...
Web Access Control (WebAC or WAC) is Fedora's system for authorizing requests for resources in the repository.
...
Definition
From the SOLID Web Access Control specification:
...
The user userA can Read document foo
Code Block language text @prefix acl: <http://www.w3.org/ns/auth/acl#> <#auth1> a acl:Authorization ; acl:accessTo </fcrepo/rest/foo> ; acl:mode acl:Read; acl:agent "userA" .
Users in NewsEditor group can Write to any resource of type ex:News
Code Block language text @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix ex: <http://example.org/ns#> . <#auth2> a acl:Authorization ; acl:accessToClass ex:News ; acl:mode acl:Read, acl:Write; acl:agentClass </fcrepo/rest/agents/NewsEditors> .
Code Block language text title /agents/NewsEditors @prefix vcard: <http://www.w3.org/2006/vcard/ns#> . <> a vcard:Group; vcard:hasMember "editor1", "editor2".
The user userB can Read document foo (This involves setting a system property for the servlet container, e.g.
-Dfcrepo.auth.webac.userAgent.baseUri=http://example.org/agents/)
Code Block language text @prefix acl: <http://www.w3.org/ns/auth/acl#> <#auth3> a acl:Authorization ; acl:accessTo </fcrepo/rest/foo> ; acl:mode acl:Read; acl:agent <http://example.org/agents/userB> .
Protecting Resources
Any resource in the repository may have its own ACL. The location of that (potential) ACL is given in a Link
HTTP header with rel="acl"
. If a resource itself does not specify its own ACL, its parent containers are inspected, and the first specified ACL found is used as the ACL for the requested resource. If no ACLs are found, a filesystem-based ACL will be checked, the default policy of which is to deny access to the requested resource.
The standard location for a resource's ACL is the fcr:acl
child of that resource, but clients should not rely on this behavior and always "follow their nose" by checking the Link
header.
Example Scenarios
These scenarios assume that Fedora has been configured to use fcrepo.auth.webac.userAgent.baseUri=http://example.org/agent/ and
fcrepo.auth.webac.groupAgent.baseUri=http://example.org/group/
I want to allow a user with username "smith123" to have read, write access to resource http://localhost:8080/rest/webacl_box1.
...
Using the two "files" below to create our Authorization and ACL resources.
Code Block | ||
---|---|---|
| ||
@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl .
|
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
acl:agent <http://example.org/agent/smith123> ;
acl:mode acl:Read, acl:Write ;
acl:accessTo <http://localhost:8080/rest/webacl_box1> . |
We would execute the following commands.
Code Block |
---|
> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
http://localhost:8080/rest/acl
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1"
http://localhost:8080/rest/acl/auth1
> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/webacl_box1" |
I want to let the group "Editors" have read, write access on all the items in the collection "http://localhost:8080/rest/box/bag/collection"
...
Using the two "files" below to create our Authorization and ACL resources.
Code Block | ||
---|---|---|
| ||
@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl . |
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
acl:agent <http://example.org/group/Editors> ;
acl:mode acl:Read, acl:Write ;
acl:accessTo <http://localhost:8080/rest/box/bag/collection> . |
We would execute the following commands.
Code Block |
---|
> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
http://localhost:8080/rest/acl
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1"
http://localhost:8080/rest/acl/auth1
> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/box/bag/collection" |
I would like the collection http://localhost:8080/rest/dark/archive to be viewable only by the groupId "Restricted", but I would like to allow anyone to view the resource http://localhost:8080/rest/dark/archive/sunshine.
How-To Guides
...
Using the three "files" below to create our Authorization and ACL resources.
Code Block | ||
---|---|---|
| ||
@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl . |
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
acl:agent <http://example.org/group/Restricted> ;
acl:mode acl:Read ;
acl:accessTo <http://localhost:8080/rest/dark/archive> . |
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
<> a acl:Authorization ;
acl:agent foaf:Agent ;
acl:mode acl:Read ;
acl:accessTo <http://localhost:8080/rest/dark/archive/sunshine> . |
The I would execute the following commands.
Code Block |
---|
> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
http://localhost:8080/rest/acl_lock
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl_lock/auth1"
http://localhost:8080/rest/acl_lock/auth1
> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl_lock> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive"
> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
http://localhost:8080/rest/acl_open
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_open.ttl" "http://localhost:8080/rest/acl_open/auth2"
http://localhost:8080/rest/acl_open/auth2
> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl_open> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive/sunshine" |
The collection http://localhost:8080/rest/public_collection should be readable by anyone but only editable by users in the group Editors.
...
Using the three "files" below to create our Authorization and ACL resources.
Code Block | ||
---|---|---|
| ||
@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl . |
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
<> a acl:Authorization ;
acl:agent foaf:Agent ;
acl:mode acl:Read ;
acl:accessTo <http://localhost:8080/rest/public_collection> . |
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
acl:agent <http://example.org/group/Editors> ;
acl:mode acl:Read, acl:Write ;
acl:accessTo <http://localhost:8080/rest/public_collection> . |
I would execute the following code:
Code Block |
---|
> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
http://localhost:8080/rest/acl
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth1.ttl" "http://localhost:8080/rest/acl/auth1"
http://localhost:8080/rest/acl/auth1
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth2.ttl" "http://localhost:8080/rest/acl/auth2"
http://localhost:8080/rest/acl/auth2
> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/public_collection" |
Only the ex:publicImage type objects in the container http://localhost:8080/rest/mixedCollection are viewable by anyone, all others are only viewable by the group Admins.
...
Using the three "files" below to create our Authorization and ACL resources.
Code Block | ||
---|---|---|
| ||
@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl . |
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
acl:agent <http://example.org/group/Admins> ;
acl:mode acl:Read ;
acl:accessTo <http://localhost:8080/rest/mixedCollection> . |
Code Block | ||
---|---|---|
| ||
@prefix acl: <http://www.w3.org/ns/auth/acl#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
<> a acl:Authorization ;
acl:agent foaf:Agent ;
acl:mode acl:Read ;
acl:accessToClass ex:publicImage . |
I would execute the following commands:
Code Block |
---|
> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
http://localhost:8080/rest/acl
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl/auth1"
http://localhost:8080/rest/acl/auth1
> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_open.ttl" "http://localhost:8080/rest/acl/auth2"
http://localhost:8080/rest/acl/auth2
> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/mixedCollection" |
How-To Guides
More Detailed Documentation
...