...
- Container Authentication: A user comes into the system. They are assigned one or more principals:
- If they authenticate through some authentication gateway, then their principal may be generated from some of the person's attributes;
- If Whether they don't authenticate , then they may or not, the request will be assigned a default principal (such as "guest").
Question: do we have default principals? Or only a default role, which is assigned if no principal is available?everyone" principal
- Fedora Principal Factory Extensions: Principal factory extensions may bring in more principals after authentication, such as groups, from sources like LDAP.
- Fedora Roles PEP Queries for Assigned Roles on Content: What roles have been assigned?
- The authorization layer queries the requested repository object(s) for all roles that are assigned to principals.
- If none are found locally, then it will query each ancestor in turn until role assignments are found.
- If no role assignments are found in the tree of objects, then a default set of role assignments is used.
- Fedora Roles PEP - Role Resolution: What roles does this request have?
- Assigned roles are compared with the set of principals for the request. Any roles assigned to principals for the request are considered effective.
- At this point we have the effective access roles for this operation
- Fedora Roles PEP - Policy Enforcement: Can this role perform the requested operation?
- The Fedora PEP is an extension point, so enforcement will vary by the chosen implementation. We assume that installations will combine the access roles module with a roles-based PEP.
- Effective roles will be used to determine if the user is permitted to perform the action on a given object.
- The PEP will return a response to ModeShape, which will throw an exception to Fedora if access has been denied.
- Fedora will respond with a 403 if the given REST operation is denied.
- The one exception to this process is the fedoraAdmin container role. if the request has a fedoraAdmin user role (in the container), then no object checks are made. The PEP is not consulted as admins have permission to do everything. Objects will never have the fedoraAdmin role explicitly assigned to them, since it is a container role and not a content role. (e.g. a tomcat user role)
...