eXist-db

Hey guys/gals,

I've posted this topic several times now and not gotten any responses,
perhaps I am not explaining it well. I'll try one more time.

The project I am working on requires that eXist have a Invitation based
permissions system ( Like google docs ), on top of the regular unix style
permissions.

We implemented this in XQuery ( and check permissions against stored
invitation permissions in xml files in the database ) however we also need
it to be considered when a user accessed one of the web services ( REST,
WebDAV, XML-RPC etc)

So my questions are:

What is the easiest way to correctly do this and keep it consistent across
all Inputs/outputs?
Would it be best to just customize the java code that deals with
permissions?
Could we use an XQuery controller to "mediate" the web services by say
re-routing to the WebDAV servlet? ( How would this effect authentication for
things like WebDav )

I don't mind getting down and dirty if someone can just point me in the
right direction. Thanks!

Cheers,

Casey

-- 
--
Casey Jordan
Jorsek Software LLC.
"CaseyDJordan" on LinkedIn, Twitter & Facebook
Cell (585) 771 0189
Office (585) 239 6060
Jorsek.com


This message is intended only for the use of the Addressee(s) and may
contain information that is privileged, confidential, and/or exempt from
disclosure under applicable law.  If you are not the intended recipient,
please be advised that any disclosure  copying, distribution, or use of
the information contained herein is prohibited.  If you have received
this communication in error, please destroy all copies of the message,
whether in electronic or hard copy format, as well as attachments, and
immediately contact the sender by replying to this e-mail or by phone.
Thank you.

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Casey Jordan <casey.jordan@jo...> - 2010-02-26 15:41 Attachments: Message as HTML      So "Invitation Style Permissions" would allow one user to invite another user to view/edit file outside of the regular unix style permissions. It would be an extension of the regular permissions system. Google docs uses this style permissions system. It seems to me that it would be very easy to add this functionality to the validate() function in eXist. I just need to know if this is the best way to do it, and if there would be significant effects on the system ( efficiency, etc ) Thanks Dmitriy Cheers, Casey On Thu, Feb 25, 2010 at 10:04 PM, Dmitriy Shabanov <shabanovd@...: > On Thu, 2010-02-25 at 21:02 -0500, Casey Jordan wrote: > > The project I am working on requires that eXist have a Invitation > > based permissions system ( Like google docs ), on top of the regular > > unix style permissions. > > Can you provide more information here? What does it mean - "Invitation > based permissions system"? > > -- > Cheers, > > Dmitriy Shabanov > -- -- Casey Jordan Jorsek Software LLC. "CaseyDJordan" on LinkedIn, Twitter & Facebook Cell (585) 771 0189 Office (585) 239 6060 Jorsek.com This message is intended only for the use of the Addressee(s) and may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, please be advised that any disclosure copying, distribution, or use of the information contained herein is prohibited. If you have received this communication in error, please destroy all copies of the message, whether in electronic or hard copy format, as well as attachments, and immediately contact the sender by replying to this e-mail or by phone. Thank you.

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Adam Retter <adam@ex...> - 2010-02-26 23:49 I think almost all of this could be done through an XQuery Controller, you would just add an extra layer of authentication in there which maps onto the your authentication details and the unix style permissions. On 26 February 2010 02:02, Casey Jordan <casey.jordan@...> wrote: > Hey guys/gals, > > I've posted this topic several times now and not gotten any responses, > perhaps I am not explaining it well. I'll try one more time. > > The project I am working on requires that eXist have a Invitation based > permissions system ( Like google docs ), on top of the regular unix style > permissions. > > We implemented this in XQuery ( and check permissions against stored > invitation permissions in xml files in the database ) however we also need > it to be considered when a user accessed one of the web services ( REST, > WebDAV, XML-RPC etc) > > So my questions are: > > What is the easiest way to correctly do this and keep it consistent across > all Inputs/outputs? > Would it be best to just customize the java code that deals with > permissions? > Could we use an XQuery controller to "mediate" the web services by say > re-routing to the WebDAV servlet? ( How would this effect authentication for > things like WebDav ) > > I don't mind getting down and dirty if someone can just point me in the > right direction. Thanks! > > Cheers, > > Casey > > -- > -- > Casey Jordan > Jorsek Software LLC. > "CaseyDJordan" on LinkedIn, Twitter & Facebook > Cell (585) 771 0189 > Office (585) 239 6060 > Jorsek.com > > > This message is intended only for the use of the Addressee(s) and may > contain information that is privileged, confidential, and/or exempt from > disclosure under applicable law.  If you are not the intended recipient, > please be advised that any disclosure  copying, distribution, or use of > the information contained herein is prohibited.  If you have received > this communication in error, please destroy all copies of the message, > whether in electronic or hard copy format, as well as attachments, and > immediately contact the sender by replying to this e-mail or by phone. > Thank you. > > ------------------------------------------------------------------------------ > Download Intel&#174; Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > Exist-open mailing list > Exist-open@... > https://lists.sourceforge.net/lists/listinfo/exist-open > > -- Adam Retter eXist Developer { United Kingdom } adam@... irc://irc.freenode.net/existdb

