You are here: start » dev » acldesign

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
dev:acldesign [2008/04/14 11:42]
fran Tidy up wording & syntax 		dev:acldesign [2009/07/06 20:36] (current)
Line 1: Line 1:
-Main Author: [[http://www.r4vi.org | Ravindra de Silva ]] Contributors: ...+Important Note: This page is DEPRECATED!
  
 +The new approach is documented here:
 +  * [[security | Data Security and Privacy Design]]
  
 ====== Introduction ====== ====== Introduction ======
Line 24: Line 26:
  
 The advanced user can directly specify the permissable actions for a user for each resource without relying on roles. The advanced user can directly specify the permissable actions for a user for each resource without relying on roles.
 +
 +
  
  
 ====== ACL and Front controller ====== ====== ACL and Front controller ======
  
-The way the sahana framework works ,every request is routed via the +The way the sahana framework works, every request is routed via the 
-front controller (index.php). front controller calls the function+front controller (index.php). The front controller calls the function
 identified using the $_GET["act"] and $_GET["mod"] variables. identified using the $_GET["act"] and $_GET["mod"] variables.
-Before calling the function ACL check is done ,if ACL is enabled. +If ACL is enabled, then an ACL check is done before calling the function. 
-Therefore main resource we protect is the function that is called via+Therefore the main resource we protect is the function that is called via
 front controller. front controller.
-currently All the ACL entries are aimed at protecting functions. +Currently All the ACL entries are aimed at protecting functions. 
-Module(e.g.organization registry) developers can provide a script to +Module (e.g.organization registry) developers can provide a script to indicate which functions to protect. Otherwise there is an interface to register functions (in System Administration). 
-indicate which functions to protect. otherwise there is an interface  +The API is there for all ACL-specific things, but the interface now covers nearly the whole API. 
-to register functions.(in System Administration) + 
-The API is there for all ACL specific things ,but the interface now +Below is some sample code that registers a function to be protected and gives permission for the guest role to use it.
-contains covers nearly the whole API.+
  
-below is some sample code that registers a function to be protected and  +Since it is hard to specify permissions for each and every function, functions can be registered under function groups (e.g "create","delete") and then permissions are specified for those groups.
-gives permission for the guest role to use it. +
-Another important point is , since it is difficult for the lay user to +
-specify permissions for each and every function, functions can be +
-registered under function groups (e.g "create","delete") and then +
-permission are specified for those groups.+
  
 e.g :  e.g : 
-// add an action group named "create" under the module "or"+  // add an action group named "create" under the module "or" 
 +  $res=shn_acl_add_action_group("or","create","create group"); 
 +   
 +  // add an action name 'shn_or_reg_org" under the above action group  
 +  $res=shn_acl_add_action("or","create","shn_or_reg_org","Register function"); 
 +   
 +  // give permission for 'create' action group within 'or' to 'guest' role 
 +  $res=shn_acl_add_perms_action_group_role('guest','or','create');
  
- $res=shn_acl_add_action_group("or","create","create group"); 
  
-//add an action name 'shn_or_reg_org" under the above action group  +Above code is not complete, but I hope it gives an understanding of the
- +
- $res=shn_acl_add_action("or","create","shn_or_reg_org","Register function"); +
- +
-  //give permission for 'create' action group with in 'or' to 'guest' role +
-    $res=shn_acl_add_perms_action_group_role('guest','or','create'); +
- +
- +
-Above code is not complete , but i hope it gives an understanding of the+
 design. design.
 For example if the functions relevant to data input can be grouped under For example if the functions relevant to data input can be grouped under
-"create" group. and then data edit functions can be grouped under "edit" +"create" group. Then data edit functions can be grouped under "edit" 
-group.Then for user "A" if you allow "create" group ,but not "edit" +group. Then for user "A" if you allow "create" group, but not "edit" 
-group,Then front controller with the ACL library will make sure user "A"+group, then front controller with the ACL library will make sure user "A"
 cannot edit. cannot edit.
  
 +[[acl|More complete Example]]
  
-Though the main resources we protect is the function, the design allows +Though the main resource we protect is the functions, the design allows 
-even database row locking. But there is no API for that as the need did +even database row locking. But there is no API for that as the need has 
-not arise so far.+not arisen so far.
  
-====== Deep in to the design ====== 
-from a technical point of view , there is an open source class phpGACL( http://phpgacl.sourceforge.net/), with 
  
-powerfull ACL capabilities. once you download phpGACL , in docs ,there is a very easy to understand manual ,i have attached it. 
  
-just for your information GACL concept is 
  
-there are resources/objects you need access to(e.g webpages) : Access Control Objects (ACO)+====== Deep into the design ====== 
 +This implementation is based on the open source class phpGACL: http://phpgacl.sourceforge.net/. 
 +phpGACL has a very easy to understand manual, included in the download.
  
-there are requesters for these objects(e.g users): Access Request Objects (ARO) +GACL concept is: 
- +  * There are resources/objects you need access to (e.g webpages) : Access Control Objects (ACO) 
-Then for fine grain control there are AXO's:Access eXtension Objects(AXO).+  * There are requesters for these objects (e.g users): Access Request Objects (ARO) 
 +  * Then for fine-grained control there are AXO's: Access eXtension Objects(AXO).
  
 AXOs are identical to AROs in many respects. There is an AXO tree (separate from the ARO tree), with it's own Groups and AXOs. When dealing with AXOs, consider an AXO to take the old role of the ACO (i.e. "things to control access on"), and change the view of ACOs from "things to control access on" to "actions that are requested". AXOs are identical to AROs in many respects. There is an AXO tree (separate from the ARO tree), with it's own Groups and AXOs. When dealing with AXOs, consider an AXO to take the old role of the ACO (i.e. "things to control access on"), and change the view of ACOs from "things to control access on" to "actions that are requested".
  
 ARO and ACO-only View: ARO and ACO-only View:
- +  * AROs: Things requesting access 
-AROs: Things requesting access +  * ACOs: Things to control access on
- +
-ACOs: Things to control access on+
  
 ARO, ACO and AXO View: ARO, ACO and AXO View:
- +  * AROs: Things requesting access 
-AROs: Things requesting access +  * ACOs: Actions that are requested 
- +  * AXOs: Things to control access on
-ACOs: Actions that are requested +
- +
-AXOs: Things to control access on+
  
 Example: Example:
- +  * A website manager is trying to manage access to projects on the website. The ARO tree consists of all the users:
-A website manager is trying to manage access to projects on the website. The ARO tree consists of all the users:+
  
 Website Website
Line 139: Line 129:
 The actions that can be taken with each project are "View" and "Edit". These are the ACOs. The actions that can be taken with each project are "View" and "Edit". These are the ACOs.
  
-GACL provides a very easy to use API to specify ACO, ARO,AXO+GACL provides a very easy to use API to specify ACO, ARO, AXO.
  
-GACL is used by many popular sites.(dotProject, Mambo)+Once we verify the user identity , we just need to call the API with the username(or role), with the name of the resource and the action. It will output DENY or ALLOW.
  
-see http://phpgacl.sourceforge.net/cool_apps.html 
  
-therefore once we verify the user identity , we just need to call the API with the username(or role) , with the name of the resource and the action. +GACL is used by many popular projects (e.g. Mambo) 
- +  * see http://phpgacl.sourceforge.net/cool_apps.html
-it will output DENY or ALLOW.+
  
 +Main Author: [[http://www.r4vi.org | Ravindra de Silva ]] Contributors: ...
  

Trace:

Navigation
QR Code
QR Code dev:acldesign (generated for current page)