The Fedora WebAC authorization Fedora module is an implementation of the W3C's still evolving draft by the W3C that proposes a of an RDF-based decentralized authorization policy mechanism. See WebAccessControl specifications at the W3C website.

W3C's definition of WebAccessControl

From the WebAccessControl description at the W3C website:

WebAccessControl is a decentralized system for allowing different users and groups various forms of access to resources where users and groups are identified by HTTP URIs.

...

The WebAC module will enforce access control based on the Access Control List (ACL) RDF resource associated with the requested resource. The ACL resource should specify the types of access, allowed users or groups, and applicable resources.

User -> Read/Write/Append/Control -> Resource/ResourceType

Example:

In WebAC, an ACL consists of a set of Authorizations. Each Authorization is a single rule for access, such as "users alice and bob may write to resource foo", described with a set of RDF properties. Authorizations have the RDF type http://www.w3.org/ns/auth/acl#Authorization.

For the remainder of this document, the 1. userA can Read document foo
@prefix acl: <http://www.w3.org/ns/auth/acl#>

</acls/read> acl:accessTo </foo> ;
acl:mode acl:Read;
acl:agent </agents/userA> .

...

namespace will be abbreviated with the prefix acl:.

Authorizations

The properties that may be used on an acl:Authorization are:

Property	Meaning
`acl:accessTo`	the URI of the protected resource
`acl:agent`	the user (in the W3C WebAC ontology, the user is named with a URI, but Fedora's implementation supports both URI- and string-based usernames)
`acl:mode`	the type of access (WebAC defines several modes: `acl:Read`, `acl:Write`, `acl:Append`, and `acl:Control`; Fedora implements `acl:Read` and `acl:Write`)
`acl:accessToClass`	an RDF class of protected resources
`acl:agentClass`	a group of users (defined as a `foaf:Group` resource listing its users with the `foaf:member` property)

For a more detailed explanation of Authorizations and their properties, see WebAC Authorizations.

Examples of Authorizations

The user userA can Read document foo
Code Block
language text
@prefix acl

</acls/write> acl:accessToClass </objecttype/news> ;
acl:mode acl:Read, acl:Write;
acl:agentClass </agents/newsEditor> .

Example Request Authorization Flow:

...

Example Scenarios

I want to allow a user with username "smith123" to have read, write access to resource http://localhost:8080/rest/webacl_box1.

Using these two "files" to create our Authorization and ACL resources.

Code Block

title	Acl.ttl

@prefix rdf: <http://www.w3.org/1999ns/02/22-rdf-syntax-ns#> .
@prefix ldp: <http://www.w3.org/ns/ldp#> .
<> a ldp:BasicContainer auth/acl#>

<> a acl:Authorization ;
    acl:accessTo </foo> ;
    acl:mode acl:Read;
   rdf acl:type ???:WebAcl .

agent "userA" .

Users in NewsEditor group can Write to any resource of type ex:News

Code Block

titlelanguage	Authorization.ttltext

@prefix acl: <http://www.w3.org/ns/auth/acl#> .
@prefix rdfex: <http://www.w3example.org/1999/02/22-rdf-syntax-ns#> .
@prefix ldp: <http://www.w3.org/ns/ldp#> .
<> a ldpacl:RDFSourceAuthorization ;
   rdf:type acl:Authorization ;
   acl:agent "smith123" accessToClass ex:News ;
    acl:mode acl:Read, acl:Write ;
    acl:accessToagentClass <http:<//localhost:8080/rest/webacl_box1> .agents/NewsEditor> .

Code Block

language	text
title	/agents/NewsEditors

@prefix foaf: <http://xmlns.com/foaf/0.1/> .

<> a foaf:Group;
    foaf:member "editor1", "editor2".

The user userB can Read document foo (This involves setting a system property for the servlet container, e.g. -Dfcrepo.auth.webac.userAgent.baseUri=http://example.org/agents/)

Code Block

language	text

@prefix

We would execute the following commands.

