Skip to content

Commit e3f7b9d

Browse files
langsamulangsamu
committed
WAC-ACP
1 parent cf3d4b9 commit e3f7b9d

1 file changed

Lines changed: 171 additions & 0 deletions

File tree

‎solid26.html‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,15 @@ <h2>Table of Contents</h2>
301301
<p><a class="tocxref" href="#implementation-guidance"><bdi class="secno">3.</bdi> <span>Implementation Guidance</span></a></p>
302302
<ol>
303303
<li class="tocline"><a class="tocxref" href="#webid"><bdi class="secno">3.1</bdi> <span>WebID</span></a></li>
304+
<li class="tocline">
305+
<p><a class="tocxref" href="#wac-and-acp"><bdi class="secno">3.2</bdi> <span>WAC and ACP</span></a></p>
306+
<ol>
307+
<li class="tocline"><a class="tocxref" href="#data-model-comparison"><bdi class="secno">3.2.1</bdi> <span>Data Model Comparison</span></a></li>
308+
<li class="tocline"><a class="tocxref" href="#converting-wac-to-acp"><bdi class="secno">3.2.2</bdi> <span>Converting WAC to ACP</span></a></li>
309+
<li class="tocline"><a class="tocxref" href="#converting-acp-to-wac"><bdi class="secno">3.2.3</bdi> <span>Converting ACP to WAC</span></a></li>
310+
<li class="tocline"><a class="tocxref" href="#summary-of-convertible-features"><bdi class="secno">3.2.4</bdi> <span>Summary of Convertible Features</span></a></li>
311+
</ol>
312+
</li>
304313
</ol>
305314
</li>
306315
<li class="tocline"><a class="tocxref" href="#references"><span>References</span></a></li>
@@ -427,6 +436,165 @@ <h4><span>Note</span></h4>
427436
</div>
428437
</div>
429438
</section>
439+
440+
<section id="wac-and-acp" inlist="" rel="schema:hasPart" resource="#wac-and-acp">
441+
<h3 property="schema:name">WAC and ACP</h3>
442+
<div datatype="rdf:HTML" property="schema:description">
443+
<p>The Solid ecosystem defines two access control systems: [<a href="#ref-wac">WAC</a>] and [<a href="#ref-acp">ACP</a>]. A Solid server implements one or both of these. Clients working across servers may need to convert between the two representations.</p>
444+
<p>WAC and ACP overlap in what they can express but are not equivalent. WAC uses a flat list of <code>acl:Authorization</code> instances. ACP uses a layered structure of Access Control Resources, Access Controls, Policies, and Matchers. Some constructs in each system have no counterpart in the other.</p>
445+
446+
<section id="data-model-comparison" inlist="" rel="schema:hasPart" resource="#data-model-comparison">
447+
<h4>Data Model Comparison</h4>
448+
<div datatype="rdf:HTML" property="schema:description">
449+
<p>A WAC authorization (an instance of <code>acl:Authorization</code>) combines access objects, access modes, and access subjects into a single resource. It uses <code>acl:accessTo</code> and <code>acl:default</code> to identify target resources, <code>acl:mode</code> to specify permissions, and <code>acl:agent</code>, <code>acl:agentClass</code>, <code>acl:agentGroup</code>, and <code>acl:origin</code> to identify subjects.</p>
450+
<p>ACP separates these concerns across multiple classes. An <code>acp:AccessControlResource</code> connects a resource to one or more <code>acp:AccessControl</code> instances via <code>acp:accessControl</code> and <code>acp:memberAccessControl</code>. Each Access Control links to Policies via <code>acp:apply</code>. A Policy specifies allowed and denied modes via <code>acp:allow</code> and <code>acp:deny</code>, and references Matchers via <code>acp:allOf</code>, <code>acp:anyOf</code>, and <code>acp:noneOf</code>. A Matcher describes agent, client, issuer, and credential conditions.</p>
451+
</div>
452+
</section>
453+
454+
<section id="converting-wac-to-acp" inlist="" rel="schema:hasPart" resource="#converting-wac-to-acp">
455+
<h4>Converting WAC to ACP</h4>
456+
<div datatype="rdf:HTML" property="schema:description">
457+
<p>Each <code>acl:Authorization</code> produces one <code>acp:AccessControlResource</code> containing one <code>acp:AccessControl</code>, one <code>acp:Policy</code>, and one <code>acp:Matcher</code>.</p>
458+
459+
<ol>
460+
<li id="wac2acp-step-0">For each <code>acl:Authorization</code> in the source:</li>
461+
