The Fedora WebAC authorization Fedora module is an implementation of the W3C's still evolving draft by the W3C that proposes a of an RDF-based decentralized authorization mechanism. See WebAccessControl specifications at the W3C website. policy mechanism.
W3C's definition of WebAccessControl
From the WebAccessControl specifications at the W3C website:
WebAccessControl is a decentralized system for allowing different users and groups various forms of access to resources where users and groups are identified by HTTP URIs.
...
The WebAC module will enforce access control based on the Access Control List (ACL) RDF resource associated with the requested resource. In WebAC, an Access Control List ( ACL ) consists of a set of Authorizations. An Each Authorization is a single rule for access, such as "users alice and bob may write to resource foo", described with a set of RDF properties. Authorizations have the RDF type http://www.w3.org/ns/auth/acl#Authorization (for .
For the remainder of this document, the http://www.w3.org/ns/auth/acl# namespace will be abbreviated with the prefix acl:).
Authorizations
The properties that may be used on an acl:Authorization are:
| Property | Meaning | ||
|---|---|---|---|
acl:accessTo | the URI of the protected resource | ||
acl:agent | the user (in the W3C spec, the user is named with a URI, but Fedora's implementation uses string usernames instead) | ||
acl:mode | the type of | acl:mode | the type of access (WebAC defines several modes: acl:Read, acl:Write, acl:Append, and acl:Control) |
acl:accessToClass | an RDF class of protected resources (N.B., not implemented in the first version of this module) | ||
acl:agentClass | an RDF class a group of users (N.B., not implemented in the first version of this module)defined as a foaf:Group resource listing its users with the foaf:memeber property) |
For a more detailed explanation of Authorizations and their properties, see WebAC Authorizations.
Examples of Authorizations
The user userA can Read document foo
Code Blockpanel language text @prefix acl: <http<http://www.w3.org/ns/auth/acl#>
acl#> <> a acl:Authorization ;
acl:accessTo </foo> ;
acl:mode acl:Read;
acl:agent </agents/userA>"userA" .Users in NewsEditor group can Write to any resource of type ex:News
Code Block language text @prefix acl: <http<http://www.w3.org/ns/auth/acl#>/acl#> . @prefix ex: <http://example.org/ns#> . <> a acl:Authorization ; acl:accessToClass ex:News ; acl:mode acl:Read, acl:Write; acl:agentClass </agents/NewsEditor> .
Code Block language text title /agents/NewsEditors @prefix foaf: <http://xmlns.com/foaf/0.1/> . <> a aclfoaf:Authorization ;
acl:accessToClass ex:News ;
acl:mode acl:Read, acl:Write;
acl:agentClass </agents/NewsEditor> Group; foaf:member "editor1", "editor2".
Storing WebAC ACLs in Fedora 4
In Fedora 4, an ACL is a ldp::BasicContainer resource with the additional RDF type of http://fedora.info/definitions/v4/webac#Aclwebac#Acl. This class is part of the Fedora WebAC ontology. Its children should each be resources of type acl:Authorization. It is given the namespace prefix webac: by convention.
Protecting Resources
A resource specifies the location of its ACL using the acl:accessControl property. If a resource itself does not specify an ACL, its parent containers are inspected, and the first specified ACL found is used as the ACL for the requested resource. If no ACLs are found, the default policy is to deny access to the requested resource.
Steps in determining the effective authorization
Finding the ACL:
- Get the ACL of the requested resource, if exists, else.
- Get the ACL of the next ancestor recursively (using either ldp:contains or fedora:hasParent), if exists, else.
- If no more ancestor exist (root node reached) and no ACL is found: Deny access.
...