Code Block

> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"

http://localhost:8080/rest/acl

> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1"

http://localhost:8080/rest/acl/auth1

> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT INTO {
<>
<> a acl:Authorization ;
    acl:accessControlaccessTo <http://localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/webacl_box1"</foo> ;
    acl:mode acl:Read;
    acl:agent <http://example.org/agents/userB> .

Storing WebAC ACLs in Fedora 4

In Fedora 4, an ACL is a ldp::BasicContainer resource with the additional RDF type of http://fedora.info/definitions/v4/webac#Acl. This class is part of the Fedora WebAC ontology. Its children should each be resources of type acl:Authorization. It is given the namespace prefix webac: by convention.

Protecting Resources

A resource specifies the location of its ACL using the acl:accessControl property. If a resource itself does not specify an ACL, its parent containers are inspected, and the first specified ACL found is used as the ACL for the requested resource. If no ACLs are found, a filesystem-based ACL will be checked, the default policy of which is to deny access to the requested resource.

Example Scenarios

These scenarios assume that Fedora has been configured to use fcrepo.auth.webac.userAgent.baseUri=http://example.org/agent/ and fcrepo.auth.webac.groupAgent.baseUri=http://example.org/group/

I want to allow a user with username "smith123" to have read, write access to resource http://localhost:8080/rest/webacl_box1.

Expand

Using the two "files" below to create our Authorization and ACL resources.

Code Block

title	Acl.ttl

@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl .

Code Block

title	Authorization.ttl

@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
   acl:agent <http://example.org/agent/smith123> ;
   acl:mode acl:Read, acl:Write ;
   acl:accessTo <http://localhost:8080/rest/webacl_box1> .

We would execute the following commands.

Code Block

> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"

http://localhost:8080/rest/acl

> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1"

http://localhost:8080/rest/acl/auth1

> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/webacl_box1"

I want to let the group "Editors" have read, write access on all the items in the collection "http://localhost:8080/rest/box/bag/collection"

Expand

Using the two "files" below to create our Authorization and ACL resources.

Code Block

title	Acl.ttl

@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl .

Code Block

title	Authorization.ttl

@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
   acl:agent <http://example.org/group/Editors> ;
   acl:mode acl:Read, acl:Write ;
   acl:accessTo <http://localhost:8080/rest/box/bag/collection> .

We would execute the following commands.

Code Block

> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"

http://localhost:8080/rest/acl

> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1"

http://localhost:8080/rest/acl/auth1

> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT DATA {
<> acl:accessControl

I want to let the group "Editors" have read, write access on all the items in the collection "http://localhost:8080/rest/box/bag/collection"
Using the below two "files",

Code Block

title	Acl.ttl

@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix ldp: <http://www.w3.org/ns/ldp#> .
<> a ldp:BasicContainer ;
   rdf:type ???:WebAcl .

Code Block

title	Authorization.ttl

@prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent "Editors" ; acl:mode acl:Read, acl:Write ; acl:accessTo

 <http://localhost:8080/rest/

box/bag/collection> .

We would execute the following commands.

Code Block

>

acl> .
}" | curl -X

POST

PATCH -H "Content-type:

text

application/

turtle

sparql-update" --upload-

data

file -

binary

@Acl.ttl" "

http://localhost:8080/rest/box/bag/collection"

I would like the collection http://localhost:8080/rest

"

/dark/archive to be viewable only by the groupId "Restricted", but I would like to allow anyone to view the resource http://localhost:8080/rest/dark/archive/sunshine.

http

Expand

Using the three "files" below to create our Authorization and ACL resources.

Code Block

title	Acl.ttl

@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl .

