Changes between Version 20 and Version 21 of S3/S3AAA

Timestamp:

01/17/11 11:17:46 (14 years ago)

Author:

Dominic König

Comment:

--

S3/S3AAA

@@ -65 +65 @@
 ACLs are stored per role and request destination in the {{{s3_permission}}} table, which is defined by the {{{S3Permission}}} class (in {{{modules/s3/s3aaa.py}}}).
 
+For every destination (controller/function/table) two ACLs can be defined to be applied depending on whether a user ownes the record or not:
+
+  - one ACL for users owning a record (Owner ACL = {{{oacl}}})
+  - one ACL for any other user not owning the record (User ACL = {{{uacl}}}).
+
+If a user ownes a record, then the most permissive of the User ACL and the Owner ACL gets applied, otherwise only the User ACL gets applied.
+
 === Record Ownership ===
 
@@ -77 +84 @@
 A user is considered ''owner'' of a record if he has either created the record (user ID == {{{created_by}}}), or he is a member of the owner group ({{{owned_by}}} in user roles).
 
-In tables which do not define either of these meta-fields, ownership rules are not applied.
+In tables which do not define either of these meta-fields, ownership rules are not applied ({{{uacl}}} only).
 
-Record ownership allows to set different permissions depending on whether a user ownes a record or not:
+=== Controller/Table Restriction ===
 
-  - one ACL for users owning a record (Owner ACL = {{{oacl}}})
-  - one ACL for any other user not owning the record (User ACL = {{{uacl}}}).
+ACLs can be defined for controllers, or for particular functions inside controllers.[[BR]]
+ACLs can additionally be defined for database tables.
 
-If a user ownes a record, then the most permissive of the User ACL and the Owner ACL gets applied, otherwise only the User ACL gets applied.
-=== Controller Restriction ===
+The controller ACLs are applied when the respective controller is set to {{{restricted=True}}} in {{{deployment_settings.modules}}} ({{{000_config.py}}}):
 
-=== Resource Restriction ===
+{{{
+    dvi = Storage(
+            name_nice = T("Disaster Victim Identification"),
+            description = T("Disaster Victim Identification"),
+
+            restricted = True, # Apply controller ACLs
+
+            module_type = 10,
+            resources = Storage(
+                dvi_recreq = {"importer" : True},
+            )
+        ),
+}}}
+
+The Controller ACL can be defined for all functions in a controller, or a particular function inside a controller, where the function-specific ACL overrides the general controller ACL. That means, you can define a general ACL for the {{{pr}}} controller, and a different one for the {{{pr/person}}} function.
+
+The Controller ACLs are applied to ''all'' resources when accessed through this controller/function. If the Controller ACL does not specify any permission, the request is rejected as "Unauthorized".
+
+Once the user has passed that controller permission check, and requests access to a particular table, the controller checks for table-specific ACLs. If there are specific ACLs for this table, then the most ''restrictive'' of controller and cable ACLs apply (i.e. you cannot allow on the table level what you forbid at the controller level, and vice versa). If there are no specific ACLs defined for this table, then the controller ACLs apply.
 
 == Implementation of Access Control ==