Warning | ||
---|---|---|
| ||
The examples on this page are incompatible with Fedora 5, as they do not follow the SOLID WebAC specification. This page is being updated to bring it into alignment with the current specification |
These scenarios assume that Fedora has been configured to use fcrepo.auth.webac.userAgent.baseUri=http://example.org/agent/ and
fcrepo.auth.webac.groupAgent.baseUri=http://example.org/group/
I want to allow a user with username "smith123" to have read, write access to resource http://localhost:8080/rest/webacl_box1.
Expand Using the two "files" below to create our Authorization and ACL resources. Create this file to use as the ACL:
Code Block title Acl.ttl code@prefix webac: <http://fedora.info/definitions/v4/webac#> . <> a webac:Acl .
language text title Authorizationacl.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . <><#authz> a acl:Authorization ; acl:agent <http://example.org/agent/smith123> ; acl:mode acl:Read, acl:Write ; acl:accessTo <http://localhost:8080/rest/webacl_box1> .
We would execute Run the following commands.:
Code Block language bash > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "XPUT http://localhost:8080/rest" /webac1_box1 curl -XPUT http://localhost:8080/rest/webacl_box1/acl > curl -X PUTfcr:acl -H "'Content-typeType: text/turtle"' --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1" http://localhost:8080/rest/acl/auth1 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT DATA { <> acl:accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/webacl_box1"@acl.ttl
I want to let the group "Editors" have read, write access on all the items in the collection "http://localhost:8080/rest/box/bag/collection"
Expand Create this file to use as the ACL:
Code Block language text title acl Using the two "files" below to create our Authorization and ACL resources.
Code Block title Acl.ttl @prefix webac: <http://fedora.info/definitions/v4/webac#> . <> a webac:Acl .
Code Block title Authorization.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . <> a acl:Authorization ; acl:agentagentGroup <http://example.org/grouplocalhost:8080/rest/groups/Editors> ; acl:mode acl:Read, acl:Write ; acl:accessTo <http://localhost:8080/rest/box/bag/collection> .
We would execute the following commands.
Create this file to define the Editors group:
Code Block language text title group.ttl @prefix vcard: <http://www.w3.org/2006/vcard/ns#> . <> a vcard:Group ; vcard:hasMember <http://example.org/agent/jones456>
Run the following commands:
Code Block language bash curl -XPUT
Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" /box/bag/collection curl -XPUT http://localhost:8080/rest/acl > curl -X PUT/groups/Editors -H "'Content-typeType: text/turtle"' --data-binary "@Authorization@group.ttl" curl -XPUT "http://localhost:8080/rest/acl/auth1" http://localhost:8080/rest/acl/auth1 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT DATA { <> acl:accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/box/bag/collection"box/bag/collection/fcr:acl -H 'Content-Type: text/turtle' --data-binary @acl.ttl
I would like the collection http://localhost:8080/rest/dark/archive to be viewable only by the groupId group "Restricted", but I would like to allow anyone to view the resource http://localhost:8080/rest/dark/archive/sunshine.
Expand Using the three "files" below to create our Authorization and ACL resources.Create these file to use as the ACLs and the group listing:
Code Block title Acl.ttl code@prefix webac: <http://fedora.info/definitions/v4/webac#> . <> a webac:Acl .
language text title Authacl_restricted.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . <> a acl:Authorization ; acl:agentagentGroup <http://example.org/grouplocalhost:8080/rest/groups/Restricted> ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/dark/archive> .
Code Block language text title Authacl_open.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a acl:Authorization ; acl:agentagentClass foaf:Agent ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/dark/archive/sunshine> .
The I would execute the following commands.