Code Block

title	Auth_restricted.ttl

@prefix

/acl > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1" http://localhost:8080/rest/acl/auth1 > echo "PREFIX

 acl: <http://www.w3.org/ns/auth/acl#>

INSERT

INTO {

.
<> a acl:

accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/box/bag/collection"

I would like the collection http://localhost:8080/rest/dark/archive to be viewable only by the groupId "Restricted", but I would like to allow anyone to view the resource

Authorization ;
   acl:agent <http://example.org/group/Restricted> ;
   acl:mode acl:Read ;
   acl:accessTo <http://localhost:8080/rest/dark/

archive/sunshine.
Using the below three files to setup the Acl and Authorization resources.Acl

archive> .

Code Block

title

Auth_open.ttl

@prefix

rdf

acl: <http://www.w3.org/

1999

ns/

02/22-rdf-syntax-ns#>

auth/acl#> .
@prefix

ldp

foaf: <http://

www.w3.org/ns/ldp#>

xmlns.com/foaf/0.1/> .
<> a

ldp

acl:

BasicContainer

Authorization ;

rdf

acl:

type

agent

???:WebAcl .

Code Block

title	Auth_restricted.ttl

@prefix

foaf:Agent ;
   acl:

<http://www.w3.org/ns/auth/acl#> . @prefix rdf:

mode acl:Read ;
   acl:accessTo <http://

/www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent "Restricted" ; acl:mode acl:Read ; acl:accessTo <http:

localhost:8080/rest/dark/archive/sunshine> .

The I would execute the following commands.

Code Block

> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"

http://localhost:8080/rest/acl_lock

> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/

dark/archive> .

Code Block

title	Auth_open.ttl

Code Block

@prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp

acl_lock/auth1"

http://localhost:8080/rest/acl_lock/auth1

> echo "PREFIX acl: <http://www.w3.org/ns/

ldp#> . @prefix foaf:

auth/acl#>
INSERT DATA {
<> acl:accessControl <http://

xmlns.com/foaf/0.1/>

localhost:8080/rest/acl_lock> .

<>

}"

a

ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent foaf:Agent ; acl:mode acl:Read ; acl:accessTo <http

curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive"

> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest

/dark/archive/sunshine> .

The I would execute the following commands.

"

http://localhost:8080/rest/acl_open

> curl -X

POST

PUT -H "Content-type: text/turtle" --data-binary "

@Acl.ttl" "

@Auth_open.ttl" "http://localhost:8080/rest/acl_open/auth2"

http://localhost:8080/rest/acl_open/auth2

> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>

http

INSERT DATA {
<> acl:accessControl <http://localhost:8080/rest/acl_

lock >

open> .
}" | curl -X

PUT

PATCH -H "Content-type:

text

application/

turtle

sparql-update" --

data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl_lock/auth1" http://localhost:8080/rest/acl_lock/auth1 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT INTO { <> acl:accessControl <http:

upload-file - "http://localhost:8080/rest/dark/archive/sunshine"

The collection http://localhost:8080/rest/public_collection should be readable by anyone but only editable by users in the group Editors.

Expand

Using the three "files" below to create our Authorization and ACL resources.

Code Block

title	Acl.ttl

@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl .

Code Block

title	Auth1.ttl

@prefix acl: <http://www.w3.org/ns/auth/acl#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
<> a acl:Authorization ;
   acl:agent foaf:Agent ;
   acl:mode acl:Read ;
   acl:accessTo <http

acl_lock> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive" > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl_open > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_open.ttl" "http

://localhost:8080/rest/

acl_open/auth2" http://localhost:8080/rest/acl_open/auth2 > echo "PREFIX acl:

public_collection> .

Code Block

title	Auth2.ttl

@prefix acl: <http://www.w3.org/ns/auth/acl#> .
<> a acl:Authorization ;
   acl:agent <http://

www

example.

w3.

org/

ns/auth/acl#> INSERT INTO { <> acl:accessControl

group/Editors> ;
   acl:mode acl:Read, acl:Write ;
   acl:accessTo <http://localhost:8080/rest/

acl

public_

open> . }" |

collection> .

