The Fedora WebAC authorization Fedora module is an implementation of the W3C's still evolving draft by the W3C that proposes a of an RDF-based decentralized authorization policy mechanism. See WebAccessControl specifications at the W3C website.
W3C's definition of WebAccessControl
From the WebAccessControl description at the W3C website:
WebAccessControl is a decentralized system for allowing different users and groups various forms of access to resources where users and groups are identified by HTTP URIs.
...
The WebAC module will enforce access control based on the Access Control List (ACL) RDF resource associated with the requested resource. The ACL resource should specify the types of access, allowed users or groups, and applicable resources.
User -> Read/Write/Append/Control -> Resource/ResourceType
Example:
1. userA can Read document foo
@prefix acl: <In WebAC, an ACL consists of a set of Authorizations. Each Authorization is a single rule for access, such as "users alice and bob may write to resource foo", described with a set of RDF properties. Authorizations have the RDF type http://www.w3.org/ns/auth/
acl#>
</acls/read> acl:accessTo </foo> ;
acl:mode acl:Read;
acl:agent </agents/userA> .
For the remainder of this document, the 2. users in NewsEditor group can Write to any resource of type News
@prefix acl: <http://www.w3.org/ns/auth/acl#
>
</acls/write> acl:accessToClass </objecttype/news> ;
acl:mode acl:Read, acl:Write;
acl:agentClass </agents/newsEditor> .
Example Request Authorization Flow:
...
namespace will be abbreviated with the prefix acl:
.
Authorizations
The properties that may be used on an acl:Authorization
are:
Property | Meaning |
---|---|
acl:accessTo | the URI of the protected resource |
acl:agent | the user (in the W3C WebAC ontology, the user is named with a URI, but Fedora's implementation supports both URI- and string-based usernames) |
acl:mode | the type of access (WebAC defines several modes: acl:Read , acl:Write , acl:Append , and acl:Control ; Fedora implements acl:Read and acl:Write ) |
acl:accessToClass | an RDF class of protected resources |
acl:agentClass | a group of users (defined as a foaf:Group resource listing its users with the foaf:member property) |
For a more detailed explanation of Authorizations and their properties, see WebAC Authorizations.
Examples of Authorizations
The user userA can Read document foo
Code Block language text @prefix acl: <http://www.w3.org/ns/auth/acl#> <> a acl:Authorization ; acl:accessTo </foo> ; acl:mode acl:Read; acl:agent "userA" .
Users in NewsEditor group can Write to any resource of type ex:News
Code Block language text @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix ex: <http://example.org/ns#> . <> a acl:Authorization ; acl:accessToClass ex:News ; acl:mode acl:Read, acl:Write; acl:agentClass </agents/NewsEditor> .
Code Block language text title /agents/NewsEditors @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a foaf:Group; foaf:member "editor1", "editor2".
The user userB can Read document foo (This involves setting a system property for the servlet container, e.g.
-Dfcrepo.auth.webac.userAgent.baseUri=http://example.org/agents/)
Code Block language text @prefix acl: <http://www.w3.org/ns/auth/acl#> <> a acl:Authorization ; acl:accessTo </foo> ; acl:mode acl:Read; acl:agent <http://example.org/agents/userB> .
Storing WebAC ACLs in Fedora 4
In Fedora 4, an ACL is a ldp::BasicContainer
resource with the additional RDF type of http://fedora.info/definitions/v4/webac#Acl
. This class is part of the Fedora WebAC ontology. Its children should each be resources of type acl:Authorization
. It is given the namespace prefix webac:
by convention.
Protecting Resources
A resource specifies the location of its ACL using the acl:accessControl
property. If a resource itself does not specify an ACL, its parent containers are inspected, and the first specified ACL found is used as the ACL for the requested resource. If no ACLs are found, a filesystem-based ACL will be checked, the default policy of which is to deny access to the requested resource.
Example Scenarios
These scenarios assume that Fedora has been configured to use fcrepo.auth.webac.userAgent.baseUri=http://example.org/agent/ and
fcrepo.auth.webac.groupAgent.baseUri=http://example.org/group/
I want to allow a user with username "smith123" to have read, write access to resource http://localhost:8080/rest/webacl_box1.
Expand Using the two "files" below to create our Authorization and ACL resources.
Code Block title Acl.ttl @prefix webac: <http://fedora.info/definitions/v4/webac#> . <> a webac:Acl .
