Preview release - RDF ABAC data access

[Andy Seaborne <an...@telicent.io>]

This is a preview open source release from Telicent of a system for 
data-level access control for Apache Jena Fuseki.

     https://github.com/Telicent-io/public-rdf-abac

The license is Apache License 2.0.

ABAC - Attribute Based Access Control - allows data owners to define and 
manage access controls. Different parts of an RDF dataset can be given 
different access requirements. These requirements control the visibility 
of the data for read access (SPARQL query or Graph Store Protocol). The 
access-controlled dataset is a view of the underlying RDF dataset.

The access requirements are expressed as labels on the data. Every 
triple has a set of labels associated with it. These labels can be 
specified at the triple level, or on all triples with a specific 
property, or on triples with the same subject.

A request has a set of attributes for the user (or software system) 
making the request. Triples are visible to the read request only if the 
attributes of the request satisfy the requirements specified by the data 
labels.

The access controls are self-contained and can be transported with the 
data.

A local user attribute store for stand-alone operation is provided in 
this preview release.

   Request: "status=employee".
   Visible Data:
   :s :p :o  -- label "status=employee || status=contractor".


Hierarchies are provided whereby some attribute values imply other 
attribute values.

    public < restricted < company confidential < company private

A request at level "company confidential" has visibility of data 
labelled with "company confidential", "restricted" or "public".

   Request: "level=confidential"
   Visible Data:
   :s :p :o  -- label "level=restricted"


This is a snapshot of on-going work within Telicent and the system is in 
active use and active development. Telicent primarily uses per-triple 
labelling.

Documentation:

https://github.com/Telicent-io/public-rdf-abac/blob/main/docs/abac.md

This preview release is subject to design change.
This is a source-only preview. There are no public maven artifacts.

User authentication is not part of this system.

This preview release has restrictions:

* Data labelling only applies to the default graph.
* Per graph access is not yet provided
   (c.f. 
https://jena.apache.org/documentation/fuseki2/fuseki-data-access-control)

     Andy

https://www.telicent.io/