Skip to content

docs(access-rules): clarify Descriptor FieldIdentifier applicability #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aorzelskiGH wants to merge 1 commit into
base: IDTA-01004-3-1_Working
Choose a base branch
from
Open

docs(access-rules): clarify Descriptor FieldIdentifier applicability #78

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,6 +273,15 @@

An Object Group defines a list of single objects and/or a list of names of other object groups.

[[descriptor-applicability]]
===== Descriptor FieldIdentifier Applicability

Descriptor-based FieldIdentifiers (`$aasdesc`, `$smdesc`) address metadata that is only available when the deployment implements a Registry profile according to IDTA-01002 (for example `AssetAdministrationShellRegistryServiceSpecification/SSP-001` or `SubmodelRegistryServiceSpecification/SSP-001`).

In deployments that do not expose Registry endpoints (pure Repository profiles such as `AssetAdministrationShellRepositoryServiceSpecification/SSP-002`), access rules that reference `$aasdesc` or `$smdesc` are *not applicable*: the referenced metadata does not exist in the deployment, so the rule neither grants nor denies access. Evaluation MUST NOT fail because of such a rule; the rule is skipped for that request and any other applicable rules continue to apply.

Implementations SHOULD therefore scope Descriptor-based rules to deployments in which at least one Registry profile is supported. The concrete applicability per IDTA-01002 profile is listed in IDTA-01002 § "Service Specifications and Profiles", sub-section xref:IDTA-01002:http-rest-api/service-specifications-and-profiles.adoc#fieldidentifier-applicability[FieldIdentifier applicability per profile].

Check warning on line 283 in documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc

View workflow job for this annotation

GitHub Actions / qodana

Typo 

Typo: In word 'IDTA'

Check failure on line 283 in documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc

View workflow job for this annotation

GitHub Actions / qodana

Unresolved Antora module 

Antora Module doesn't resolve

Check failure

Code scanning / QDJVMC

Unresolved Antora module Error documentation

Antora Module doesn't resolve

Check warning

Code scanning / QDJVMC

Typo Warning documentation

Typo: In word 'IDTA'

==== Formulas

[source,bnf,linenums]
Expand Down
Loading