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Patrick Bosek <patrick.bosek@jo...> - 2010-02-27 02:19 Attachments: Message as HTML      That's actually been one of our methods. However, that creates problems when you want to have your permissions enforced through REST and WebDav. Anyone have any thoughts about creating a InviteStylePermission and swapping it in the PermissionFactory. Then in the validate function having InviteStylePermission check a file stored in the data base which lists users with access? On Fri, Feb 26, 2010 at 6:49 PM, Adam Retter <adam@...> wrote: > I think almost all of this could be done through an XQuery Controller, > you would just add an extra layer of authentication in there which > maps onto the your authentication details and the unix style > permissions. > > > > On 26 February 2010 02:02, Casey Jordan <casey.jordan@...> wrote: > > Hey guys/gals, > > > > I've posted this topic several times now and not gotten any responses, > > perhaps I am not explaining it well. I'll try one more time. > > > > The project I am working on requires that eXist have a Invitation based > > permissions system ( Like google docs ), on top of the regular unix style > > permissions. > > > > We implemented this in XQuery ( and check permissions against stored > > invitation permissions in xml files in the database ) however we also > need > > it to be considered when a user accessed one of the web services ( REST, > > WebDAV, XML-RPC etc) > > > > So my questions are: > > > > What is the easiest way to correctly do this and keep it consistent > across > > all Inputs/outputs? > > Would it be best to just customize the java code that deals with > > permissions? > > Could we use an XQuery controller to "mediate" the web services by say > > re-routing to the WebDAV servlet? ( How would this effect authentication > for > > things like WebDav ) > > > > I don't mind getting down and dirty if someone can just point me in the > > right direction. Thanks! > > > > Cheers, > > > > Casey > > > > -- > > -- > > Casey Jordan > > Jorsek Software LLC. > > "CaseyDJordan" on LinkedIn, Twitter & Facebook > > Cell (585) 771 0189 > > Office (585) 239 6060 > > Jorsek.com > > > > > > This message is intended only for the use of the Addressee(s) and may > > contain information that is privileged, confidential, and/or exempt from > > disclosure under applicable law. If you are not the intended recipient, > > please be advised that any disclosure copying, distribution, or use of > > the information contained herein is prohibited. If you have received > > this communication in error, please destroy all copies of the message, > > whether in electronic or hard copy format, as well as attachments, and > > immediately contact the sender by replying to this e-mail or by phone. > > Thank you. > > > > > ------------------------------------------------------------------------------ > > Download Intel&#174; Parallel Studio Eval > > Try the new software tools for yourself. Speed compiling, find bugs > > proactively, and fine-tune applications for parallel performance. > > See why Intel Parallel Studio got high marks during beta. > > http://p.sf.net/sfu/intel-sw-dev > > _______________________________________________ > > Exist-open mailing list > > Exist-open@... > > https://lists.sourceforge.net/lists/listinfo/exist-open > > > > > > > > -- > Adam Retter > > eXist Developer > { United Kingdom } > adam@... > irc://irc.freenode.net/existdb > > > ------------------------------------------------------------------------------ > Download Intel&#174; Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > Exist-open mailing list > Exist-open@... > https://lists.sourceforge.net/lists/listinfo/exist-open > -- Patrick Bosek Jorsek Software Cell (585) 820 9634 Office (585) 239 6060 Jorsek.com