Code Block language text title group.ttl @prefix vcard: <http://www.w3.org/2006/vcard/ns#> . <> a vcard:Group ; vcard:hasMember <http://example.org/agent/jones456>
Run the following commands:
Code Block curl -XPUT
Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl_lock > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl_lock/auth1" http://localhost:8080/rest/acl_lockdark/auth1archive >curl echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT DATA { <> acl:accessControl <http-XPUT http://localhost:8080/rest/acl_lock> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "/dark/archive/sunshine curl -XPUT http://localhost:8080/rest/dark/archive" > curl -X POSTgroups/Restricted -H "'Content-typeType: text/turtle"' --data-binary "@Acl@group.ttl" curl -XPUT "http://localhost:8080/rest" http://localhost:8080/rest/acl_open > curl -X PUT -H "Content-type/dark/archive/fcr:acl -H 'Content-Type: text/turtle"' --data-binary "@Auth@acl_openrestricted.ttl" curl -XPUT "http://localhost:8080/rest/acl_open/auth2" http://localhost:8080/rest/acl_open/auth2 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT DATA { <> acl:accessControl <http://localhost:8080/rest/acl_open> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive/sunshine"dark/archive/sunshine/fcr:acl -H 'Content-Type: text/turtle' --data-binary @acl_open.ttl
The collection http://localhost:8080/rest/public_collection should be readable by anyone but only editable by users in the group Editors.
Expand Using the three "files" below to create our Authorization and ACL resources.
Code Block @prefix webac: <http://fedora.info/definitions/v4/webac#> . <> a webac:Acl .title Acl.ttl Create these file to use as the ACL and the group listing:
I would execute the followingCode Block title Auth1.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> <#authz_read> a acl:Authorization ; acl:agentagentClass foaf:Agent ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/public_collection> .
Code Block title Auth2.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . <> <#authz_read_write> a acl:Authorization ; acl:agentagentGroup <http://example.org/grouplocalhost:8080/rest/groups/Editors> ; acl:mode acl:Read, acl:Write ; acl:accessTo <http://localhost:8080/rest/public_collection> .
:Code Block language text title group.ttl @prefix vcard: <http://www.w3.org/2006/vcard/ns#> . <> a vcard:Group ; vcard:hasMember <http://example.org/agent/jones456>
Run the following commands:
Code Block curl -XPUT
Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest" http://localhost:8080/rest/acl > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth1.ttl" "http://localhost:8080/rest/aclpublic/auth1" collection curl -XPUT http://localhost:8080/rest/acl/auth1 > curl -X PUT -H "Content-typegroups/Editors -H 'Content-Type: text/turtle"' --data-binary "@Auth2@group.ttl" curl -XPUT "http://localhost:8080/rest/acl/auth2" http://localhost:8080/rest/acl/auth2 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT DATA { <> acl:accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/public_collection"public/collection/fcr:acl -H 'Content-Type: text/turtle' --data-binary @acl_restricted.ttl
Only the ex:publicImage type objects in the container http://localhost:8080/rest/mixedCollection are viewable by anyone, all others are only viewable by the group Admins.
Expand Create these file to use as the ACL and the group listing:
Code Block language text title acl Using the three "files" below to create our Authorization and ACL resources.
Code Block title Acl.ttl @prefix webacex: <http://fedoraexample.info/definitions/v4/webac#>org/terms#> . <> a webac:Acl .
Code Block title Auth_restricted.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> <#authz_restricted> a acl:Authorization ; acl:agentagentGroup <http://example.orglocalhost:8080/rest/group/Admins> ; acl:mode acl:Read ; acl:accessTo <http://localhost:8080/rest/mixedCollection> .
Code Block title Auth_open.ttl @prefix acl: <http://www.w3.org/ns/auth/acl#> . @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> <#authz_open> a acl:Authorization ; acl:agentagentClass foaf:Agent ; acl:mode acl:Read ; acl:accessToClass ex:publicImage .
I would execute the following commands:
Code Block > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http; acl:default <http://localhost:8080/rest" http://localhost:8080/rest/acl > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "/mixedCollection> .
Code Block language text title group.ttl @prefix vcard: <http://www.w3.org/2006/vcard/ns#> . <> a vcard:Group ; vcard:hasMember <http://example.org/agent/jones456>
Run the following commands:
Code Block curl -XPUT http://localhost:8080/rest/acl/auth1" mixedCollection curl -XPUT http://localhost:8080/rest/acl/auth1 > curl -X PUTgroups/Admins -H "'Content-typeType: text/turtle"' --data-binary "@Auth_open@group.ttl" curl -XPUT "http://localhost:8080/rest/acl/auth2" http://localhost:8080/rest/acl/auth2 > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#> INSERT DATA { <> acl:accessControl <http://localhost:8080/rest/acl> . }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/mixedCollection"mixedCollection/fcr:acl -H 'Content-Type: text/turtle' --data-binary @acl.ttl