Code Block title Authorization.ttl @prefix acl
Example Scenarios
I want to allow a user with username "smith123" to have read, write access to resource http://localhost:8080/rest/webacl_box1.
Expand Using these two "files" to create our Authorization and ACL resources.
Code Block title Acl.ttl @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . <> a ldp:BasicContainer ; rdf:type ???:WebAcl .
Code Block title Authorization.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#>auth/acl#> . <> a ldp:RDFSource ; rdf:type a acl:Authorization ; acl:agent "smith123"<http://example.org/agent/smith123> ; acl:mode acl:Read, acl:Write ; acl:accessTo <http://localhost:8080/rest/webacl_box1> .
We would execute the following commands.
Code Block > curl -X POSTPUT -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1" http://localhost:8080/rest/acl/auth1 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT INTODATA { <> acl:accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/webacl_box1"
I want to let the group "Editors" have read, write access on all the items in the collection "http://localhost:8080/rest/box/bag/collection"
the collection "http://localhost:8080/rest/box/bag/collection"
I would like the collectionExpand Using the two "files" below to create our Authorization and ACL resources.
Code Block title Acl Expand Using the below two "files",
Code Block title Acl.ttl @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . <> a ldp:BasicContainer ; rdf:type ???:WebAcl .
Code Block title Authorization.ttl @prefix aclwebac: <http://fedora.info/definitions/v4/webac#> . <> a webac:Acl .
Code Block title Authorization.ttl @prefix aclwww.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/auth/ldp#>acl#> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent "Editors"<http://example.org/group/Editors> ; acl:mode acl:Read, acl:Write ; acl:accessTo <http://localhost:8080/rest/box/bag/collection> .
We would execute the following commands.following commands.
Code Block Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl > curl -X PUTPOST -H "Content-type: text/turtle" --data-binary "@Authorization@Acl.ttl" "http://localhost:8080/rest/acl/auth1" http://localhost:8080/rest/acl/auth1 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT INTO { <> acl:accessControl <http http://localhost:8080/rest/acl> . }" |acl > curl -X PATCHPUT -H "Content-type: applicationtext/sparql-updateturtle" --uploaddata-file - "http://localhost:8080/rest/box/bag/collection"
dark/archive to be viewable only by the groupId "Restricted", but I would like to allow anyone to view the resourcebinary "@Authorization.ttl" "http://localhost:8080/rest/
dark/archive/sunshine.acl/auth1" http://localhost:8080/rest/
Expand Using the below three files to setup the Acl and Authorization resources.
Code Block title Acl.ttl @prefix rdfacl/auth1 > echo "PREFIX acl: <http://www.w3.org/1999ns/02/22-rdf-syntax-ns#> . @prefix ldp:auth/acl#> INSERT DATA { <> acl:accessControl <http://www.w3.org/ns/ldp#>localhost:8080/rest/acl> . <>}" a| ldp:BasicContainer ; rdf:type ???:WebAcl .curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/box/bag/collection"
I would like the collection http://localhost:8080/rest/dark/archive to be viewable only by the groupId "Restricted", but I would like to allow anyone to view the resource http://localhost:8080/rest/dark/archive/sunshine.
The collectionExpand Using the three "files" below to create our Authorization and ACL resources.
Code Block title Acl.ttl @prefix webac: <http://fedora.info/definitions/v4/webac#> . <> a webac:Acl
Code Block title Auth_restricted.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent "Restricted" ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/dark/archive> .
Code Block title Auth_openrestricted.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf:/acl#> . <> a acl:Authorization ; acl:agent <http://example.org/group/Restricted> ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/dark/archive> .
Code Block title Auth_open.ttl @prefix aclwww.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/auth/ldp#>acl#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent foaf:Agent ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/dark/archive/sunshine> .
The I would execute the following commands.
Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl_lock > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl_lock/auth1" http://localhost:8080/rest/acl_lock/auth1 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT INTODATA { <> acl:accessControl <http://localhost:8080/rest/acl_lock> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive" > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" - "http://localhost:8080/rest/acl_open/dark/archive" > curl -X PUTPOST -H "Content-type: text/turtle" --data-binary "@Auth_open.ttl" "http://localhost:8080/rest/acl_open/auth2" http://localhost:8080/rest/acl_open/auth2 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT INTO { <> acl:accessControl <http@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl_open> . }" |open > curl -X PATCHPUT -H "Content-type: applicationtext/sparql-updateturtle" --upload-file -data-binary "@Auth_open.ttl" "http://localhost:8080/rest/dark/archive/sunshine"
public_collection should be readable by anyone but only editable by users in the group Editors.acl_open/auth2" http://localhost:8080/rest/
Expand Using the following three files to setup the Acl and Authorizations. We would:
Code Block title Acl.ttl @prefix rdfacl_open/auth2 > echo "PREFIX acl: <http://www.w3.org/1999ns/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . <> a ldp:BasicContainer ; rdf:type ???:WebAcl .auth/acl#> INSERT DATA { <> acl:accessControl <http://localhost:8080/rest/acl_open> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive/sunshine"
The collection http://localhost:8080/rest/public_collection should be readable by anyone but only editable by users in the group Editors.
Only the ex:publicImage type objects in the container httpExpand Using the three "files" below to create our Authorization and ACL resources.
Code Block title Acl.ttl @prefix webac
Code Block title Auth1.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://wwwfedora.w3.orginfo/1999definitions/02/22-rdf-syntax-ns#>v4/webac#> . <> a webac:Acl .
Code Block title Auth1.ttl @prefix ldpacl: <http://www.w3.org/ns/auth/ldp#>acl#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a ldp:RDFSource ; rdf:type a acl:Authorization ; acl:agent foaf:Agent ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/public_collection> .
Code Block .
Code Block title Auth2.ttl @prefix acl
title Auth2.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . @prefix foaf: <http://xmlns.com/foaf/0.1/>auth/acl#> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent "Editors"<http://example.org/group/Editors> ; acl:mode acl:Read, acl:Write ; acl:accessTo <http://localhost:8080/rest/public_collection> .
I would execute the following code: code:
Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl > curl -X PUTPOST -H "Content-type: text/turtle" --data-binary "@Auth1@Acl.ttl" "http://localhost:8080/rest/acl/auth1" http://localhost:8080/rest/acl/auth1 > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth2@Auth1.ttl" "http://localhost:8080/rest/acl/auth2" http://localhost:8080/rest/acl/auth2 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT INTO { <> acl:accessControl <http8080/rest/acl/auth1" http://localhost:8080/rest/acl> . }" |/acl/auth1 > curl -X PATCHPUT -H "Content-type: applicationtext/sparql-updateturtle" ---upload-file - "data-binary "@Auth2.ttl" "http://localhost:8080/rest/acl/auth2" http://localhost:8080/rest/public_collection"
/acl/auth2 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT DATA { <> acl:accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/public_collection"
Only the ex:publicImage type objects in the container http://localhost:8080/rest/mixedCollection are viewable by anyone, all others are only viewable by the group Admins.
mixedCollection are viewable by anyone, all others are only viewable by the group Admins.Expand Using the three "files" below to create our Authorization and ACL resources
Expand Using the following three files Acl.ttl, Auth_restricted.ttl and Auth_open.ttl
Code Block @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . <> a ldp:BasicContainer ; rdf:type ???:WebAcltitle Acl.ttl .
Code Block title Auth_restrictedAcl.ttl @prefix aclwebac: <http://wwwfedora.w3.orginfo/nsdefinitions/authv4/acl#>webac#> . @prefix<> rdf:a webac:Acl .
Code Block title Auth_restricted.ttl @prefix acl<http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/ldp#> . @prefix foaf: <http://xmlns.com/foaf/0.1/>auth/acl#> . <> a ldpacl:RDFSourceAuthorization ; rdf:type acl:Authorization ; acl:agent 'Admins'agent <http://example.org/group/Admins> ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/mixedCollection> .
Code Block title Auth_open.ttl_open.ttl @prefix acl@prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix ldp: <http://www.w3.org/ns/auth/ldp#>acl#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a ldp:RDFSource ; rdf:type acl:Authorization ; acl:agent foaf:Agent ; acl:mode acl:Read ; acl:accessToClass ex:publicImage .
I would execute the following commands:
Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl/auth1" http://localhost:8080/rest/acl/auth1 > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_open.ttl" "http://localhost:8080/rest/acl/auth2" http://localhost:8080/rest/acl/auth2 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT INTODATA { <> acl:accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/mixedCollection"
...