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Adam Retter <adam@ex...> - 2010-02-27 13:08 On 27 February 2010 01:14, Patrick Bosek <patrick.bosek@...> wrote: > That's actually been one of our methods. However, that creates problems when > you want to have your permissions enforced through REST and WebDav. Why? In trunk, everything sits underneath the XQuery Controller... > Anyone have any thoughts about creating a InviteStylePermission and swapping > it in the PermissionFactory. Then in the validate function having > InviteStylePermission check a file stored in the data base which lists users > with access? > > > > On Fri, Feb 26, 2010 at 6:49 PM, Adam Retter <adam@...> wrote: >> >> I think almost all of this could be done through an XQuery Controller, >> you would just add an extra layer of authentication in there which >> maps onto the your authentication details and the unix style >> permissions. >> >> >> >> On 26 February 2010 02:02, Casey Jordan <casey.jordan@...> wrote: >> > Hey guys/gals, >> > >> > I've posted this topic several times now and not gotten any responses, >> > perhaps I am not explaining it well. I'll try one more time. >> > >> > The project I am working on requires that eXist have a Invitation based >> > permissions system ( Like google docs ), on top of the regular unix >> > style >> > permissions. >> > >> > We implemented this in XQuery ( and check permissions against stored >> > invitation permissions in xml files in the database ) however we also >> > need >> > it to be considered when a user accessed one of the web services ( REST, >> > WebDAV, XML-RPC etc) >> > >> > So my questions are: >> > >> > What is the easiest way to correctly do this and keep it consistent >> > across >> > all Inputs/outputs? >> > Would it be best to just customize the java code that deals with >> > permissions? >> > Could we use an XQuery controller to "mediate" the web services by say >> > re-routing to the WebDAV servlet? ( How would this effect authentication >> > for >> > things like WebDav ) >> > >> > I don't mind getting down and dirty if someone can just point me in the >> > right direction. Thanks! >> > >> > Cheers, >> > >> > Casey >> > >> > -- >> > -- >> > Casey Jordan >> > Jorsek Software LLC. >> > "CaseyDJordan" on LinkedIn, Twitter & Facebook >> > Cell (585) 771 0189 >> > Office (585) 239 6060 >> > Jorsek.com >> > >> > >> > This message is intended only for the use of the Addressee(s) and may >> > contain information that is privileged, confidential, and/or exempt from >> > disclosure under applicable law.  If you are not the intended recipient, >> > please be advised that any disclosure  copying, distribution, or use of >> > the information contained herein is prohibited.  If you have received >> > this communication in error, please destroy all copies of the message, >> > whether in electronic or hard copy format, as well as attachments, and >> > immediately contact the sender by replying to this e-mail or by phone. >> > Thank you. >> > >> > >> > ------------------------------------------------------------------------------ >> > Download Intel&#174; Parallel Studio Eval >> > Try the new software tools for yourself. Speed compiling, find bugs >> > proactively, and fine-tune applications for parallel performance. >> > See why Intel Parallel Studio got high marks during beta. >> > http://p.sf.net/sfu/intel-sw-dev >> > _______________________________________________ >> > Exist-open mailing list >> > Exist-open@... >> > https://lists.sourceforge.net/lists/listinfo/exist-open >> > >> > >> >> >> >> -- >> Adam Retter >> >> eXist Developer >> { United Kingdom } >> adam@... >> irc://irc.freenode.net/existdb >> >> >> ------------------------------------------------------------------------------ >> Download Intel&#174; Parallel Studio Eval >> Try the new software tools for yourself. Speed compiling, find bugs >> proactively, and fine-tune applications for parallel performance. >> See why Intel Parallel Studio got high marks during beta. >> http://p.sf.net/sfu/intel-sw-dev >> _______________________________________________ >> Exist-open mailing list >> Exist-open@... >> https://lists.sourceforge.net/lists/listinfo/exist-open > > > > -- > Patrick Bosek > Jorsek Software > Cell (585) 820 9634 > Office (585) 239 6060 > Jorsek.com > > -- Adam Retter eXist Developer { United Kingdom } adam@... irc://irc.freenode.net/existdb

