Syn

June 24, 2026 · View on GitHub

Introduction

A valve for Tomcat8 that authenticates the JWT tokens created by Islandora in order to provide sessionless Authentication for Fedora. Named after the Norse goddess Syn.

Requirements

This project requires Java 8 and can be built with Gradle. To build and test locally, use ./gradlew build.

Copy the JAR that was built above from build/libs/islandora-syn-X.X.X-all.jar and place into $TOMCAT_HOME/lib directory. Can be found in Ubuntu at: /var/lib/tomcat8/lib/. Note that this JAR is built to contain all the dependencies.

Register Valve

Now register the valve in Tomcat configuration file. In Ubuntu this file is located at: /var/lib/tomcat8/conf/context.xml

<Valve className="ca.islandora.syn.valve.SynValve" 
	  		 pathname="conf/syn-settings.xml" />

where:

pathname: The location of the settings file. Defaults to $CATALINA_BASE/conf/syn-settings.xml.

Enable `security-constraint`

The valve checks if requested URL is under security constraints. So, valve will activate only if the Fedora4 web.xml file contains something like:

<security-constraint>
    <web-resource-collection>
      <web-resource-name>Fedora4</web-resource-name>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>
<security-role>
    <role-name>islandora</role-name>
</security-role>
<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>fcrepo</realm-name>
</login-config>

On Ubuntu this file can be found at: /var/lib/tomcat8/webapps/fcrepo/WEB-INF/web.xml

Setup Syn Configuration

Modify the example configuration and move it to: $CATALINA_BASE/conf/syn-settings.xml.

Header principals

Additional roles are passed to Fedora via a HTTP header, this is configured via the header attribute to the <config> element in the syn-settings.xml.example file. You must also configure Fedora to read this header via its HeaderProvider.

Documentation

Further documentation for this module is available on the Islandora 8 documentation site.

Troubleshooting/Issues

Having problems or solved a problem? Check out the Islandora google groups for a solution.

Maintainers

Current maintainers:

Jared Whiklo

Support status

This project currently maintains two major release lines:

Version	Servlet namespace	Target runtime	Support status
`1.x`	`javax.*`	Tomcat 9	Supported for Tomcat 9 compatibility
`2.x`	`jakarta.*`	Tomcat 10+	Current development line

The 2.x release line is a breaking change because it moves from the legacy Java EE javax.* namespace to the Jakarta EE jakarta.* namespace required by Tomcat 10 and later. Users running Tomcat 9 should remain on the 1.x release line.

The 1.x release line will continue to receive critical fixes, including security fixes when practical, for as long as Tomcat 9.0.x remains supported upstream. Apache has announced that Tomcat 9.0.x support may end after March 31, 2027. After upstream Tomcat 9.0.x support ends, this project expects to end support for the 1.x release line and continue active support on 2.x.

Development

If you would like to contribute, please get involved by attending our weekly Tech Call. We love to hear from you!

If you would like to contribute code to the project, you need to be covered by an Islandora Foundation Contributor License Agreement or Corporate Contributor License Agreement. Please see the Contributors pages on Islandora.ca for more information.

We recommend using the islandora-playbook to get started.

License

MIT

Syn