[Prev][Next][Index][Thread]
RE: Access Control Draft
>We should however specify and API whereby the access control
can be provided >by
>a third party application (server extension) on the server side
thereby
>relieving the server providers from the necessity of providing
the functionality
>(they only have to support the API).
I like this approach. The third party application would have to
understand the userid and translate from the WebDAV permission set
(read, modify, delete, ...whatever they turn out to be) to the platform
dependent security that exists, and give a yes/no response. This would
allow such a "policy engine" to decide that a certain user, who is in
some "day shift" group, can only access certain file from 9-5pm, with NO
special changes to WebDAV. The policy engine could also be a simple
direct translation to file system permissions. Doesn't matter what it
does.
The API could simply be: send in a userid and a list of permissions
(standardized by WebDAV) to check, and get back a yes/no response.
James D. Myers, Ph.D.
Environmental Molecular Sciences Laboratory
Pacific Northwest National Laboratory
MS K1-87, 999 Battelle Blvd.
Richland, WA 99352
509-375-2252
Fax: 509-375-6631
Jim.Myers@pnl.gov, jd_myers@pnl.gov
http://www.emsl.pnl.gov:2080/docs/collab/