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Patrick Bosek <patrick.bosek@jo...> - 2010-02-27 15:55 Attachments: Message as HTML      Do you know of a way to govern access for REST and WebDav using XQuery? On Sat, Feb 27, 2010 at 8:08 AM, Adam Retter <adam@...> wrote: > On 27 February 2010 01:14, Patrick Bosek <patrick.bosek@...> wrote: > > That's actually been one of our methods. However, that creates problems > when > > you want to have your permissions enforced through REST and WebDav. > > Why? In trunk, everything sits underneath the XQuery Controller... > > > Anyone have any thoughts about creating a InviteStylePermission and > swapping > > it in the PermissionFactory. Then in the validate function having > > InviteStylePermission check a file stored in the data base which lists > users > > with access? > > > > > > > > On Fri, Feb 26, 2010 at 6:49 PM, Adam Retter <adam@...> wrote: > >> > >> I think almost all of this could be done through an XQuery Controller, > >> you would just add an extra layer of authentication in there which > >> maps onto the your authentication details and the unix style > >> permissions. > >> > >> > >> > >> On 26 February 2010 02:02, Casey Jordan <casey.jordan@...> > wrote: > >> > Hey guys/gals, > >> > > >> > I've posted this topic several times now and not gotten any responses, > >> > perhaps I am not explaining it well. I'll try one more time. > >> > > >> > The project I am working on requires that eXist have a Invitation > based > >> > permissions system ( Like google docs ), on top of the regular unix > >> > style > >> > permissions. > >> > > >> > We implemented this in XQuery ( and check permissions against stored > >> > invitation permissions in xml files in the database ) however we also > >> > need > >> > it to be considered when a user accessed one of the web services ( > REST, > >> > WebDAV, XML-RPC etc) > >> > > >> > So my questions are: > >> > > >> > What is the easiest way to correctly do this and keep it consistent > >> > across > >> > all Inputs/outputs? > >> > Would it be best to just customize the java code that deals with > >> > permissions? > >> > Could we use an XQuery controller to "mediate" the web services by say > >> > re-routing to the WebDAV servlet? ( How would this effect > authentication > >> > for > >> > things like WebDav ) > >> > > >> > I don't mind getting down and dirty if someone can just point me in > the > >> > right direction. Thanks! > >> > > >> > Cheers, > >> > > >> > Casey > >> > > >> > -- > >> > -- > >> > Casey Jordan > >> > Jorsek Software LLC. > >> > "CaseyDJordan" on LinkedIn, Twitter & Facebook > >> > Cell (585) 771 0189 > >> > Office (585) 239 6060 > >> > Jorsek.com > >> > > >> > > >> > This message is intended only for the use of the Addressee(s) and may > >> > contain information that is privileged, confidential, and/or exempt > from > >> > disclosure under applicable law. If you are not the intended > recipient, > >> > please be advised that any disclosure copying, distribution, or use > of > >> > the information contained herein is prohibited. If you have received > >> > this communication in error, please destroy all copies of the message, > >> > whether in electronic or hard copy format, as well as attachments, and > >> > immediately contact the sender by replying to this e-mail or by phone. > >> > Thank you. > >> > > >> > > >> > > ------------------------------------------------------------------------------ > >> > Download Intel&#174; Parallel Studio Eval > >> > Try the new software tools for yourself. Speed compiling, find bugs > >> > proactively, and fine-tune applications for parallel performance. > >> > See why Intel Parallel Studio got high marks during beta. > >> > http://p.sf.net/sfu/intel-sw-dev > >> > _______________________________________________ > >> > Exist-open mailing list > >> > Exist-open@... > >> > https://lists.sourceforge.net/lists/listinfo/exist-open > >> > > >> > > >> > >> > >> > >> -- > >> Adam Retter > >> > >> eXist Developer > >> { United Kingdom } > >> adam@... > >> irc://irc.freenode.net/existdb > >> > >> > >> > ------------------------------------------------------------------------------ > >> Download Intel&#174; Parallel Studio Eval > >> Try the new software tools for yourself. Speed compiling, find bugs > >> proactively, and fine-tune applications for parallel performance. > >> See why Intel Parallel Studio got high marks during beta. > >> http://p.sf.net/sfu/intel-sw-dev > >> _______________________________________________ > >> Exist-open mailing list > >> Exist-open@... > >> https://lists.sourceforge.net/lists/listinfo/exist-open > > > > > > > > -- > > Patrick Bosek > > Jorsek Software > > Cell (585) 820 9634 > > Office (585) 239 6060 > > Jorsek.com > > > > > > > > -- > Adam Retter > > eXist Developer > { United Kingdom } > adam@... > irc://irc.freenode.net/existdb > -- Patrick Bosek Jorsek Software Cell (585) 820 9634 Office (585) 239 6060 Jorsek.com