I would execute the following code:

Code Block
> curl -X

PATCH

POST -H "Content-type:

application

text/

sparql-update

turtle" --

upload

data-

file -

binary "@Acl.ttl" "http://localhost:8080/rest

/dark/archive/sunshine"

The collection

"

http://localhost:8080/rest/

public_collection should be readable by anyone but only editable by users in the group Editors.
Using the following three files to setup the Acl and Authorizations. We would:

Code Block

title	Acl.ttl

@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix ldp: <http://www.w3.org/ns/ldp#> .
<> a ldp:BasicContainer ;
   rdf:type ???:WebAcl .

Code Block

title	Auth1.ttl

@prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp

acl

> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth1.ttl" "http://localhost:8080/rest/acl/auth1"

http://localhost:8080/rest/acl/auth1

> curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth2.ttl" "http://localhost:8080/rest/acl/auth2"

http://localhost:8080/rest/acl/auth2

> echo "PREFIX acl: <http://www.w3.org/ns

/ldp#> . @prefix foaf:

/auth/acl#>
INSERT DATA {
<> acl:accessControl <http://

xmlns.com/foaf/0.1/> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent foaf:Agent ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/public_collection>

localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/public_collection"

Only the ex:publicImage type objects in the container http://localhost:8080/rest/mixedCollection are viewable by anyone, all others are only viewable by the group Admins.

Auth2

Expand

Using the three "files" below to create our Authorization and ACL resources.

Code Block

title	Acl.ttl

@prefix webac: <http://fedora.info/definitions/v4/webac#> .
<> a webac:Acl .

Code Block

title

Auth_restricted.ttl

@prefix acl: <http://www.w3.org/ns/auth/acl#> .

@prefix rdf:


<> a acl:Authorization ;
   acl:agent <http://

www

example.

w3.

org

/1999/02/22-rdf-syntax-ns#> . @prefix ldp

/group/Admins> ;
   acl:mode acl:Read ;
   acl:accessTo <http://localhost:8080/rest/mixedCollection> .

Code Block

title	Auth_open.ttl

@prefix acl: <http://www.w3.org/ns/auth/

ldp#>

acl#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
<> a

ldp:RDFSource ; rdf:type

acl:Authorization ;
   acl:agent

"Editors"

foaf:Agent ;
   acl:mode acl:Read

, acl:Write

 ;
   acl:

accessTo <http://localhost:8080/rest/public_collection>

accessToClass ex:publicImage .

I would execute the following

code

commands:

Code Block
> curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl > curl -X PUT -H "Content-type: text/turtle" --data-binary "

@Auth1

@Auth_restricted.ttl" "http://localhost:8080/rest/acl/auth1"

http://localhost:8080/rest/acl/auth1

> curl -X PUT -H "Content-type: text/turtle" --data-binary "

@Auth2

@Auth_open.ttl" "http://localhost:8080/rest/acl/auth2"

http://localhost:8080/rest/acl/auth2

> echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
INSERT

INTO

DATA {
<> acl:accessControl <http://localhost:8080/rest/acl> .
}" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/

public_collection"

...

mixedCollection"

Page tree

Versions Compared

Old Version 12

New Version Current

Key

W3C's definition of WebAccessControl

Example:

Authorizations

Examples of Authorizations

Example Request Authorization Flow:

Example Scenarios

Storing WebAC ACLs in Fedora 4

Protecting Resources

Example Scenarios

How-To Guides

More Detailed Documentation

Page tree

Page History

Versions Compared

Old Version 12

New Version Current

Key

W3C's definition of WebAccessControl

Example:

Authorizations

Examples of Authorizations

Example Request Authorization Flow:

Example Scenarios

Storing WebAC ACLs in Fedora 4

Protecting Resources

Example Scenarios

How-To Guides

More Detailed Documentation