Good afternoon.
I've been struggling for four or five days now with failing inline Object
policies - WHEN THE DATABASE IS ORACLE. (When a local McKoi DB the
policies work just fine.)
I've tried a large number of different methods to determine why this is
acting the way it is and can only offer clues.
The biggest of the differences I see between the two flows (McKoi vs
Oracle) is that when using McKoi the DefaultDOManager logs: "Got
DOReader (source=filesystem)", while with Oracle it logs: "Got
DOReader (source=database)".
The policy datastream information does not reside in either
"database" (please see the massive amount of detail
below).
The policy detail can only be seen in the filesystem
data/objects/../object XML file.
As we must use Oracle, we are completely stalled in our effort to migrate
to v2.2.1.
Your help is requested!
Thanks,
John
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
To try and get to the bottom of this I dropped all tables, sequences,
etc. from our Oracle DB, and wiped the data/datastreams. data/objects,
and data/resourceIndex directories. I then fired up the fedora (2.2.1)
instance which created the DB tables as expected. I then used the GUI
admin tool to create an object.
At this point the DB contained the following data in ONLY the following
tables:
DOBJ
DOFIELDS
DOREGISTRY
OBJECTPATHS
PLEASE NOTE:
The DSBIND table was empty:
At this point the
/global/tc/app/tc1/webapps/fedora/CUfedora-2.2.1/data/objects/2007/1116/14/37/xacmltest_jap54
object (as delineated in the OBJECTPATHS DB) contained:
<?xml version="1.0"
encoding="UTF-8"?>
<foxml:digitalObject
xmlns:foxml="info:fedora/fedora-system:def/foxml#"
xmlns:fedoraxsi="
http://www.w3.org/2001/XMLSchema-instance"
xmlns:audit="info:fedora/fedora-system:def/audit#"
fedoraxsi:schemaLocation="info:fedora/fedora-system:def/foxml#
http://www.fedora.info/definitions/1/0/foxml1-0.xsd"
PID="xacmltest:jap54">
<foxml:objectProperties>
<foxml:property
NAME="http://www.w3.org/1999/02/22-rdf-syntax-ns#type"
VALUE="FedoraObject"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#state"
VALUE="Active"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#label"
VALUE="inlineXACMLpolicy"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#ownerId"
VALUE="jap54"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#createdDate"
VALUE="2007-11-16T19:37:36.118Z"/>
<foxml:property
NAME="info:fedora/fedora-system:def/view#lastModifiedDate"
VALUE="2007-11-16T19:37:36.118Z"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#contentModel"
VALUE="foxml"/>
</foxml:objectProperties>
<foxml:datastream ID="DC"
STATE="A" CONTROL_GROUP="X"
VERSIONABLE="true">
<foxml:datastreamVersion
ID="DC1.0" LABEL="Dublin Core Metadata"
CREATED="2007-11-16T19:37:36.118Z"
MIMETYPE="text/xml" SIZE="0">
<foxml:contentDigest TYPE="DISABLED"
DIGEST="none"/>
<foxml:xmlContent>
<oai_dc:dc
xmlns:oai_dc="http://www.openarchives.org/OAI/2.0/oai_dc/"
xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:title>inlineXACMLpolicy</dc:title>
<dc:identifier>xacmltest:jap54</dc:identifier>
</oai_dc:dc>
</foxml:xmlContent>
</foxml:datastreamVersion>
</foxml:datastream>
</foxml:digitalObject>
--------------------------------------------------------------------------------------------------------------------------------------------
Then, also through the GUI admin tool I added a "POLICY"
datastream to this object.
Other than the DOFIELDS table showing an updated MDATE, THIS
ACTION CAUSED NO CHANGES TO THE ORACLE HELD DATA.
