headers
Serhiy Polyakov | 1 Jul 2011 05:03
Picon

Re: [fcrepo-user] Extracting all audit records with iTQL

Egbert,

Thanks. I rebuilt resource index and now those records are shown once
in iTQL as it should be. Will work with foxml of objects directly to
get audit.

Serhiy

On Thu, Jun 30, 2011 at 4:44 AM, Egbert Gramsbergen
<E.F.Gramsbergen@...> wrote:
> Hello,
>
> The RI index does not keep information from old versions of objects so I would expect each object once in
your iTQL result regardless the number of audits. That is, unless there are accidentally two titles in the
DC datastream after the first correction. To do it right, you would have to do an iTQL query to find all pid's
and then extract the audit records and datastream versions from the object xml (foxml) of each object separately.
>
> Egbert Gramsbergen
> -----Original Message-----
> From: Serhiy Polyakov [mailto:sp0055@...]
> Sent: donderdag 30 juni 2011 10:04
> To: fedora-commons-users@...
> Subject: [fcrepo-user] Extracting all audit records with iTQL
>
> Hello,
>
> I am extracting basic medtadata from fedora repository with iTQL using myhost:8080/fedora/risearch
>
> Here is query:
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Carol Minton Morris | 6 Jul 2011 16:48
Favicon

[fcrepo-user] POSITION: Associate Dean for Research and Informatics at Virginia Tech Libraries

----Posted on behalf of Tyler Walters, Dean, University Libraries, Virginia Tech; E-Mail tyler.walters-PjAqaU27lzQ@public.gmane.org----


The Associate Dean for Research and Informatics (AD-RI) reports to the Dean of University Libraries and has responsibility for integrating and mapping the Virginia Tech Libraries -- its services, resources, and consultative expertise – with the university’s research enterprise, which includes the latter’s policies, planning, processes, and sponsored research initiatives. The AD-RI will work collegially, collaboratively, and effectively with library directors in pursuit of developing the Libraries’ research engagement program, including the application of library and information science to collaborate on and solve problems in the academic disciplines. The position also serves as a member of the Libraries’ senior management team, contributing to the Libraries’ strategic visioning, program development and assessment, technology strategies and directions, and organizational transformation in support of its evolving goals and objectives.

The AD-RI: assumes a leadership role in fostering collaboration between VT library directors, librarians and researchers in regards to researchers’ content/information/data management, virtual research community activities, and other informatics-related needs; takes the lead in effecting the Libraries’ contribution to the university’s research-related information policies, such as open access-related policies and policies responding to research-sponsoring organization’s information management, preservation, and access directives; interacts chiefly with the colleges’ associate deans for research, research institute and center directors/associate directors, department chairs, faculty, the office of the vice president for research, and other research administrators. Moreover, the AD-RI has lead responsibility on behalf of the Libraries for developing successful and productive campus relationships in research programs. The AD-RI also: serves as a liaison with the office of sponsored programs and represents the Dean of University Libraries when needed in research administration matters; enables and fosters research programs within the Libraries and in partnership with other informatics-related VT research units as well as with other universities and government agencies in pursuit of grants, grant proposals, and attendance at multi-institutional pre-proposal planning meetings.

Additional details relating to the position’s responsibilities include: overall development and direction of the Libraries’ research engagement program, with a focus on contributing to the strategic research directions and program goals of the university; support of the Libraries and its faculty in assertively pursuing grant funds as well as providing general coordination for the Libraries’ sponsored projects; development of productive relationships with public and private grantsmaking agencies Seek collaborative opportunities with all manner of VT research units, including its newly formed VT Carilion School of Medicine and Research Institute as well as with research entities in the Virginia Tech Corporate Research Park; cultivation of positive Libraries – campus research unit/faculty relationships; work with associate deans and faculty to increase participation in collaborative research and facilitate partnerships between university research programs and the Libraries; leadership in advancing new forms of research and scholarship; assertive and significant contributions to the Libraries’ organizational learning and development agenda.

