<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
<font face="Arial">We need both: role based access control and more
granular form of access control. <br>
<br>
An example of a simple role-based access:<br>
GET /owners/{owner_uuid} - shouldn't be accessoble to 'client' role,
but should be available for 'owner'.<br>
<br>
More granular access control, based on client or owner uuid:<br>
GET /consumers/{consumer_uuid}/entitlements - a 'consumer' can issue
this call for themselves only, while 'owner' for any consumer (within
the organization).<br>
<br>
While role-based access control is rather straightforward, the latter
form of access control is much less so. I can think of two possible
implementations. <br>
<br>
url-based: <br>
- at the resource level;<br>
- have to specify role AND uuid (probably in the form of a url pattern)<br>
- relatively simple<br>
- something in the form: <br>
@Requires(role = Roles.CONSUMER, assertUUID =
'/consumers/{uuid}/entitlements') // has to match uuid<br>
<br>
the trouble: above url doesn't contain any references to the owner.
Are we going to have a different url for 'owners'? If we are to keep
the same url, then the implementation won't differ significantly from
the next approach.<br>
<br>
entity-based<br>
- at the curator level<br>
- will have to have a way to relate to consumer & owner (it seems
that it might not be that difficult - we have references to both on
main entities)<br>
- something in the form: @RequiresConsumerRole, @RequiresOwnerRole<br>
- under the hood (assume </font><font face="Arial">GET
/consumers/{consumer_uuid}/entitlements is being accessed)</font><font
face="Arial">:<br>
<br>
POST/DELETE Role.CONSUMER: extract consumer_uuid from the
certificate, compare it with consumer.uuid on the entitlement<br>
GET Role.CONSUMER: extract consumer_uuid from the certificate,
apply filter: where consumer.uuid = consumer_uuid<br>
or<br>
POST/DELETE Role.OWNER: extract owner_uuid from the user object,
compare it with owner.uuid on the entitlement<br>
GET Role.OWNER: extract extract owner_uuid from the user object,
apply filter: where owner.uuid = owner_uuid<br>
<br>
<br>
Thoughts? Comments?<br>
-d<br>
<br>
</font>
</body>
</html>