svn commit: r902394 - in /websites/staging/sling/trunk/content: ./ documentation/bundles/resource-access-security.html

[bu...@apache.org]

Author: buildbot
Date: Wed Mar 19 21:44:26 2014
New Revision: 902394

Log:
Staging update by buildbot for sling

Modified:
    websites/staging/sling/trunk/content/   (props changed)
    websites/staging/sling/trunk/content/documentation/bundles/resource-access-security.html

Propchange: websites/staging/sling/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Wed Mar 19 21:44:26 2014
@@ -1 +1 @@
-1579410
+1579415

Modified: websites/staging/sling/trunk/content/documentation/bundles/resource-access-security.html
==============================================================================
--- websites/staging/sling/trunk/content/documentation/bundles/resource-access-security.html (original)
+++ websites/staging/sling/trunk/content/documentation/bundles/resource-access-security.html Wed Mar 19 21:44:26 2014
@@ -89,12 +89,27 @@
       
       
       <h1>Resource Access Security</h1>
-      <p>The ResourceAccessSecurity defines a service API which is used in two different context: for securing resource providers which have no own access control and on the application level to further restrict the access to resources in general. </p>
+      <div class="note">
+The description here is work in progress and not complete. The Resource Access Security bundle is not yet released.
+</div>
+
+<h2 id="summary">Summary</h2>
+<p>The ResourceAccessSecurity defines a service API which is used in two different context: for securing resource providers which have no own access control and on the application level to further restrict the access to resources in general. </p>
 <p>A resource access security service is registered with the service property CONTEXT. Allowed values are APPLICATION_CONTEXT and PROVIDER_CONTEXT. If the value is missing or invalid, the service will be ignored. </p>
 <p>In the context of resource providers, this service might be used for implementations of resource providers where the underlying persistence layer does not implement access control. The goal is to make it easy to implement a lightweight access control for such providers. For example, a JCR resource providers should <em>not</em> use the provider context resource access security - in a JCR context, security is fully delegated to the underlying repository, and mixing security models would be a bad idea. </p>
 <p>In the context of the application, this service might be used to add additional or temporary constraints across the whole resource tree. It is expected to only have a single service per context in the framework/application (much like the OSGi LogService or ConfigurationAdmin Service). In the case of multiple services per context, the one with the highest service ranking is used.</p>
+<h2 id="how-to-use-resourceaccesssecurity">How to use ResourceAccessSecurity</h2>
+<p>To let use Resource Resolver the ResourceAccessSecurity service simply add the resourceaccesssecurity bundle to your sling instance.
+The implementation of ResourceAccessSecurity defines a service provider interface named ResourceAccessGate.</p>
+<p>The ResourceAccessGate defines a service API which might be used to make some restrictions to accessing resources. Implementations of this service interface must be registered like ResourceProvider with a path (like provider.roots). If different ResourceAccessGateService services match a path, not only the ResourceAccessGateService with the longest path will be called, but all of them, that's in contrast to the ResourceProvider, but in this case more logical (and secure!). The gates will be called in the order of the service ranking. If one of the gates grants access for a given operation access will be granted. service properties: </p>
+<ul>
+<li>path: regexp to define on which paths the service should be called (default .*) </li>
+<li>operations: set of operations on which the service should be called ("read,create,update,delete,execute", default all of them) </li>
+<li>finaloperations: set of operations on which the service answer is final and no further service should be called (default none of them), except the GateResult is GateResult.CANT_DECIDE </li>
+</ul>
+<p>The resource access gate can either have the context PROVIDER_CONTEXT, in this case the gate is only applied to resource providers requesting the security checks. Or the context can be APPLICATION_CONTEXT. In this case the access gate is invoked for the whole resource tree. This is indicated by the required service property CONTEXT. If the property is missing or invalid, the service is ignored.</p>
       <div class="timestamp" style="margin-top: 30px; font-size: 80%; text-align: right;">
-        Rev. 1579410 by mykee on Wed, 19 Mar 2014 21:35:06 +0000
+        Rev. 1579415 by mykee on Wed, 19 Mar 2014 21:44:20 +0000
       </div>
       <div class="trademarkFooter"> 
         Apache Sling, Sling, Apache, the Apache feather logo, and the Apache Sling project