WebAC ACL Interface #4

whikloj · 2015-08-25T18:43:18Z

No description provided.

awoods · 2015-08-25T18:50:18Z

src/main/java/org/fcrepo/auth/webac/AbstractFedoraWebAcl.java

+ * @author whikloj
+ * @since 2015-08-25
+ */
+public interface AbstractFedoraWebAcl {


Why "Abstract"FedoraWebAcl? Any reason not to drop the "Abstract" prefix?

This is an interface. It is in the Fedora codebase. Why does it have either Abstract or Fedora as part of its name?

peichman-umd · 2015-08-25T20:19:38Z

Would this interface be able to support a method that takes a resource and/or an agent (as URIs) and returns the authorization(s) that mention that resource and/or agent? Alternatively, a method that returned the list of authorizations in the ACL, and the client class could iterate over that list to find the authorizations that were relevant to its interests? If either of these are desired, I would suggest an additional interface/class to represent a single authorization ("authorization" being the WebAC terminology for a single rule relating an agent(Class) to an accessTo(Class) resource with an access mode.

awoods · 2015-08-25T20:32:00Z

@peichman-umd, Although per the WebAC "spec", agents are represented as URIs. My understanding was that most installations would only be able to support Strings.

How are you defining "authorizations"? I thought this interface represented a single "authorization", i.e. all principals that have these modes on these resources (and resource classes).

peichman-umd · 2015-08-25T20:40:23Z

@awoods, The way I read the WebAC "spec", an ACL is a graph containing one or more acl:Authorization resources, which all seem to be represented as blank nodes with acl:accessTo, acl:agent, acl:mode, etc. properties. Thus I was assuming that an ACL class would represent that graph.

Maybe this is a case of terminological confusion? If so, I would suggest renaming this interface to something like WebACAuthorization.

peichman-umd · 2015-08-25T20:47:18Z

@awoods, For the issue of representing agents as strings or URIs, would the new acct: URI scheme (RFC 7565) help at all? It is specifically designed to make no commitment about how the URIs are resolved, it is just for naming accounts on a particular system. The only issue might be what to put in the host section of the URI.

awoods · 2015-08-25T20:52:15Z

From: https://wiki.duraspace.org/display/FF/2015-07-22+-+WebAccessControl+Authorization+Delegate+Planning+Meeting
"Probably not using URIs for agents at least at first"

ajs6f · 2015-08-25T20:52:35Z

Those acl:Authorizations don't have to be blank nodes, right? They could be something more sane, like hash-URI nodes.

whikloj · 2015-08-25T20:52:41Z

My grasp of some of the W3C lingo is weak. But based on this
"Note that there are properties of an Authorization which allow you to specify who gets access either by giving a relation to a specific user or a different relation to a class of user. The same technique is used for expressing to which resource or class of resources access is being granted."

My assumption is that one Authorization contains:

1 or more triples with a predicate from the set [acl:agent, acl:agentClass]
1 or more triples with a predicate from the set [acl:accessTo, acl:accessToClass]
1 triple with the predicate acl:mode

awoods · 2015-08-25T20:55:24Z

@whikloj, I had a similar representation in mind. I think we need to take a moment and decide on a clear, clean, consistent perspective on how Authorizations are represented in the repository.

peichman-umd · 2015-08-25T20:56:24Z

@ajs6f Yes, the Authorizations could definitely be hash-URI nodes.
@whikloj Yes, that fits with my reading of Authorization as well.

whikloj · 2015-08-25T21:01:53Z

Ok, I can change the name to WebACAuthorization.

As for your first question @peichman-umd.

