strawman delegate implementation #8

acoburn · 2015-08-27T21:07:10Z

This doesn't even pretend to be a correct implementation (it doesn't even consider type-based accessToClass resources), but it is a start. Please feel free to tear it apart!

awoods · 2015-08-27T21:20:17Z

src/main/java/org/fcrepo/auth/webac/WebACAuthorizationDelegate.java

+
+        final List<URI> actionURIs = actionsAsURIs(actions);
+
+        final Optional<URI> effectiveACL = getEffectiveAcl(new FedoraResourceImpl(userSession.getNode(absPath)));


We may need an "internal-session" as the userSession will likely not have permissions to read the ACL resources.

awoods · 2015-08-27T21:30:57Z

As a side note, we will need a WebAC implementation of AccessRolesProvider:
https://github.com/fcrepo4/fcrepo-module-auth-rbacl/blob/master/fcrepo-auth-roles-common/src/main/java/org/fcrepo/auth/roles/common/AbstractRolesAuthorizationDelegate.java#L53

acoburn · 2015-08-27T22:18:36Z

I would also note that I used Optional<boolean> instead of a more straight-forward Predicate because we actually need to differentiate between null, true and false, where true means "permit the operation", false means "deny the operation" and null means try the next authorization mechanism (starting with user, then moving to group and finally trying rdf:type for acl:accessToClass properties). If none of those provide a non-null response, then deny the request (i.e. permit = false).

whikloj · 2015-08-28T13:25:30Z

src/main/java/org/fcrepo/auth/webac/WebACAuthorizationDelegate.java

@@ -15,6 +15,17 @@
 */
 package org.fcrepo.auth.webac;

+// The WEBAC_HAS_ACL variable does not exist (we don't even have a namespace for it yet).
+import static org.fcrepo.auth.webac.URIConstants.WEBAC_HAS_ACL;


Could we use acl:accessControl for this? From the ontology

<rdf:Property rdf:about="http://www.w3.org/ns/auth/acl#accessControl"> <comment>The Access Control file for this information resource. This may of course be a virtual resorce implemented by the access control system. Note also HTTP's header Link: foo.meta ;rel=meta can be used for this.</comment> <domain rdf:resource="http://www.w3.org/2006/gen/ont#InformationResource"/> <label>access control</label> <range rdf:resource="http://www.w3.org/2006/gen/ont#InformationResource"/> <subPropertyOf rdf:resource="http://www.w3.org/2000/01/rdf-schema#seeAlso"/> </rdf:Property>

@whikloj, that property seems appropriate.

👍 nice call

awoods · 2015-08-28T13:41:08Z

@acoburn, are we actually planning on hijacking acl:accessToClass? Do you not have concerns about then changing gears in phase two towards dereferencing those URIs to get the membership of those "groups"?
Unless we do not have such phase-two plans.

acoburn · 2015-08-28T14:27:51Z

@awoods If you look at the examples in the WebAC wiki, you will see that acl:accessToClass is used, e.g. to reference foaf:Document. The range is any rdfs:Class of resources, so using that to reference ex:AdminImage or ex:ArchivalObject as in:

<> acl:accessToClass ex:ArchivalObject, ex:AdminImage ;
    acl:agent <http://myinstitution.edu/groups/admins> ;
    acl:mode acl:Read, acl:Write .

Do you feel that this diverges from what the WebACL document lays out?

awoods · 2015-08-28T14:33:49Z

@acoburn, nevermind... I was mentally hooked on acl:agentClass not acl:accessToClass. Disregard.

acoburn · 2015-08-28T14:36:26Z

src/main/java/org/fcrepo/auth/webac/WebACAuthorizationDelegate.java

+        map.put("DELETE", WEBAC_MODE_WRITE);
+        map.put("PATCH", WEBAC_MODE_WRITE);
+        map.put("OPTIONS", WEBAC_MODE_READ);
+        actionMap = Collections.unmodifiableMap(map);


I have no idea if this matches any type of reality. Is the actions array (below) composed of Strings like "GET", or "POST"? Without knowing any better, that's what I'm assuming.

Incidentally, if @acoburn is correct, this is one reason why we don't want to have resources created or updated or deleted by requests to URIs that aren't their own.

awoods · 2015-09-01T19:21:39Z

Are we scrapping this PR in favor of a new one? or is there a plan for closure today?

acoburn · 2015-09-01T19:23:57Z

I'm still working on this PR, though it is dependent on @whikloj and the creation of a WebACRolesProvider interface

whikloj · 2015-09-02T03:18:00Z

Sorry, but I thought @mohideen was going to work on the WebACRolesProvider implementation as he was already working on the AuthHandler interface, I was working on the WebACAuthenticationImpl. Did I get that mixed up?

…JCR session.

https://docs.jboss.org/author/display/MODE/Custom+authentication+providers

acoburn · 2015-09-04T02:58:40Z

Added unit tests with the provided TTL resources. Added more debugging log output. Need to add more comments, and have support for acls residing on ancestor nodes.

Conflicts: src/main/java/org/fcrepo/auth/webac/WebACAuthorizationDelegate.java src/main/java/org/fcrepo/auth/webac/impl/WebACAccessRolesProvider.java src/test/java/org/fcrepo/auth/webac/impl/WebACAccessRolesProviderTest.java

REGISTER_TYPE CREATE_WORKSPACE DELETE_WORKSPACE RESTORE Added: ADD_NODE

Updated the Map with ModeshapePermissions to WebAC access modes.

