Versions Compared

Old Version 3

changes.mady.by.user Andrew Woods

Saved on

compared with

New Version 4

changes.mady.by.user Peter Eichman

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

If you use acl:accessTo to protect a container, and add an acl:default predicate, that authorization rule by default will also apply to any of that container's children, unless that child has its own acl:accessControl property, as described belowACL.

Code Block
languagetext
titleInheritable authorization using acl:default
<> acl:accessTo </collections/rebels> ;
    acl:default </collections/rebels> .

The second is to use the acl:accessToClass property to state that the authorization rule applies to any resource with the named RDF type:

...

languagetext

...

. For example, this authorization will apply to any pcdm:Container

...

Note that adding acl:accessTo or acl:accessToClass to an authorization is only one half of what is required to protect a resource with a WebAC ACL. The other half is to specify on the resource itself that it is protected by the ACL that contains that authorizationresources contained by /collections/rebels that do not have their own ACL:

Code Block
languagetext
# </acls/rebels>
<> a webac:Acl;
    ldp:contains <commanders>.

# </acls/rebels/commanders>
<> a acl:Authorization;
    acl:agentGroup </groups/rebel-commanders>;
    acl:accessToaccessToClass pcdm:Container ;
acl:default </collections/rebels/plans>;
    # modes will be discussed in the next section
    acl:mode acl:Read, acl:Write.

# partial contents of </collections/rebels/plans>:
<> acl:accessControl </acls/rebels> rebels>


Note

While Fedora will not prevent you from using acl:accessToClass without an acl:default statement on the same authorization, this is almost certainly not the behavior you want. Without the acl:default predicate to indicate that the authorization should be inheritable (see SOLID WebAC), the authorization will only apply to the protected resource if the protected resource has an RDF type that matches acl:accessToClass.

If your intent is to just protect the single resource, that intent is more clearly stated through using acl:accessTo. If your intent is to protect multiple resources based on their RDF type, then you will need the authorization to be inherited by using acl:default in conjunction with acl:accessToClass.


"How?" - Modes of Interaction

...