{"action":"created","issue":{"url":"https://api.github.com/repos/projecthydra/hydra-head/issues/313","repository_url":"https://api.github.com/repos/projecthydra/hydra-head","labels_url":"https://api.github.com/repos/projecthydra/hydra-head/issues/313/labels{/name}","comments_url":"https://api.github.com/repos/projecthydra/hydra-head/issues/313/comments","events_url":"https://api.github.com/repos/projecthydra/hydra-head/issues/313/events","html_url":"https://github.com/projecthydra/hydra-head/issues/313","id":131777459,"number":313,"title":"Align Hydra's ACLs with Fedora's","user":{"login":"awead","id":312085,"avatar_url":"https://avatars.githubusercontent.com/u/312085?v=3","gravatar_id":"","url":"https://api.github.com/users/awead","html_url":"https://github.com/awead","followers_url":"https://api.github.com/users/awead/followers","following_url":"https://api.github.com/users/awead/following{/other_user}","gists_url":"https://api.github.com/users/awead/gists{/gist_id}","starred_url":"https://api.github.com/users/awead/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/awead/subscriptions","organizations_url":"https://api.github.com/users/awead/orgs","repos_url":"https://api.github.com/users/awead/repos","events_url":"https://api.github.com/users/awead/events{/privacy}","received_events_url":"https://api.github.com/users/awead/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-05T22:35:40Z","updated_at":"2016-02-05T23:59:47Z","closed_at":null,"body":"In order to let Fedora interpret and enforce the access controls that Hydra creates for resources, we need to have Hydra create ACLs that match up with Fedora.\r\n\r\n1. Add rdf:Type acl:Authorization to all Hydra::AccessControls::Permission objects\r\n2. Make explicit implied read and discovery permissions, so when a resource is editable by a user, there is only one triple that specifies write access, but there should be two additional triples for read and discovery because those rights are implicit with write access.\r\n3. Use agentClass predicate, `<http://www.w3.org/ns/auth/acl#agentClass>`, for groups in instead of agent"},"comment":{"url":"https://api.github.com/repos/projecthydra/hydra-head/issues/comments/180628751","html_url":"https://github.com/projecthydra/hydra-head/issues/313#issuecomment-180628751","issue_url":"https://api.github.com/repos/projecthydra/hydra-head/issues/313","id":180628751,"user":{"login":"acoburn","id":1265883,"avatar_url":"https://avatars.githubusercontent.com/u/1265883?v=3","gravatar_id":"","url":"https://api.github.com/users/acoburn","html_url":"https://github.com/acoburn","followers_url":"https://api.github.com/users/acoburn/followers","following_url":"https://api.github.com/users/acoburn/following{/other_user}","gists_url":"https://api.github.com/users/acoburn/gists{/gist_id}","starred_url":"https://api.github.com/users/acoburn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/acoburn/subscriptions","organizations_url":"https://api.github.com/users/acoburn/orgs","repos_url":"https://api.github.com/users/acoburn/repos","events_url":"https://api.github.com/users/acoburn/events{/privacy}","received_events_url":"https://api.github.com/users/acoburn/received_events","type":"User","site_admin":false},"created_at":"2016-02-05T23:59:47Z","updated_at":"2016-02-05T23:59:47Z","body":"@awead can you clarify point 3 a bit? The Fedora impl uses `acl:agent` for user names and group names, e.g.:\r\n\r\n    <> a acl:Authorization ;\r\n       acl:mode acl:Read ;\r\n       acl:agent \"repoEditorGroup\", \"user@institution.edu\".\r\n\r\n(Technically, the values for acl:agent should be URIs, but given our use cases and the practicality of implementing WebAC, we left this as string literals.)\r\n\r\nThe `acl:agentClass` can be for groups that are defined at a URI like so:\r\n\r\n    <> a acl:Authorization ;\r\n       acl:mode acl:Read ;\r\n       acl:agentClass </rest/groups/editors> .\r\n\r\nWhere `</rest/groups/editors>` is an in-domain URI that consists of a `foaf:Group`, defining a list of users. In principle, that URI could point to any resource on the web, but I had some significant security concerns about that (MITM attacks -- esp. arp poisoning attacks -- would make it an easy target), so in the Fedora impl, it must be an in-domain URI.\r\n\r\n"}}