Removed RBACL-based test class. Added license header, and move WebACRecipesIT into the correct package.

acoburn · 2015-09-05T18:38:06Z

This PR is now deprecated in favor of #28 (and other yet-to-be-issued PRs)

awoods · 2015-09-06T00:17:59Z

@acoburn, please feel free to close this PR if that is the intent of your previous comment.

awoods reviewed Aug 27, 2015
View reviewed changes

whikloj reviewed Aug 28, 2015
View reviewed changes

acoburn reviewed Aug 28, 2015
View reviewed changes

acoburn force-pushed the delegate_impl branch 3 times, most recently from d294e09 to d51d883 Compare September 3, 2015 16:23

acoburn and others added 4 commits September 3, 2015 12:24

strawman delegate implementation

cee057f

added accessToClass stubs and use of acl:accessControl property

be5f909

Get the agent string from the Fedora user principal attribute in the …

f5e9e67

…JCR session.

added AccessRolesProvider implementation

3069cb9

acoburn force-pushed the delegate_impl branch from d51d883 to 3069cb9 Compare September 3, 2015 16:25

acoburn and others added 7 commits September 3, 2015 12:32

checkstyle, dead code cleanup

cc91941

strawman delegate implementation

e3f8bfd

added accessToClass stubs and use of acl:accessControl property

992071f

Get the agent string from the Fedora user principal attribute in the …

32d9a2c

…JCR session.

added AccessRolesProvider implementation

f663c0d

Updated the Map with ModeshapePermissions to WebAC access modes.

4b1b4ba

https://docs.jboss.org/author/display/MODE/Custom+authentication+providers

added working unit tests with provided resources

ce2d1d6

acoburn force-pushed the delegate_impl branch from cc91941 to ce2d1d6 Compare September 4, 2015 02:55

added documentation; support for acl-bearing parent

b5de8b4

added tests for locating ACLs on parent resources

943d460

acoburn mentioned this pull request Sep 4, 2015

Created AuthorizationHandler interface. #7

Closed

mohideen and others added 13 commits September 4, 2015 11:26

Merge branch 'delegate_impl' into delegate_impl_local

9e3ffcb

Conflicts: src/main/java/org/fcrepo/auth/webac/WebACAuthorizationDelegate.java src/main/java/org/fcrepo/auth/webac/impl/WebACAccessRolesProvider.java src/test/java/org/fcrepo/auth/webac/impl/WebACAccessRolesProviderTest.java

Removed:

5abe98f

REGISTER_TYPE CREATE_WORKSPACE DELETE_WORKSPACE RESTORE Added: ADD_NODE

Merge pull request #19 from mohideen/delegate_impl

4b4eba0

Updated the Map with ModeshapePermissions to WebAC access modes.

Adding new Fedora WebAC namespace and resource

084c792

Update FedoraWebACSecurityContextTests to get to ground zero

59aa4b4

Updated README.

9610ce1

remove use of FedoraWebACUserSecurityContext

ef05e9f

Remove: WebACRolesReaderIT

02f2ab7

Created no-op integration test class.

e238898

Removed RBACL-based test class. Added license header, and move WebACRecipesIT into the correct package.

strawman delegate implementation

96befa9

added accessToClass stubs and use of acl:accessControl property

a4460fa

added working unit tests with provided resources

fc04515

added debug logging

ad7ca8d

acoburn mentioned this pull request Sep 5, 2015

Roles provider #28

Closed

acoburn closed this Sep 6, 2015

acoburn deleted the delegate_impl branch September 8, 2015 11:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

strawman delegate implementation #8

strawman delegate implementation #8

acoburn commented Aug 27, 2015

awoods Aug 27, 2015

awoods commented Aug 27, 2015

acoburn commented Aug 27, 2015

whikloj Aug 28, 2015

awoods Aug 28, 2015

acoburn Aug 28, 2015

awoods commented Aug 28, 2015

acoburn commented Aug 28, 2015

awoods commented Aug 28, 2015

acoburn Aug 28, 2015

ajs6f Aug 28, 2015

awoods commented Sep 1, 2015

acoburn commented Sep 1, 2015

whikloj commented Sep 2, 2015

acoburn commented Sep 4, 2015

acoburn commented Sep 5, 2015

awoods commented Sep 6, 2015


		final List<URI> actionURIs = actionsAsURIs(actions);

		final Optional<URI> effectiveACL = getEffectiveAcl(new FedoraResourceImpl(userSession.getNode(absPath)));

strawman delegate implementation #8

strawman delegate implementation #8

Conversation

acoburn commented Aug 27, 2015

awoods Aug 27, 2015

Choose a reason for hiding this comment

awoods commented Aug 27, 2015

acoburn commented Aug 27, 2015

whikloj Aug 28, 2015

Choose a reason for hiding this comment

awoods Aug 28, 2015

Choose a reason for hiding this comment

acoburn Aug 28, 2015

Choose a reason for hiding this comment

awoods commented Aug 28, 2015

acoburn commented Aug 28, 2015

awoods commented Aug 28, 2015

acoburn Aug 28, 2015

Choose a reason for hiding this comment

ajs6f Aug 28, 2015

Choose a reason for hiding this comment

awoods commented Sep 1, 2015

acoburn commented Sep 1, 2015

whikloj commented Sep 2, 2015

acoburn commented Sep 4, 2015

acoburn commented Sep 5, 2015

awoods commented Sep 6, 2015