<li id="wac2acp-step-1">If the authorization has any <code>acl:origin</code> values, the conversion fails. WAC's origin-based access has no equivalent in ACP's matcher model.</li>
462+
<li id="wac2acp-step-2">If <code>acl:accessTo</code> is present, create an <code>acp:AccessControlResource</code> and link it to a new <code>acp:AccessControl</code> via <code>acp:accessControl</code>. Set <code>acp:resource</code> to the value of <code>acl:accessTo</code>. Then populate the Policy and Matcher as described in steps 4–7.</li>
463+
<li id="wac2acp-step-3">If <code>acl:default</code> is present, create an <code>acp:AccessControlResource</code> and link it to a new <code>acp:AccessControl</code> via <code>acp:memberAccessControl</code>. Set <code>acp:resource</code> to the value of <code>acl:default</code>. The <code>acp:memberAccessControl</code> property provides the transitive inheritance that <code>acl:default</code> provides in WAC. Then populate the Policy and Matcher as described in steps 4–7.</li>
464+
<li id="wac2acp-step-4">Create a new <code>acp:AccessControl</code>, a new <code>acp:Policy</code>, and a new <code>acp:Matcher</code>. Link the Access Control to the Access Control Resource's <code>acp:accessControl</code> or <code>acp:memberAccessControl</code> set (depending on step 2 or 3). Link the Policy to the Access Control via <code>acp:apply</code>. Link the Matcher to the Policy via <code>acp:allOf</code>.</li>
465+
<li id="wac2acp-step-5">For each <code>acl:mode</code> value on the authorization, add it to the Policy via <code>acp:allow</code>. Both systems use the same mode IRIs from the ACL vocabulary (<code>acl:Read</code>, <code>acl:Write</code>, <code>acl:Control</code>, <code>acl:Append</code>).</li>
466+
<li id="wac2acp-step-6">For each <code>acl:agent</code> value:
467+
<ul>
468+
<li>If the value is <code>foaf:Agent</code>, add <code>acp:PublicAgent</code> to the Matcher's <code>acp:agent</code>.</li>
469+
<li>If the value is <code>acl:AuthenticatedAgent</code>, add <code>acp:AuthenticatedAgent</code> to the Matcher's <code>acp:agent</code>.</li>
470+
<li>Otherwise, add the agent IRI directly to the Matcher's <code>acp:agent</code>.</li>
471+
</ul>
472+
</li>
473+
<li id="wac2acp-step-7">For each member of an <code>acl:agentGroup</code> (resolved via <code>vcard:hasMember</code>), add the member IRI to the Matcher's <code>acp:agent</code>. ACP has no group indirection; group members are flattened into individual agent references.</li>
474+
</ol>
475+
</div>
476+
</section>
477+
478+
<section id="converting-acp-to-wac" inlist="" rel="schema:hasPart" resource="#converting-acp-to-wac">
479+
<h4>Converting ACP to WAC</h4>
480+
<div datatype="rdf:HTML" property="schema:description">
481+
<p>Each <code>acp:AccessControlResource</code> produces one <code>acl:Authorization</code>. The authorization accumulates modes and agents from all Access Controls and their Policies.</p>
482+
483+
<ol>
484+
<li id="acp2wac-step-0">Given an <code>acp:AccessControlResource</code> in the source:</li>
485+
<li id="acp2wac-step-1">Create a new <code>acl:Authorization</code>.</li>
486+
<li id="acp2wac-step-2">If the ACR has any <code>acp:accessControl</code> values, set <code>acl:accessTo</code> on the authorization to the ACR's <code>acp:resource</code> value,</li>
487+
<li id="acp2wac-step-3">If the ACR has any <code>acp:memberAccessControl</code> values, set <code>acl:default</code> on the authorization to the ACR's <code>acp:resource</code> value.</li>
488+
<li id="acp2wac-step-4">For each <code>acp:AccessControl</code> linked via <code>acp:accessControl</code> or <code>acp:memberAccessControl</code>, and for each <code>acp:Policy</code> linked via <code>acp:apply</code>:
489+
<ol type="a">
490+
<li id="acp2wac-step-4a">If the Policy has any <code>acp:deny</code> values, the conversion fails. WAC has no deny mechanism.</li>
491+
<li id="acp2wac-step-4b">If the Policy has any <code>acp:anyOf</code> matchers, the conversion fails. WAC has no disjunctive matching.</li>
492+
<li id="acp2wac-step-4c">If the Policy has any <code>acp:noneOf</code> matchers, the conversion fails. WAC has no negation.</li>
493+