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Wolfgang Meier <wolfgang@ex...> - 2010-02-27 20:17 > It seems to me that it would be very easy to add this functionality to the > validate() function in eXist. I just need to know if this is the best way to > do it, and if there would be significant effects on the system ( efficiency, > etc ) Some time ago, I thought about adding a simple callback mechanism, which would allow you to register a custom handler with the security manager. User.validate would call this handler after it checked the standard permissions, but only if access would be granted. Your callback class could thus deny access though the standard permissions would allow it. This would be a simple, straightforward solution for custom applications which need to implement additional rules on top of the existing permissions. Wolfgang

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Patrick Bosek <patrick.bosek@jo...> - 2010-02-27 20:32 Attachments: Message as HTML      That does sound like a good solution. Do you think this is a change which will make it into the main code base, or should I simply add it to my own branch? Patrick On Sat, Feb 27, 2010 at 3:17 PM, Wolfgang Meier <wolfgang@...: > > It seems to me that it would be very easy to add this functionality to > the > > validate() function in eXist. I just need to know if this is the best way > to > > do it, and if there would be significant effects on the system ( > efficiency, > > etc ) > > Some time ago, I thought about adding a simple callback mechanism, > which would allow you to register a custom handler with the security > manager. User.validate would call this handler after it checked the > standard permissions, but only if access would be granted. Your > callback class could thus deny access though the standard permissions > would allow it. This would be a simple, straightforward solution for > custom applications which need to implement additional rules on top of > the existing permissions. > > Wolfgang > > > ------------------------------------------------------------------------------ > Download Intel&#174; Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > Exist-open mailing list > Exist-open@... > https://lists.sourceforge.net/lists/listinfo/exist-open > -- Patrick Bosek Jorsek Software Cell (585) 820 9634 Office (585) 239 6060 Jorsek.com

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Dmitriy Shabanov <shabanovd@gm...> - 2010-02-28 04:04 Attachments: smime.p7s      On Fri, 2010-02-26 at 10:41 -0500, Casey Jordan wrote: > So "Invitation Style Permissions" would allow one user to invite > another user to view/edit file outside of the regular unix style > permissions. It would be an extension of the regular permissions > system. Google docs uses this style permissions system. > > It seems to me that it would be very easy to add this functionality to > the validate() function in eXist. I just need to know if this is the > best way to do it, and if there would be significant effects on the > system ( efficiency, etc ) The simplest solution I see (without redesign or coding) it unique group per resource. By adding or removing user to/from that group you will control access to resource in "share mode". Only problem is permissions will be same for sharers. Another solution is XACML & I ready to help with that. -- Cheers, Dmitriy Shabanov

Re: [Exist-open] Customizing permissions system - Is this crazy? From: Wolfgang Meier <wolfgang@ex...> - 2010-02-28 11:57 > That does sound like a good solution. Do you think this is a change which > will make it into the main code base, or should I simply add it to my own > branch? If you implement a callback mechanism, just send me a patch and I will add it to the code base. Wolfgang

5 messages have been excluded from this view by a project administrator.