As the acl:mode will be the same for all users and resources referenced by this ACL.
The only check is whether the agent exists in the ACL. Not sure this is the right place for that check.

awoods · 2015-08-25T21:05:08Z

Is there a reason to even create hash resources? In other words, does an ACL resource need to contain a sub-graph of Authorizations, versus simply having all of the triples @whikloj described attached to the ACL resource itself?

whikloj · 2015-08-26T14:06:45Z

@awoods, I don't think so. Based on my understanding we would have simple triples on the Acl resource where the Acl resource would always be the subject.

peichman-umd · 2015-08-26T14:22:53Z

@whikloj: The way I have been reading the W3C spec is that the ACL is never actually the subject of any triples. There is an acl:acl property on a protected resource that identifies the location of its ACL, but that is just a URI to be retrieved.

awoods · 2015-08-26T14:28:57Z

@peichman-umd, are you saying that your understanding is that "protected resources" have a property that points to their ACL?

peichman-umd · 2015-08-26T14:31:53Z

@awoods That was my understanding of this section of the spec: http://www.w3.org/wiki/WebAccessControl#Modifying_Access_Control_information

whikloj · 2015-08-26T14:32:18Z

@peichman-umd, yes I see what you mean.
But then I can't understand how we handle the accessToClass functions. If the acl is not the subject of the triple that provides acl:accessToClass to rdf:type, what is?

peichman-umd · 2015-08-26T14:36:05Z

@whikloj, I think it is the Authorization. Note that the ontology does not actually define a class for the ACLs, which suggests that they are not intended to be RDF resources themselves. Instead, I think the ACL is supposed to be used as just a URL where a graph of authorizations can be retrieved.

ajs6f · 2015-08-26T14:39:43Z

I have no understanding of nor opinion about this issue, but just from the diction and tone of this conversation, perhaps this is a question best put to whomever is writing or maintaining WebAC?

peichman-umd · 2015-08-26T14:47:47Z

Also, from the WAC and LDP section:

So even though the acl file is neither an LDPR nor an LDPC it should be editable using the same methods.

ajs6f · 2015-08-26T14:49:16Z

This seems a bit confusing: maybe check with the (ex-)LDP WG for some clarification? @azaroth42?

awoods · 2015-08-26T19:24:15Z

src/main/java/org/fcrepo/auth/webac/WebACAuthorization.java

+     * Set/Modify the acl:agents of this ACL.
+     * @param users a Set of agents
+     */
+    void setUsers(Set<String> users);


Should we use acl:Agent terminology? If so, are userIds different than groupIds?

acoburn · 2015-08-27T13:30:41Z

src/main/java/org/fcrepo/auth/webac/WebACAuthorization.java

+     * Set/Modify the rdf:types to apply this ACL to.
+     * @param objectClasses set of RDF objects
+     */
+    void setObjectClasses(Set<RDF> objectClasses);


peichman-umd · 2015-08-27T19:05:06Z

👍

acoburn · 2015-08-27T19:34:04Z

👍

whikloj · 2015-08-27T20:22:21Z

I agree, what fine work. Someone press the button.

awoods · 2015-08-27T20:23:57Z

Someone should squash the commits before pressing the button.

whikloj · 2015-08-27T20:26:07Z

I'll give it a try, never done that before.

awoods · 2015-08-27T20:27:45Z

i.e.

git checkout --track origin pull/4
git log
git rebase -i

"pick" first, "s" others
update comment

git push origin pull/4:master

Assuming you already did a "git pull" with the following ".git/config" update:

[remote "origin"]
        url = https://github.com/fcrepo4-labs/fcrepo-module-auth-webac.git
        fetch = +refs/heads/*:refs/remotes/origin/*
        fetch = +refs/pull/*/head:refs/remotes/origin/pull/*

whikloj · 2015-08-27T21:00:32Z

I hope that works.

awoods · 2015-08-27T21:04:07Z

I does not look like it. Now I see 7 commits instead of one squashed commit. Was that intentional, @whikloj?

whikloj · 2015-08-28T00:49:17Z

Sorry, I should have asked. I just removed some of the commits. I'll squash it all.

