Changes between Version 9 and Version 10 of JuergeN

Timestamp:

18.07.2011 17:53:08 (13 years ago)

Author:

JuergeN

Comment:

--

JuergeN

@@ -80 +80 @@
 Which operations does the server offer/allow on objects and associations?
 We need to define a list of valid operations for Topics Associations and ~Types. Those are:
- * create (CreateTopic / CreateAssociation / CreateTopicType / CreateAssociationType)
+ * create (createTopic / createAssociation / createTopicType / createAssociationType)
  * update/modify
  * delete
@@ -98 +98 @@
  * member (workspace)
  * peer/manager/editor
- * everyone
+ * everyone (=every user)
+ * anonymous
 
 Roles should be assined to users and groups.
@@ -104 +105 @@
 
 === Attributes ===
-Every object should have a set of inherent attributes (properties), e.g.
+Every object should have a set of inherent attributes ( which may be properties or associations), e.g.
  * create time
  * modify time
  * access time
- * not: creator -> association
- * not: owner -> association
+ * not property: creator -> association
+ * not property: owner -> association
  * ro
- * not: hidden -> association (viewable e.g. based on context)
+ * not property: hidden -> association (viewable e.g. based on context)
  * private (interface shortcut for ACL)
  * isolated (=object cannot be associated) (insterface shortcut for ACL)
- * not: label -> association -> name/label
+ * not property: label -> association -> name/label
 
 === Access Control Lists ===
-Every object (nodes and edges) shall have inherent ACLs (properties). 
- * Group A: read (r)
- * Group B: read,update,delete (rud)
- * everyone: read (r)
- * user(n): associate (a)
+Every object (nodes and edges) shall have inherent ACLs (properties) to define permissions on this object. 
+ * Group A: read only (ro)
+ * Group B: read write (rw) incl. delete
+ * everyone: read only (ro)
+ * user(n): associate (a) (create an association towards this object)
 
 Questions: How do ACLs relate to edges? May one see the association to a hidden object?
@@ -127 +128 @@
 ACLs can be set on user and group level.
 
+=== Operation Control List ===
+Especially for TopicType and WorkSpace, we need to define who may do what by role and operation on the object. It defines e.g if  user may create or search an instance of an object, user may join a certain workspace, create (and send) an email (function) or in general who may use domain specific functions.  
+The operation is to a certain role: 
+ 
+ * role: operation
+ * member: createInstance 
+
 === Locations ===
 
 Operations could be limited through location address (localhost, 192.168.0.1, etc.), Just like in Apache or 'MySQL'
+Location shall be part of the Token to allow certain operations only from localhost, or IP XXX.YYY.ZZZ.ABC
+e.g. when uploading a file it is important to know if you work on localhost (just add a link) or if working on a remote server then open upload dialogue.
+
+=== Token ===
+
+Server creates Token for user and validates the token (like Kerberos or OpenAuth).