Skip to content

Attribute based access control implementation

Georgy Litvinov requested to merge github/fork/litvinovg/abac_pr into main

VIVO GitHub issue

Vitro PR

What does this pull request do?

This pull request is a VIVO part of new authorization mechanism that provides flexible way to configure access rules and check access requests.

What's new?

This pull requests contains:

  • Datasets for entity policies in n3 files.
  • Java policies were removed.
  • Startup listeners file was modified in accordance with linked Vitro PR
  • Authorization requests in generator were aligned with Vitro PR You can find more information in Vitro PR.

How should this be tested?

There are 2 ways to test it:

  • Migration from currently in use VIVO instance Apply changes in PR for Vitro and for VIVO, build and deploy your VIVO. Check if access works the same as it worked before for object properties, data properties, faux object properties and faux data properties. Check if access works the same as it worked in ARM. Standard VIVO checks are required to test this PR. If you want to try new policies, try edit policies in firsttime directory, reload VIVO and see results.
  • Migration from Advanced role management Apply changes in PR for Vitro and for VIVO Make sure to retain ARM entity permission configurations in auth/firsttime folder to retain auth graph state for conversion of ARM permissions into policy datasets. Build and deploy your VIVO. Check if access works the same as it worked in ARM. If you want to try new policies, try edit policies in firsttime directory, reload VIVO and see results.

Additional notes

  • Documentation will need to be updated.

Interested parties

@chenejac @vivo-project/vivo-committers

Merge request reports