Agents, groups, and authorizations
\nLinkedDataHub access control is based on the W3C ACL ontology.
\nThere are three access modes (classes of operation) that map to HTTP methods:
\n| Mode | \nPermits | \nHTTP method | \n
|---|---|---|
| Read | \nRead the contents, including querying them. | \nGET | \n
| Write | \nOverwrite the contents, including deleting or modifying them. | \nPUT, PATCH, DELETE | \n
| Append | \nAdd information without removing or replacing any. | \nPOST | \n
acl:Control grants nothing: authorizations are documents in the administration dataspace,\n so changing them takes acl:Write there.
An agent is a person or a piece of software, identified by a WebID, that can be authorized to have certain modes\n of access to certain dataspaces.
\nA group is a named group of agents to which an authorization can\n be given. It is a subclass of the foaf:Group\n class.
There are several default groups:
\nBy default, only members of the owners group have access to the administration dataspace: its built-in\n Full control authorization grants them read, append and write access to the administration root and everything\n below it. See Authorizations.
\nNote that an agent being a member of one of the above groups does not automatically provide it with an\n authorization. A valid authorization for the whole group has to be present.
\nAn authorization explicitly grants access for an agent or a group\n of agents to a specific document (acl:accessTo), to every document below a container (acl:default),\n or to the resources of a class (acl:accessToClass). Grants only add access:\n no authorization overrides another.
An authorization counts only in its own document, the one whose foaf:primaryTopic it is, and a group's members count\n only in the group's own document.
To use the administration dataspace, an agent needs access to its\n documents like to any others. By default the owners group has it.
\nThe default authorizations for groups and their respective access modes:
\n| Group | \nRead access | \nWrite/append access | \nAdministration dataspace | \n
|---|---|---|---|
| Owners | \nRead | \nWrite | \nRead, Append, Write | \n
| Append | \n|||
| Writers | \nRead | \nWrite | \n— | \n
| Append | \n|||
| Readers | \nRead | \n— | \n— | \n
An authorization is a plain RDF resource. Granting the writers group full access to the Northwind orders container:
\n@prefix acl: <http://www.w3.org/ns/auth/acl#> .\n@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .\n\n<#this> a acl:Authorization ;\n rdfs:label \"Order management\" ;\n acl:agentGroup <https://admin.localhost:4443/acl/groups/writers/#this> ;\n acl:mode acl:Read, acl:Append, acl:Write ;\n acl:accessTo <https://localhost:4443/orders/> .\n
ldh admin create authorization \\\n --label \"Order management\" \\\n --agent-group \"https://admin.localhost:4443/acl/groups/writers/#this\" \\\n --to \"https://localhost:4443/orders/\" \\\n --read --append --write\n
An authorization can also reach every document below a container with acl:default. Granting the readers group read access to\n the orders container and every order in it:
@prefix acl: <http://www.w3.org/ns/auth/acl#> .\n@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .\n\n<#this> a acl:Authorization ;\n rdfs:label \"Order read access\" ;\n acl:agentGroup <https://admin.localhost:4443/acl/groups/readers/#this> ;\n acl:mode acl:Read ;\n acl:accessTo <https://localhost:4443/orders/> ;\n acl:default <https://localhost:4443/orders/> .\n
ldh admin create authorization \\\n --label \"Order read access\" \\\n --agent-group \"https://admin.localhost:4443/acl/groups/readers/#this\" \\\n --to \"https://localhost:4443/orders/\" \\\n --default \"https://localhost:4443/orders/\" \\\n --read\n
A document is below a container when its own sioc:has_parent or sioc:has_container leads there. acl:default does\n not cover the container itself, hence the acl:accessTo alongside it.
acl:accessToClass grants access to the resources of a class, such as nfo:FileDataObject for file uploads. It refuses the\n document classes (def:Root, dh:Container, dh:Item) and the classes above them: documents are granted through the\n hierarchy.
A public-access authorization allows access for non-authenticated agents — the Publish stage of the\n tutorial shows the one ldh admin make-public creates, granting acl:Read to the foaf:Agent class\n on the root and every document below it.
The agent that creates a document is its owner (acl:owner), and stays so for the life of the document. The built-in\n Owner access authorization grants read, append and write access to the lacl:OwnerAgent class, which matches\n the owners of the requested document, on the end-user root and every document below it.
The owner's and secretary's authorizations are stored under stable URIs (acl/authorizations/owner-webid/ and acl/authorizations/secretary-webid/), so reloading the admin dataset does not create duplicates.
\nIf access is denied due to missing authorization, the agent can ask for it by issuing a request to the dataspace's\n owners. The request indicates the request URI and access mode in question.\n The owners can then accept the request by creating an authorization with the provided information\n (possibly extending the requested access to a group of agents or a class of resources),\n or simply ignore it.
\nA request is data too — asking for write access to a Northwind order:
\n@prefix lacl: <https://w3id.org/atomgraph/linkeddatahub/admin/acl#> .\n@prefix acl: <http://www.w3.org/ns/auth/acl#> .\n\n<#this> a lacl:AuthorizationRequest ;\n lacl:requestAgent <https://localhost:4443/agents/jane/#this> ;\n lacl:requestMode acl:Write ;\n lacl:requestAccessTo <https://localhost:4443/orders/10248/> .\n
| Action | \nCLI command | \n
|---|---|
| Create group | \nldh admin create group | \n
| Create authorization | \nldh admin create authorization | \n
| Add agent to group | \nldh admin add agent | \n
| Make a document public | \nldh admin make-public | \n
To request access to someone else's dataspace, see the Request access guide. To open your data to the public, follow the Publish stage of the tutorial.
\n