Change permissions to modes Change interface name Make method names closer to spec Removing setters acl:agents cover both users and groups Object classes are URIs Re-add agentClasses rename methods change Set<URI> to Set<String> for getAccessToURIs() Update javadoc

WebAC ACL Interface

LIBFCREPO-1061. Reuse the cachedAclHandle if the session is still live.

awoods reviewed Aug 25, 2015
View reviewed changes

mohideen mentioned this pull request Aug 25, 2015

Created AuthorizationHandler interface. #7

Closed

whikloj force-pushed the jareds-acl-branch branch from 8cb44ee to 5d56184 Compare August 26, 2015 14:02

awoods reviewed Aug 26, 2015
View reviewed changes

acoburn reviewed Aug 27, 2015
View reviewed changes

whikloj force-pushed the jareds-acl-branch branch from 1b5f9dd to 8b04366 Compare August 27, 2015 20:52

WebAC ACL Interface

187f993

Change permissions to modes Change interface name Make method names closer to spec Removing setters acl:agents cover both users and groups Object classes are URIs Re-add agentClasses rename methods change Set<URI> to Set<String> for getAccessToURIs() Update javadoc

whikloj force-pushed the jareds-acl-branch branch from 8b04366 to 187f993 Compare August 28, 2015 00:51

awoods pushed a commit that referenced this pull request Aug 28, 2015

Merge pull request #4 from fcrepo4-labs/jareds-acl-branch

7b4f093

WebAC ACL Interface

awoods merged commit 7b4f093 into master Aug 28, 2015

awoods deleted the jareds-acl-branch branch August 28, 2015 02:26

peichman-umd added a commit to peichman-umd/fcrepo-module-auth-webac that referenced this pull request Nov 7, 2023

Merge pull request fcrepo4#4 from peichman-umd/feature/LIBFCREPO-1061

13c596e

LIBFCREPO-1061. Reuse the cachedAclHandle if the session is still live.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WebAC ACL Interface #4

WebAC ACL Interface #4

whikloj commented Aug 25, 2015

awoods Aug 25, 2015

ajs6f Aug 25, 2015

peichman-umd commented Aug 25, 2015

awoods commented Aug 25, 2015

peichman-umd commented Aug 25, 2015

peichman-umd commented Aug 25, 2015

awoods commented Aug 25, 2015

ajs6f commented Aug 25, 2015

whikloj commented Aug 25, 2015

awoods commented Aug 25, 2015

peichman-umd commented Aug 25, 2015

whikloj commented Aug 25, 2015

awoods commented Aug 25, 2015

whikloj commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

awoods commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

whikloj commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

ajs6f commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

ajs6f commented Aug 26, 2015

awoods Aug 26, 2015

acoburn Aug 27, 2015

peichman-umd commented Aug 27, 2015

acoburn commented Aug 27, 2015

whikloj commented Aug 27, 2015

awoods commented Aug 27, 2015

whikloj commented Aug 27, 2015

awoods commented Aug 27, 2015

whikloj commented Aug 27, 2015

awoods commented Aug 27, 2015

whikloj commented Aug 28, 2015

WebAC ACL Interface #4

WebAC ACL Interface #4

Conversation

whikloj commented Aug 25, 2015

awoods Aug 25, 2015

Choose a reason for hiding this comment

ajs6f Aug 25, 2015

Choose a reason for hiding this comment

peichman-umd commented Aug 25, 2015

awoods commented Aug 25, 2015

peichman-umd commented Aug 25, 2015

peichman-umd commented Aug 25, 2015

awoods commented Aug 25, 2015

ajs6f commented Aug 25, 2015

whikloj commented Aug 25, 2015

awoods commented Aug 25, 2015

peichman-umd commented Aug 25, 2015

whikloj commented Aug 25, 2015

awoods commented Aug 25, 2015

whikloj commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

awoods commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

whikloj commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

ajs6f commented Aug 26, 2015

peichman-umd commented Aug 26, 2015

ajs6f commented Aug 26, 2015

awoods Aug 26, 2015

Choose a reason for hiding this comment

acoburn Aug 27, 2015

Choose a reason for hiding this comment

peichman-umd commented Aug 27, 2015

acoburn commented Aug 27, 2015

whikloj commented Aug 27, 2015

awoods commented Aug 27, 2015

whikloj commented Aug 27, 2015

awoods commented Aug 27, 2015

whikloj commented Aug 27, 2015

awoods commented Aug 27, 2015

whikloj commented Aug 28, 2015