<li id="acp2wac-step-4d">For each <code>acp:allow</code> value on the Policy, add it to the authorization's <code>acl:mode</code>.</li>
494+
<li id="acp2wac-step-4e">For each <code>acp:Matcher</code> linked via <code>acp:allOf</code>:
495+
<ul>
496+
<li>If the Matcher has any <code>acp:client</code> values, the conversion fails. WAC has no client restriction.</li>
497+
<li>If the Matcher has any <code>acp:issuer</code> values, the conversion fails. WAC has no issuer restriction.</li>
498+
<li>If the Matcher has any <code>acp:vc</code> values, the conversion fails. WAC has no verifiable credential matching.</li>
499+
<li>For each <code>acp:agent</code> value on the Matcher:
500+
<ul>
501+
<li>If the value is <code>acp:CreatorAgent</code>, the conversion fails. WAC has no creator concept.</li>
502+
<li>If the value is <code>acp:OwnerAgent</code>, the conversion fails. WAC has no owner concept.</li>
503+
<li>If the value is <code>acp:PublicAgent</code>, add <code>foaf:Agent</code> to the authorization's <code>acl:agent</code>.</li>
504+
<li>If the value is <code>acp:AuthenticatedAgent</code>, add <code>acl:AuthenticatedAgent</code> to the authorization's <code>acl:agent</code>.</li>
505+
<li>Otherwise, add the agent IRI directly to the authorization's <code>acl:agent</code>.</li>
506+
</ul>
507+
</li>
508+
</ul>
509+
</li>
510+
</ol>
511+
</li>
512+
</ol>
513+
</div>
514+
</section>
515+
516+
<section id="summary-of-convertible-features" inlist="" rel="schema:hasPart" resource="#summary-of-convertible-features">
517+
<h4>Summary of Convertible Features</h4>
518+
<div datatype="rdf:HTML" property="schema:description">
519+
<table>
520+
<caption>WAC ↔ ACP feature mapping</caption>
521+
<thead>
522+
<tr>
523+
<th>WAC</th>
524+
<th>ACP</th>
525+
</tr>
526+
</thead>
527+
<tbody>
528+
<tr>
529+
<td><code>acl:accessTo</code></td>
530+
<td><code>acp:resource</code> (with <code>acp:accessControl</code>)</td>
531+
</tr>
532+
<tr>
533+
<td><code>acl:default</code></td>
534+
<td><code>acp:resource</code> (with <code>acp:memberAccessControl</code>)</td>
535+
</tr>
536+
<tr>
537+
<td><code>acl:mode</code></td>
538+
<td><code>acp:allow</code></td>
539+
</tr>
540+
<tr>
541+
<td><code>acl:agent</code></td>
542+
<td><code>acp:agent</code></td>
543+
</tr>
544+
<tr>
545+
<td><code>foaf:Agent</code></td>
546+
<td><code>acp:PublicAgent</code></td>
547+
</tr>
548+
<tr>
549+
<td><code>acl:AuthenticatedAgent</code></td>
550+
<td><code>acp:AuthenticatedAgent</code></td>
551+
</tr>
552+
<tr>
553+
<td><code>acl:agentGroup</code> (with <code>vcard:hasMember</code>)</td>
554+
<td><code>acp:agent</code></td>
555+
</tr>
556+
<tr>
557+
<td><code>acl:origin</code></td>
558+
<td>∅</td>
559+
</tr>
560+
<tr>
561+
<td>∅</td>
562+
<td><code>acp:deny</code></td>
563+
</tr>
564+
<tr>
565+
<td>∅</td>
566+
<td><code>acp:anyOf</code></td>
567+
</tr>
568+
<tr>
569+
<td>∅</td>
570+
<td><code>acp:noneOf</code></td>
571+
</tr>
572+
<tr>
573+
<td>∅</td>
574+
<td><code>acp:client</code></td>
575+
</tr>
576+
<tr>
577+
<td>∅</td>
578+
<td><code>acp:issuer</code></td>
579+
</tr>
580+
<tr>
581+
<td>∅</td>
582+
<td><code>acp:vc</code></td>
583+
</tr>
584+
<tr>
585+
<td>∅</td>
586+
<td><code>acp:CreatorAgent</code></td>
587+
</tr>
588+
<tr>
589+
<td>∅</td>
590+
<td><code>acp:OwnerAgent</code></td>
591+
</tr>
592+
</tbody>
593+
</table>
594+
</div>
595+
</section>
596+
</div>
597+
</section>
430598
</div>
431599
</section>
432600

@@ -443,6 +611,9 @@ <h2>References</h2>
443611
<dt id="ref-wac">[WAC]</dt>
444612
<dd><cite><a href="https://solidproject.org/TR/2024/wac-20240512">Web Access Control</a></cite>. W3C Solid Community Group. URL: <a href="https://solidproject.org/TR/2024/wac-20240512">https://solidproject.org/TR/2024/wac-20240512</a></dd>
445613

614+
<dt id="ref-acp">[ACP]</dt>
615+
<dd><cite><a href="https://solidproject.org/TR/2022/acp-20220518">Access Control Policy</a></cite>. W3C Solid Community Group. URL: <a href="https://solidproject.org/TR/2022/acp-20220518">https://solidproject.org/TR/2022/acp-20220518</a></dd>
616+
446617
<dt id="ref-authapp">[BKY+24]</dt>
447618
<dd>
448619
<cite>AuthApp - Portable, Reusable Solid App for GDPR-Compliant Access Granting</cite>.

0 commit comments

Comments
 (0)