The Fedora WebAC authorization module is an implementation of the W3C's still evolving draft of an RDF-based decentralized authorization policy mechanism.

W3C's definition of WebAccessControl

From the WebAccessControl description at the W3C website:

WebAccessControl is a decentralized system for allowing different users and groups various forms of access to resources where users and groups are identified by HTTP URIs.

The WebAC module will enforce access control based on the Access Control List (ACL) RDF resource associated with the requested resource. In WebAC, an ACL consists of a set of Authorizations. Each Authorization is a single rule for access, such as "users alice and bob may write to resource foo", described with a set of RDF properties. Authorizations have the RDF type  http://www.w3.org/ns/auth/acl#Authorization .

For the remainder of this document, the http://www.w3.org/ns/auth/acl# namespace will be abbreviated with the prefix acl:.

Access Control Lists (ACLs)

An ACL is an RDF document (RDFSource) that contains WebAC statements that authorize access to repository resources.  Each resource may have their own ACL, or implicitly be subject to the ACL of a parent container.   The location of the acl for a given resource may be discovered via a Link header with relation rel=acl.  

If a resource does not have an individual ACL (and therefore relies on an implicit ACL from a parent), this link header will still be present, but will return a 404.  This is because the location of ACLs is solely determined by the server, much like the automatically-created LDP-RS descriptions for binary resources.  The key difference is that Fedora does not create ACLs automatically, only their location. 

Therefore, to discover whether a resource has an individual ACL, a client would need to:

1. Perform a HEAD or GET against the resource,
2. Find the link header
3. Do a GET or HEAD against the ACL location, and see if returns 200 or 404.

To create an ACL for a resource that does not already have one, a client needs to discover the ACL location (via HEAD or GET), then PUT to that location.

Authorizations

Authorizations are the permissions statements contained within an ACL document.  An ACL may contain many authorizations, each of which must share the same subject.  The way this is achieved is via hash URIs:

@prefix acl: <http://www.w3.org/ns/auth/acl#>

<#auth1> a acl:Authorization .

The properties that may be used on an acl:Authorization are:

For a more detailed explanation of Authorizations and their properties, see WebAC Authorizations.

Agents

Agents are the users of Fedora.  These identify the principles (in a security sense) have made authenticated requests to the repository.  In ACL Authorizations used by Fedora, these may be represented as strings or as URIs.  The SOLID WebAC spec stipulates that agents are identified by URIs, and suggests (but does not have any normative language requiring) that these URIs are intended to be WebIDs.   The Fedora specification does not comment on the topic of identifying agents.  Nevertheless, for legacy purposes, the Fedora 5.x software allows strings or URIs to identify agents (e.g. "bob" or <http://example.org/people/bob>).  When using URIs, there is no expectation be Fedora that these URIs be resolvable, or have a representation.

Examples of Authorizations

1. The user userA can Read document foo

   @prefix acl: <http://www.w3.org/ns/auth/acl#>
   
   <#auth1> a acl:Authorization ;
       acl:accessTo </fcrepo/rest/foo> ;
       acl:mode acl:Read;
       acl:agent "userA" .

2. Users in NewsEditor group can Write to any resource of type ex:News

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   @prefix ex: <http://example.org/ns#> .
   
   <#auth2> a acl:Authorization ;
       acl:accessToClass ex:News ;
       acl:mode acl:Read, acl:Write;
       acl:agentClass <fcrepo/rest/agents/NewsEditors> .

   /agents/NewsEditors

   @prefix foaf: <http://xmlns.com/foaf/0.1/> .
   
   <> a foaf:Group;
       foaf:member "editor1", "editor2".

3. The user userB can Read document foo (This involves setting a system property for the servlet container, e.g. -Dfcrepo.auth.webac.userAgent.baseUri=http://example.org/agents/)

   @prefix acl: <http://www.w3.org/ns/auth/acl#>
   
   <#auth3> a acl:Authorization ;
       acl:accessTo </fcrepo/rest/foo> ;
       acl:mode acl:Read;
       acl:agent <http://example.org/agents/userB> .

Protecting Resources

A resource specifies the location of its ACL using the acl:accessControl property. If a resource itself does not specify an ACL, its parent containers are inspected, and the first specified ACL found is used as the ACL for the requested resource. If no ACLs are found, a filesystem-based ACL will be checked, the default policy of which is to deny access to the requested resource.

Example Scenarios

These scenarios assume that Fedora has been configured to use fcrepo.auth.webac.userAgent.baseUri=http://example.org/agent/ and fcrepo.auth.webac.groupAgent.baseUri=http://example.org/group/

1. I want to allow a user with username "smith123" to have read, write access to resource http://localhost:8080/rest/webacl_box1.
   

   Click here to expand...

   Using the two "files" below to create our Authorization and ACL resources.

   Acl.ttl

   @prefix webac: <http://fedora.info/definitions/v4/webac#> .
   <> a webac:Acl .
   

   Authorization.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   <> a acl:Authorization ;
      acl:agent <http://example.org/agent/smith123> ;
      acl:mode acl:Read, acl:Write ;
      acl:accessTo <http://localhost:8080/rest/webacl_box1> .

   We would execute the following commands.

   > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
   
   http://localhost:8080/rest/acl
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1"
   
   http://localhost:8080/rest/acl/auth1
   
   > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
   INSERT DATA {
   <> acl:accessControl <http://localhost:8080/rest/acl> .
   }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/webacl_box1"

2. I want to let the group "Editors" have read, write access on all the items in the collection "http://localhost:8080/rest/box/bag/collection"
   

   Click here to expand...

   Using the two "files" below to create our Authorization and ACL resources.

