...

Steps in determining the effective authorization

Finding the ACL:

1. Get the ACL of the requested resource, if exists, else. if ACL exists:Find union of authorizations that specify access for the requesting user. This includes:
2. authorizations that specify accessTo to the requested resource.
authorizations that specify accessToClass of the requested resource type.
3. Get the ACL of the next ancestor recursively (using either ldp:contains or fedora:hasParent), if exists, else.
4. If no more ancestor exist (root node reached) and no ACL is found: Deny access.

Finding the effective authorization:

1. Find union of authorizations that specify access for the requesting user's group. This includes:
   1. authorizations that specify accessTo to the requested resource.
   2. authorizations that specify accessToClass of the requested resource type.
   3. If authorizations exist for user or group:, go to step 6, else go to next step.
2. Find the union of authorizations found from steps 1.a.i and 1.a.ii.
3. Go to step 4.
that specify access for the requesting user's group. This includes:
1. authorizations that specify accessTo to the requested resource.
2. authorizations that specify accessToClass of the requested resource type.
3. If authorizations exist for group, go to step 6, else go to next step.
5. if no authorization exist for user or group:
   1. Deny Access. Go to step 2.
6. if no ACL exists for requested resource:
   1. Go to step 2.
Get the ACL of the next ancestor (using either ldp:contains or fedora:hasParent). if ACL exists:Find union of authorizations that specify access for the requesting user. This includes:
1. authorizations that specify accessToto the requested resource's ancestor.
2. authorizations that specify specify accessToClass of the requested resource  of to the requested resource's ancestor type.Find union of authorizations
3. If authorizations exist for user, go to step 6, else go to next step.
7. Find union of authorizations that specify access for the requesting user's group. This includes:
   1. authorizations that specify specify accessTo to the  to the requested resource's ancestor.
   2. authorizations that specify accessToClass of to the requested resource's ancestor type.
   3. If authorizations exist for user or group:
      
      1. Find the union of authorizations found from steps 2.a.i and 2.a.ii.
      2. Go to step 4.
   4. Find union of authorizations that specify access for the requesting user. This includes:
      1. authorizations that specify accessTo to the requested resource's ancestor.
   5. Find union of authorizations that specify access for the requesting user's group. This includes:
      1. authorizations that specify accessToClass of to the requested resource's ancestor.
   6. If authorizations exist for user or group:
      
      1. Find the union of authorizations found from steps 2.a.iv and 1.a.v.
      2. Go to step 4.
   7. if no authorization exist for user or group:
      1. Deny Access. Go to step 2.
   8. if no ACL exists for the current ancestor resource:
      1. Go to step 2.
   9. group, go to step 6, else go to next step.
8. if no authorization exists for user or group: Deny AccessIf no more ancestor exist (root node reached) and no ACL or no matching authorization is found:Deny access.
9. Use the most permissive from the set of authorizations found.
   1. Grant access if the authorizations permit requested access mode (read, write, append): Grant access.
   2. Deny access if the authorizations does not permit requested access mode.

...

1. 1. : Deny access.

Example Request Authorization Flow

...