--
Carol Minton Morris
DuraSpace
Director of Marketing and Communications
cmmorris-RMZ2BmOfPoTNLxjTenLetw@public.gmane.org
Skype: carolmintonmorris
607 592-3135
Twitter <at> DuraSpace
Twitter <at> DuraCloud
http://DuraSpace.org
------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________
Fedora-commons-users mailing list
Fedora-commons-users@...
https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
Permalink | Reply | 0 comments |
headers
Stuart Chalk | 7 Jul 2011 13:24
Favicon

[fcrepo-user] ownerId not working via REST API ingest

I cannot get the ingest method of the ingest method of the REST API to accept a value in get variable. I send the
following rest request via PHP

Array
(
    [method] => POST
    [uri] => Array
        (
            [host] => localhost
            [port] => 8080
            [path] => /fedora/objects/eureka:exp10
            [query] => Array
                (
                    [label] => Test experiment
                    [ownerId] => Stuart Chalk
                    [namespace] => eureka
                    [format] => info:fedora/fedora-system:FOXML-1.1
                    [logMessage] => Change made using pHedora
                )
        )
    [auth] => Array
        (
            [method] => Basic
            [user] => fedoraAdmin
            [pass] => ********
        )
    [body] => 
)

In fedora.log I get

INFO 2011-07-07 07:00:38.339 [http-8080-2] (DefaultManagement) Completed ingest(objectXML,
format: info:fedora/fedora-system:FOXML-1.1, encoding: UTF-8, pid	: eureka:exp10, logMessage:
Change made using pHedora)

i.e. no mention of the ownerId.  Is it even being used?

Any thoughts appreciated...

Stuart Chalk, Ph.D.
Associate Professor of Chemistry
Department of Chemistry, University of North Florida
1 UNF Drive, Jacksonville FL 32224
P: 904-620-1938
F: 904-620-3535
E: schalk@...
W: http://www.unf.edu/coas/chemistry/

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
Permalink | Reply | 4 comments |
headers
Benjamin Armintor | 7 Jul 2011 18:18
Picon
Gravatar

Re: [fcrepo-user] ownerId not working via REST API ingest

Stuart-
  Does the resulting object have no ownerId at all, or is fedoraAdmin
listed as the ownerId?

- Ben

On 7/7/11, Stuart Chalk <schalk@...> wrote:
> I cannot get the ingest method of the ingest method of the REST API to
> accept a value in get variable. I send the following rest request via PHP
>
> Array
> (
>     [method] => POST
>     [uri] => Array
>         (
>             [host] => localhost
>             [port] => 8080
>             [path] => /fedora/objects/eureka:exp10
>             [query] => Array
>                 (
>                     [label] => Test experiment
>                     [ownerId] => Stuart Chalk
>                     [namespace] => eureka
>                     [format] => info:fedora/fedora-system:FOXML-1.1
>                     [logMessage] => Change made using pHedora
>                 )
>         )
>     [auth] => Array
>         (
>             [method] => Basic
>             [user] => fedoraAdmin
>             [pass] => ********
>         )
>     [body] =>
> )
>
> In fedora.log I get
>
> INFO 2011-07-07 07:00:38.339 [http-8080-2] (DefaultManagement) Completed
> ingest(objectXML, format: info:fedora/fedora-system:FOXML-1.1, encoding:
> UTF-8, pid	: eureka:exp10, logMessage: Change made using pHedora)
>
> i.e. no mention of the ownerId.  Is it even being used?
>
> Any thoughts appreciated...
>
> Stuart Chalk, Ph.D.
> Associate Professor of Chemistry
> Department of Chemistry, University of North Florida
> 1 UNF Drive, Jacksonville FL 32224
> P: 904-620-1938
> F: 904-620-3535
> E: schalk@...
> W: http://www.unf.edu/coas/chemistry/
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Fedora-commons-users mailing list
> Fedora-commons-users@...
> https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
>

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
Permalink | Reply | 3 comments |
headers
Stephen Bayliss | 8 Jul 2011 08:55

Re: [fcrepo-user] ownerId not working via REST API ingest

I've replicated this, it does look like a bug.

In the REST API code, the ownerId query parameter for new, empty objects is
ignored and instead the value of the user making the request is used.

Instead it should only use the value of the user making the request if the
value is not supplied as a query string parameter.

Stuart - would you like to raise a JIRA issue for this?

