2
2
Access Control List
3
3
####################
4
4
5
- Access Control List (ACL) are key-value stores that can be used to manage what operations can
5
+ An Access Control List (ACL) is a key-value store that can be used to manage what operations can
6
6
be performed by which user on group, dataset, or committed type objects. Operations on other
7
7
objects (e.g. links, dataspace, or attributes) use the ACL of the object they belong to.
8
8
9
9
Each ACL consists of 1 or more items in the form:
10
10
11
11
(username, read, create, update, delete, readACL, updateACL)
12
12
13
- where username is a string, and read, create, update, delete, readACL, updateACL are booleans.
14
- There flags have the following semantics when the given username is provided in the http
13
+ where username is a string, and read, create, update, delete, readACL and updateACL are booleans.
14
+ These flags have the following semantics when the given username is provided in the http
15
15
Authorization header:
16
16
17
17
* read: The given user is authorized for read access to the resource (generally all GET requests)
@@ -22,7 +22,7 @@ Authorization header:
22
22
* updateACL: The given user is authorized to modify the ACLs of a resource
23
23
24
24
A special username 'default' is used to denote the access permission for all other users who
25
- or not list in the ACL (including un-authenticated requests that don't provide a username).
25
+ are not listed in the ACL (including un-authenticated requests that don't provide a username).
26
26
27
27
Example
28
28
-------
@@ -67,7 +67,7 @@ Finally the same set of requests are sent with 'ann' as the user:
67
67
* PUT /datasets/<id>/attributes/<name> - denied (returns HTTP Status 201 - Created)
68
68
* DELETE /datasets/<id> - denied (returns HTTP Status 200 - OK)
69
69
70
- Note: HTTP Status 401 basically says: "you can't have access until you tell me who your are",
70
+ Note: HTTP Status 401 basically says: "you can't have access until you tell me who you are",
71
71
while HTTP Status 403 says: "I know who you are, but you don't have permissions to access this
72
72
resource."
73
73
@@ -76,7 +76,7 @@ Root ACL Inheritance
76
76
77
77
In many cases it will be desired to have a default ACL that applies to each resource in the domain.
78
78
This can be accomplished by defining an ACL for the root group. This will control the access
79
- rights for any resource unless of ACL is present in that resource for the requesting user.
79
+ rights for any resource unless an ACL is present in that resource for the requesting user.
80
80
81
81
The default ACL can be read or updated by forming a request with a uri that includes the root group id,
82
82
i.e.: "/groups/<root_id>/acls", or by using the uri path for the domain, i.e. "/acls".
0 commit comments