    

   Acl.ttl

   @prefix webac: <http://fedora.info/definitions/v4/webac#> .
   <> a webac:Acl .

   Authorization.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   <> a acl:Authorization ;
      acl:agent <http://example.org/group/Editors> ;
      acl:mode acl:Read, acl:Write ;
      acl:accessTo <http://localhost:8080/rest/box/bag/collection> .

   We would execute the following commands.

   > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
   
   http://localhost:8080/rest/acl
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Authorization.ttl" "http://localhost:8080/rest/acl/auth1"
   
   http://localhost:8080/rest/acl/auth1
   
   > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
   INSERT DATA {
   <> acl:accessControl <http://localhost:8080/rest/acl> .
   }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/box/bag/collection"

3.  I would like the collection http://localhost:8080/rest/dark/archive to be viewable only by the groupId "Restricted", but I would like to allow anyone to view the resource http://localhost:8080/rest/dark/archive/sunshine.

   Click here to expand...

   Using the three "files" below to create our Authorization and ACL resources.

   Acl.ttl

   @prefix webac: <http://fedora.info/definitions/v4/webac#> .
   <> a webac:Acl .

   Auth_restricted.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   <> a acl:Authorization ;
      acl:agent <http://example.org/group/Restricted> ;
      acl:mode acl:Read ;
      acl:accessTo <http://localhost:8080/rest/dark/archive> .

   Auth_open.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   @prefix foaf: <http://xmlns.com/foaf/0.1/> .
   <> a acl:Authorization ;
      acl:agent foaf:Agent ;
      acl:mode acl:Read ;
      acl:accessTo <http://localhost:8080/rest/dark/archive/sunshine> .

   The I would execute the following commands.

   > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
   
   http://localhost:8080/rest/acl_lock
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl_lock/auth1"
   
   http://localhost:8080/rest/acl_lock/auth1
   
   > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
   INSERT DATA {
   <> acl:accessControl <http://localhost:8080/rest/acl_lock> .
   }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive"
   
   > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
   
   http://localhost:8080/rest/acl_open
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_open.ttl" "http://localhost:8080/rest/acl_open/auth2"
   
   http://localhost:8080/rest/acl_open/auth2
   
   > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
   INSERT DATA {
   <> acl:accessControl <http://localhost:8080/rest/acl_open> .
   }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/dark/archive/sunshine"

4. The collection http://localhost:8080/rest/public_collection should be readable by anyone but only editable by users in the group Editors.

   Click here to expand...

   Using the three "files" below to create our Authorization and ACL resources.

   Acl.ttl

   @prefix webac: <http://fedora.info/definitions/v4/webac#> .
   <> a webac:Acl .

   Auth1.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   @prefix foaf: <http://xmlns.com/foaf/0.1/> .
   <> a acl:Authorization ;
      acl:agent foaf:Agent ;
      acl:mode acl:Read ;
      acl:accessTo <http://localhost:8080/rest/public_collection> .

   Auth2.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   <> a acl:Authorization ;
      acl:agent <http://example.org/group/Editors> ;
      acl:mode acl:Read, acl:Write ;
      acl:accessTo <http://localhost:8080/rest/public_collection> .

   I would execute the following code:

   > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
   
   http://localhost:8080/rest/acl
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth1.ttl" "http://localhost:8080/rest/acl/auth1"
   
   http://localhost:8080/rest/acl/auth1
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth2.ttl" "http://localhost:8080/rest/acl/auth2"
   
   http://localhost:8080/rest/acl/auth2
   
   > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
   INSERT DATA {
   <> acl:accessControl <http://localhost:8080/rest/acl> .
   }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/public_collection"

5. Only the ex:publicImage type objects in the container http://localhost:8080/rest/mixedCollection are viewable by anyone, all others are only viewable by the group Admins.

   Click here to expand...

   Using the three "files" below to create our Authorization and ACL resources.

   Acl.ttl

   @prefix webac: <http://fedora.info/definitions/v4/webac#> .
   <> a webac:Acl .

   Auth_restricted.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   <> a acl:Authorization ;
      acl:agent <http://example.org/group/Admins> ;
      acl:mode acl:Read ;
      acl:accessTo <http://localhost:8080/rest/mixedCollection> .

   Auth_open.ttl

   @prefix acl: <http://www.w3.org/ns/auth/acl#> .
   @prefix foaf: <http://xmlns.com/foaf/0.1/> .
   <> a acl:Authorization ;
      acl:agent foaf:Agent ;
      acl:mode acl:Read ;
      acl:accessToClass ex:publicImage .

   I would execute the following commands:

   > curl -X POST -H "Content-type: text/turtle" --data-binary "@Acl.ttl" "http://localhost:8080/rest"
   
   http://localhost:8080/rest/acl
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_restricted.ttl" "http://localhost:8080/rest/acl/auth1"
   
   http://localhost:8080/rest/acl/auth1
   
   > curl -X PUT -H "Content-type: text/turtle" --data-binary "@Auth_open.ttl" "http://localhost:8080/rest/acl/auth2"
   
   http://localhost:8080/rest/acl/auth2
   
   > echo "PREFIX acl: <http://www.w3.org/ns/auth/acl#>
   INSERT DATA {
   <> acl:accessControl <http://localhost:8080/rest/acl> .
   }" | curl -X PATCH -H "Content-type: application/sparql-update" --upload-file - "http://localhost:8080/rest/mixedCollection"

How-To Guides

• Quick Start with WebAC
• How to Use WebAC Groups

More Detailed Documentation

• Determining the Effective Authorization Using WebAC
• W3C's WebAC Ontology