You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lenya.apache.org by th...@apache.org on 2006/09/01 12:03:47 UTC
svn commit: r439258 - in /lenya/docu/src/documentation/content/xdocs:
docs/1_4/reference/ac.xml site.xml
Author: thorsten
Date: Fri Sep 1 03:03:47 2006
New Revision: 439258
URL: http://svn.apache.org/viewvc?rev=439258&view=rev
Log:
Adding documentation about the restricted AC management to the documentation.
Added:
lenya/docu/src/documentation/content/xdocs/docs/1_4/reference/ac.xml (with props)
Modified:
lenya/docu/src/documentation/content/xdocs/site.xml
Added: lenya/docu/src/documentation/content/xdocs/docs/1_4/reference/ac.xml
URL: http://svn.apache.org/viewvc/lenya/docu/src/documentation/content/xdocs/docs/1_4/reference/ac.xml?rev=439258&view=auto
==============================================================================
--- lenya/docu/src/documentation/content/xdocs/docs/1_4/reference/ac.xml (added)
+++ lenya/docu/src/documentation/content/xdocs/docs/1_4/reference/ac.xml Fri Sep 1 03:03:47 2006
@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Copyright 1999-2004 The Apache Software Foundation
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+<!-- $Id: index.xml 55543 2004-10-26 00:14:59Z gregor $ -->
+
+<!DOCTYPE document PUBLIC "-//APACHE//DTD Documentation V2.0//EN"
+ "http://forrest.apache.org/dtd/document-v20.dtd">
+
+<document>
+ <header>
+ <title>Access Control Specification</title>
+ </header>
+ <body>
+ <section id="ac-intro">
+ <title>Access Control Specification</title>
+ <ul>
+ <li>Possibility to deny permissions</li>
+ </ul>
+ </section>
+ <section id="Terminology">
+ <title>Terminology</title>
+ <ul>
+ <li>An accreditable is either a user, a group, an IP range, or the world.</li>
+ <li>A credential is an assignment of a role to an accreditable.</li>
+ </ul>
+ </section>
+ <section id="Names">
+ <title>We use the following names.</title>
+ <ul>
+ <li>n - a node</li>
+ <li>parent(n) - the parent node of n</li>
+ <li>n.c1, ..., n.ci - the credentials of the node n</li>
+ <li>acc(c) - the accreditable which the credential refers to</li>
+ <li>role(c) - the role which the credential assignes to the accreditable</li>
+ <li>method(c) - the method of the credential</li>
+ </ul>
+ </section>
+ <section id="Concept">
+ <title>Concept</title>
+ <ul>
+ <li>Credential methods can be grant or deny.</li>
+ <li>The order of credentials at a node is important.</li>
+ <li>To find out if a certain accreditable a has a role r for the node n, use the following algorithm:
+ <ul>
+ <li>Search for the first matching credential, starting with the first credential of the node n.</li>
+ <li>If no credential of n matches the accreditable, continue with the parent node.</li>
+ <li>When a credential is found which assigns the role r to the accreditable a, return the method of the credential.</li>
+ <li>When a credential is found which assigns the role r to the accreditable a, return the method of the credential.</li>
+ </ul>
+ </li>
+ </ul>
+ </section>
+ <section id="resolving">
+ <title>Role resolving algorithm</title>
+ <ul>
+ <li>while not matched:
+ <ul>
+ <li>for c : n.ci to n.c1: + if acc(c) = a and role(c) = r, return method(c)</li>
+ <li>n := parent(n)</li>
+ </ul>
+ </li>
+ <li>return deny</li>
+ </ul>
+ </section>
+ <section id="gui">
+ <title>User interface</title>
+ <p>The user interface has to allow the following operations:</p>
+ <ul>
+ <li>add/remove credentials for users, groups, world</li>
+ <li>set the credential method</li>
+ <li>change credential order (move up/down)</li>
+ </ul>
+ </section>
+ <section id="samples">
+ <title>Examples</title>
+ <p>Like stated above the order of the credential is important. Credentials are builded
+ from policies. Imaginge you are trying to access
+ http://localhost:8888/default/introduction.html </p>
+ <p>The defined policy (with highest priority) would be:
+ config/ac/policies/introduction.html/subtree-policy.acml. Imaginge you have
+ defined:</p>
+ <source><![CDATA[<policy xmlns="http://apache.org/cocoon/lenya/ac/1.0">
+ <world>
+ <role id="visit" method="deny"/>
+ </world>
+ <group id="editor">
+ <role id="edit" method="grant"/>
+ </group>
+</policy>]]> </source>
+ <p>Then you try to login in with user "lenya" who is in the editor group. However you will
+ not be successful, because everybody always is world. Since the DENY of world is
+ coming first nobody will now be able to see the page. Changing above policy to </p>
+ <source><![CDATA[<policy xmlns="http://apache.org/cocoon/lenya/ac/1.0">
+ <group id="editor">
+ <role id="edit" method="grant"/>
+ </group>
+ <world>
+ <role id="visit" method="deny"/>
+ </world>
+</policy>]]> </source>
+ <p>Let all user of the group editor access the page.</p>
+ <p>Best practise is to deny access early in a node tree of policies for e.g. WORLD.
+ Meaning to define it e.g. in config/ac/policies/authoring/subtree-policy.acml</p>
+ </section>
+ </body>
+</document>
\ No newline at end of file
Propchange: lenya/docu/src/documentation/content/xdocs/docs/1_4/reference/ac.xml
------------------------------------------------------------------------------
svn:eol-style = native
Modified: lenya/docu/src/documentation/content/xdocs/site.xml
URL: http://svn.apache.org/viewvc/lenya/docu/src/documentation/content/xdocs/site.xml?rev=439258&r1=439257&r2=439258&view=diff
==============================================================================
--- lenya/docu/src/documentation/content/xdocs/site.xml (original)
+++ lenya/docu/src/documentation/content/xdocs/site.xml Fri Sep 1 03:03:47 2006
@@ -133,6 +133,7 @@
<reference href="reference/" label="Technical Reference">
<sitemaps14 href="lenya-sitemaps.html" label="Overview of Lenya Sitemaps" />
+ <ac-restricted href="ac.html" label="Access Control Specification"/>
<usecase-framework href="usecase-framework/" label="Usecase Framework">
<usecase-framework-overview href="index.html" label="Overview"/>
<abstractusecase href="abstractusecase.html" label="AbstractUsecase"/>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@lenya.apache.org
For additional commands, e-mail: commits-help@lenya.apache.org