In this quick start, you will use a Fedora 4 server with the WebAC Authorization module enabled to create a sample resource and an ACL for that resource, verify that access to that resource is correctly restricted, and finally modify the ACL to allow you to update the resource.

Prerequisites

• Fedora 4 with WebAC module enabled (you can use one of the pre-built WAR files from the fcrepo-webapp-plus project)a running Fedora repository
• curl

The commands in this guide assume that your Fedora 4 repository root is running at http://localhost:8080/fcrepo/rest.

Steps

Create these three files:

...

...

two files in a local directory:

@prefix acl: <http://www.w3.org/ns/auth/acl#>.
@prefix dc: <http://purl.org/dc/elements/1.1/>.

<> acl:accessControl </fcrepo/rest/acl>;
   dc:title "Hello, World!".

@prefix acl: <http://www.w3.org/ns/auth/acl#>.

<><#authz> a acl:Authorization;
   acl:accessTo </fcrepo/rest/foo>;
   acl:agent "user1";
   acl:mode acl:Read.

...

Upload these files into the repository:

$ curl -X PUT http://localhost:8080/fcrepo/rest/aclfoo -u admin1:password3 \
    -H "Content-Type: text/turtle" --data-binary @acl@foo.ttl
$ curl -X PUT http://localhost:8080/fcrepo/rest/foo -u admin1:password3 \
    -H "Content-Type: text/turtle" --data-binary @foo.ttl
$ curl -X PUT http://localhost:8080/fcrepo/rest/acl/authz/fcr:acl -u admin1:password3 \
    -H "Content-Type: text/turtle" --data-binary @authz@acl.ttl

...

Now user1 is able to read the resource at http://localhost:8080/rest/foo, but user2 cannot. To test this, try the following two commands:

$ curl -i http://localhost:8080/fcrepo/rest/foo -u user1:password1
$ curl -i http://localhost:8080/fcrepo/rest/foo -u user2:password2

...

PREFIX dc: <http://purl.org/dc/elements/1.1/>

INSERT DATA {
    <> dc:description "Quick Start with WebAC and Fedora 4" .
 }
WHERE {}

Then run this to attempt to update foo:

$ curl -i -X PATCH http://localhost:8080/fcrepo/rest/foo -u user1:password1 \
      -H "Content-Type: application/sparql-update" \
      --data-binary @foo.sparql

...

PREFIX acl: <http://www.w3.org/ns/auth/acl#>

INSERT DATA {
  <#authz>  <> acl:mode acl:Write .
 }
WHERE {}

Run this command to update the ACL authorization:

$ curl -i -X PATCH http://localhost:8080/fcrepo/rest/acl/authz -u admin1:password3 \
      -H "Content-Type: application/sparql-update" \
      --data-binary @authz.sparql

...

Now you should be able to re-run the earlier command to update the foo resource as user1:

$ curl -i -X PATCH http://localhost:8080/fcrepo/rest/foo -u user1:password1 \
      -H "Content-Type: application/sparql-update" \
      --data-binary @foo.sparql

Now this should return a 204 No Content response. To verify that the update happened, you can also go to http://localhost:8080/fcrepo/rest/foo in your web browser, and confirm that it has both dc:title and dc:description properties.

Link: <http://localhost:8080/fcrepo/rest/acl>; rel="acl"

<><#rootAuthz> a acl:Authorization;
    acl:accessTo <https://localhost:8080/fcrepo/rest> .

<><#rootAuthz> a acl:Authorization;
    acl:accessTo <https://localhost:8080/fcrepo/rest/> .
    # note this trailing slash ---------------------^

...