Versions Compared

Old Version 7

changes.mady.by.user Peter Eichman

Saved on

compared with

New Version 8

changes.mady.by.user Peter Eichman

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. The user userA can Read document foo

    Code Block
    languagetext
    @prefix acl: <http://www.w3.org/ns/auth/acl#>

<#auth1> a acl:Authorization ;
    acl:accessTo </fcrepo/rest/foo> ;
    acl:mode acl:Read;
    acl:agent "userA" .


  2. Users in NewsEditor group can Write to any resource of type ex:News

    Code Block
    languagetext
    @prefix acl: <http://www.w3.org/ns/auth/acl#> .
@prefix ex: <http://example.org/ns#> .

<#auth2> a acl:Authorization ;
    acl:accessToClass ex:News ;
    acl:mode acl:Read, acl:Write;
    acl:agentClass <fcrepo</fcrepo/rest/agents/NewsEditors> .


    Code Block
    languagetext
    title/agents/NewsEditors
    @prefix foafvcard: <http://xmlnswww.w3.comorg/foaf2006/0.1vcard/>ns#> .

<> a foafvcard:Group;
    foafvcard:memberhasMember "editor1", "editor2".


  3. The user userB can Read document foo (This involves setting a system property for the servlet container, e.g. -Dfcrepo.auth.webac.userAgent.baseUri=http://example.org/agents/)

    Code Block
    languagetext
    @prefix acl: <http://www.w3.org/ns/auth/acl#>

<#auth3> a acl:Authorization ;
    acl:accessTo </fcrepo/rest/foo> ;
    acl:mode acl:Read;
    acl:agent <http://example.org/agents/userB> .


Protecting Resources

A Any resource specifies the location of its ACL using the acl:accessControl propertyin the repository may have its own ACL. The location of that (potential) ACL is given in a Link HTTP header with rel="acl". If a resource itself does not specify an its own ACL, its parent containers are inspected, and the first specified ACL found is used as the ACL for the requested resource. If no ACLs are found, a filesystem-based ACL will be checked, the default policy of which is to deny access to the requested resource.

The standard location for a resource's ACL is the fcr:acl child of that resource, but clients should not rely on this behavior and always "follow their nose" by checking the Link header.

Example Scenarios

These scenarios assume that Fedora has been configured to use fcrepo.auth.webac.userAgent.baseUri=http://example.org/agent/ and fcrepo.auth.webac.groupAgent.baseUri=http://example.org/group/

...