it picks up the new configuration.
The original DrupalAuthModule implementation requires iterating through all configured connection when authenticating users, and for repositories connected to many sites, this iteration can be slow (and unavailable sites may even result in timeouts); therefore, it is desirable if it was possible to more directly select which against which to attempt authentication.
The DrupalMultisiteAuthModule looks for key attributes on each connection element, which must match the key obtained from the HTTP request in our ca.discoverygarden.fcrepo3.security.jaas.filter.AuthFilterJAAS implementation (by default, the User-Agent header because it is easily modified for requests from Tuque; configurable to other headers using the keyHeader property in the Spring bean configuration).
See the documentation for more details.
Having problems or solved a problem? Contact discoverygarden.
Current maintainers:
If you would like to contribute to this module, please contact us at discoverygarden.