However, the filesystem object was updated and contained the
following:
<?xml version="1.0"
encoding="UTF-8"?>
<foxml:digitalObject
xmlns:foxml="info:fedora/fedora-system:def/foxml#"
xmlns:fedoraxsi="
http://www.w3.org/2001/XMLSchema-instance"
xmlns:audit="info:fedora/fedora-system:def/audit#"
fedoraxsi:schemaLocation="info:fedora/fedora-system:def/foxml#
http://www.fedora.info/definitions/1/0/foxml1-0.xsd"
PID="xacmltest:jap54">
<foxml:objectProperties>
<foxml:property
NAME="http://www.w3.org/1999/02/22-rdf-syntax-ns#type"
VALUE="FedoraObject"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#state"
VALUE="Active"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#label"
VALUE="inlineXACMLpolicy"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#ownerId"
VALUE="jap54"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#createdDate"
VALUE="2007-11-16T19:37:36.118Z"/>
<foxml:property
NAME="info:fedora/fedora-system:def/view#lastModifiedDate"
VALUE="2007-11-16T19:44:41.399Z"/>
<foxml:property
NAME="info:fedora/fedora-system:def/model#contentModel"
VALUE="foxml"/>
</foxml:objectProperties>
<foxml:datastream ID="AUDIT"
STATE="A" CONTROL_GROUP="X"
VERSIONABLE="false">
<foxml:datastreamVersion
ID="AUDIT.0" LABEL="Fedora Object Audit Trail"
CREATED="2007-11-16T19:37:36.118Z"
MIMETYPE="text/xml"
FORMAT_URI="info:fedora/fedora-system:format/xml.fedora.audit">
<foxml:xmlContent>
<audit:auditTrail
xmlns:audit="info:fedora/fedora-system:def/audit#">
<audit:record ID="AUDREC1">
<audit:process type="Fedora API-M"/>
<audit:action>addDatastream</audit:action>
<audit:componentID>POLICY</audit:componentID>
<audit:responsibility>jap54</audit:responsibility>
<audit:date>2007-11-16T19:44:41.399Z</audit:date>
<audit:justification>DatastreamsPane generated this
logMessage.</audit:justification>
</audit:record>
</audit:auditTrail>
</foxml:xmlContent>
</foxml:datastreamVersion>
</foxml:datastream>
<foxml:datastream ID="POLICY"
STATE="A" CONTROL_GROUP="X"
VERSIONABLE="true">
<foxml:datastreamVersion
ID="POLICY.0" LABEL="inlineXACMLpolicy"
CREATED="2007-11-16T19:44:41.399Z"
MIMETYPE="text/xml" SIZE="0">
<foxml:contentDigest TYPE="DISABLED"
DIGEST="none"/>
<foxml:xmlContent>
<Policy PolicyId="POLICY"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
xmlns="urn:oasis:names:tc:xacml:1.0:policy"
xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance">
<Description>
This is an object-specific
policy stored inside the xacmltest:jap54 digital object as a POLICY
datastream.
</Description>
<Target>
<Subjects>
<AnySubject/>
</Subjects>
<Resources>
<AnyResource/>
</Resources>
<Actions>
<AnyAction/>
</Actions>
</Target>
<Rule Effect="Deny" RuleId="1">
<Condition
FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
<SubjectAttributeDesignator
AttributeId="urn:fedora:names:fedora:2.1:subject:loginId"
DataType="
http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false"/>
<ResourceAttributeDesignator
AttributeId="urn:fedora:names:fedora:2.1:resource:object:owner"
DataType="
http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false"/>
</Apply>
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">administrator</AttributeValue>
<SubjectAttributeDesignator AttributeId="fedoraRole"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false"/>
</Apply>
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">fedoraInternalCall-1</AttributeValue>
<SubjectAttributeDesignator AttributeId="fedoraRole"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false"/>
</Apply>
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
<SubjectAttributeDesignator AttributeId="permits"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false"/>
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">cu:oit:migrated_permits:cit.fedora</AttributeValue>
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">cu:oit:migrated_permits:cit.fedora.xacmltest.admin</AttributeValue>
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">cu:oit:migrated_permits:cit.fedora.xacmltest.developer</AttributeValue>
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">cu:oit:migrated_permits:cit.fedora.xacmltest.accessor</AttributeValue>
</Apply>
</Apply>
</Apply>
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
<SubjectAttributeDesignator AttributeId="proxy_id"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false"/>
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">krb-web-proxy.serviceid</AttributeValue>
</Apply>
</Apply>
<Apply
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">ytester</AttributeValue>
<SubjectAttributeDesignator AttributeId="fedoraRole"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false"/>
</Apply>
</Apply>
</Condition>
</Rule>
</Policy>
</foxml:xmlContent>
</foxml:datastreamVersion>
</foxml:datastream>
<foxml:datastream ID="DC"
STATE="A" CONTROL_GROUP="X"
VERSIONABLE="true">
<foxml:datastreamVersion
ID="DC1.0" LABEL="Dublin Core Metadata"
CREATED="2007-11-16T19:37:36.118Z"
MIMETYPE="text/xml" SIZE="231">
<foxml:contentDigest TYPE="DISABLED"
DIGEST="none"/>
<foxml:xmlContent>
<oai_dc:dc
xmlns:oai_dc="http://www.openarchives.org/OAI/2.0/oai_dc/"
xmlns:dc="
http://purl.org/dc/elements/1.1/">
<dc:title>inlineXACMLpolicy</dc:title>
<dc:identifier>xacmltest:jap54</dc:identifier>
</oai_dc:dc>
</foxml:xmlContent>
</foxml:datastreamVersion>
</foxml:datastream>
</foxml:digitalObject>