It should be a relatively trivial code change - see:

https://github.com/fcrepo/fcrepo/blob/master/fcrepo-server/src/main/java/org
/fcrepo/server/rest/FedoraObjectResource.java#L284

(line 284)

Steve

> -----Original Message-----
> From: Benjamin Armintor [mailto:armintor@...] 
> Sent: 07 July 2011 17:18
> To: Support and info exchange list for Fedora users.
> Subject: Re: [fcrepo-user] ownerId not working via REST API ingest
> 
> 
> Stuart-
>   Does the resulting object have no ownerId at all, or is 
> fedoraAdmin listed as the ownerId?
> 
> - Ben
> 
> On 7/7/11, Stuart Chalk <schalk@...> wrote:
> > I cannot get the ingest method of the ingest method of the 
> REST API to 
> > accept a value in get variable. I send the following rest 
> request via 
> > PHP
> >
> > Array
> > (
> >     [method] => POST
> >     [uri] => Array
> >         (
> >             [host] => localhost
> >             [port] => 8080
> >             [path] => /fedora/objects/eureka:exp10
> >             [query] => Array
> >                 (
> >                     [label] => Test experiment
> >                     [ownerId] => Stuart Chalk
> >                     [namespace] => eureka
> >                     [format] => info:fedora/fedora-system:FOXML-1.1
> >                     [logMessage] => Change made using pHedora
> >                 )
> >         )
> >     [auth] => Array
> >         (
> >             [method] => Basic
> >             [user] => fedoraAdmin
> >             [pass] => ********
> >         )
> >     [body] =>
> > )
> >
> > In fedora.log I get
> >
> > INFO 2011-07-07 07:00:38.339 [http-8080-2] (DefaultManagement) 
> > Completed ingest(objectXML, format: 
> info:fedora/fedora-system:FOXML-1.1, encoding:
> > UTF-8, pid	: eureka:exp10, logMessage: Change made using pHedora)
> >
> > i.e. no mention of the ownerId.  Is it even being used?
> >
> > Any thoughts appreciated...
> >
> > Stuart Chalk, Ph.D.
> > Associate Professor of Chemistry
> > Department of Chemistry, University of North Florida
> > 1 UNF Drive, Jacksonville FL 32224
> > P: 904-620-1938
> > F: 904-620-3535
> > E: schalk@...
> > W: http://www.unf.edu/coas/chemistry/
> >
> >
> > 
> ----------------------------------------------------------------------
> > --------
> > All of the data generated in your IT infrastructure is 
> seriously valuable.
> > Why? It contains a definitive record of application 
> performance, security
> > threats, fraudulent activity, and more. Splunk takes this 
> data and makes
> > sense of it. IT sense. And common sense.
> > http://p.sf.net/sfu/splunk-d2d-c2
> > _______________________________________________
> > Fedora-commons-users mailing list
> > Fedora-commons-users@...
> > https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
> >
> 
> --------------------------------------------------------------
> ----------------
> All of the data generated in your IT infrastructure is 
> seriously valuable. Why? It contains a definitive record of 
> application performance, security 
> threats, fraudulent activity, and more. Splunk takes this 
> data and makes 
> sense of it. IT sense. And common sense. 
> http://p.sf.net/sfu/splunk-d2d-c2 
> _______________________________________________
> Fedora-commons-users mailing list 
> Fedora-commons-users@...
> https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
> 

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
Permalink | Reply | 1 comment |
headers
Stuart Chalk | 8 Jul 2011 11:37
Favicon

Re: [fcrepo-user] ownerId not working via REST API ingest

I get fedoraAdmin not an empty field.
I have reported this as FCREPO-963.

Stuart

On Jul 7, 2011, at 12:18 PM, Benjamin Armintor wrote:

> Stuart-
>  Does the resulting object have no ownerId at all, or is fedoraAdmin
> listed as the ownerId?
> 
> - Ben
> 
> On 7/7/11, Stuart Chalk <schalk@...> wrote:
>> I cannot get the ingest method of the ingest method of the REST API to
>> accept a value in get variable. I send the following rest request via PHP
>> 
>> Array
>> (
>>    [method] => POST
>>    [uri] => Array
>>        (
>>            [host] => localhost
>>            [port] => 8080
>>            [path] => /fedora/objects/eureka:exp10
>>            [query] => Array
>>                (
>>                    [label] => