You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@stanbol.apache.org by harish suvarna <hs...@gmail.com> on 2013/05/13 17:22:32 UTC
stanbol security
While running the stanbol server without -no-security option, and not using
--user and --paswd options, we are still able to get the enhancer request
fulfilled. I was hoping to see some authentication failure.
My intention is run the stanbol so that only users with userid/passwd are
able to run enhancement requests using restful calls. Restful calls without
userid/passwd known to stanbol should fail.
--
Thanks
Harish
Re: stanbol security
Posted by Reto Bachmann-Gmür <re...@apache.org>.
Harish,
There's a bit of documentation on
https://stanbol.apache.org/development/security.html.
To require a permission and trigger login the following needs to be done:
- introduce a class EnhancerPermssion, this would be similar to this one:
http://svn.apache.org/repos/asf/clerezza/trunk/rdf.web/rdf.web.core/src/main/java/org/apache/clerezza/rdf/web/core/SparqlEndpointAccessPermission.java
- Add the following line at the beginning of the enhanceContent methods in
the EnhancementJobManager
(WeightedJobManager/EventJobManagerImpl):AccessController
.checkPermission(new EnhancerPermssion());
Reto
On Fri, May 17, 2013 at 5:54 PM, harish suvarna <hs...@gmail.com> wrote:
> Reto,
> Thank you very much for the answer.
> How do we add a permission check to the enahncer? Does it involve any code?
> Can you please point us to any code examples to do this?
>
> -harish
>
>
> On Fri, May 17, 2013 at 3:22 AM, Reto Bachmann-Gmür <reto@wymiwyg.com
> >wrote:
>
> > Hi Harish,
> >
> > The enhancer does not currently require any particular permission. Only
> > some engines do.
> >
> > To achieve your goal we should add a permission check to the enhancer for
> > an EnhancerPermission. Then you could create user which have that
> > permission. I suggest to add this permission to the anonymous user (more
> > precisely to BasePermissionRole) so that requiring authentication for the
> > enhancer is optional (one has to remove this permission from
> > BasePermissionRole).
> >
> > Cheers,
> > Reto
> >
> >
> > On Mon, May 13, 2013 at 5:22 PM, harish suvarna <hs...@gmail.com>
> > wrote:
> >
> > > While running the stanbol server without -no-security option, and not
> > using
> > > --user and --paswd options, we are still able to get the enhancer
> request
> > > fulfilled. I was hoping to see some authentication failure.
> > >
> > > My intention is run the stanbol so that only users with userid/passwd
> are
> > > able to run enhancement requests using restful calls. Restful calls
> > without
> > > userid/passwd known to stanbol should fail.
> > >
> > > --
> > > Thanks
> > > Harish
> > >
> >
>
>
>
> --
> Thanks
> Harish
>
Re: stanbol security
Posted by harish suvarna <hs...@gmail.com>.
Reto,
Thank you very much for the answer.
How do we add a permission check to the enahncer? Does it involve any code?
Can you please point us to any code examples to do this?
-harish
On Fri, May 17, 2013 at 3:22 AM, Reto Bachmann-Gmür <re...@wymiwyg.com>wrote:
> Hi Harish,
>
> The enhancer does not currently require any particular permission. Only
> some engines do.
>
> To achieve your goal we should add a permission check to the enhancer for
> an EnhancerPermission. Then you could create user which have that
> permission. I suggest to add this permission to the anonymous user (more
> precisely to BasePermissionRole) so that requiring authentication for the
> enhancer is optional (one has to remove this permission from
> BasePermissionRole).
>
> Cheers,
> Reto
>
>
> On Mon, May 13, 2013 at 5:22 PM, harish suvarna <hs...@gmail.com>
> wrote:
>
> > While running the stanbol server without -no-security option, and not
> using
> > --user and --paswd options, we are still able to get the enhancer request
> > fulfilled. I was hoping to see some authentication failure.
> >
> > My intention is run the stanbol so that only users with userid/passwd are
> > able to run enhancement requests using restful calls. Restful calls
> without
> > userid/passwd known to stanbol should fail.
> >
> > --
> > Thanks
> > Harish
> >
>
--
Thanks
Harish
Re: stanbol security
Posted by Reto Bachmann-Gmür <re...@wymiwyg.com>.
Hi Harish,
The enhancer does not currently require any particular permission. Only
some engines do.
To achieve your goal we should add a permission check to the enhancer for
an EnhancerPermission. Then you could create user which have that
permission. I suggest to add this permission to the anonymous user (more
precisely to BasePermissionRole) so that requiring authentication for the
enhancer is optional (one has to remove this permission from
BasePermissionRole).
Cheers,
Reto
On Mon, May 13, 2013 at 5:22 PM, harish suvarna <hs...@gmail.com> wrote:
> While running the stanbol server without -no-security option, and not using
> --user and --paswd options, we are still able to get the enhancer request
> fulfilled. I was hoping to see some authentication failure.
>
> My intention is run the stanbol so that only users with userid/passwd are
> able to run enhancement requests using restful calls. Restful calls without
> userid/passwd known to stanbol should fail.
>
> --
> Thanks
> Harish
>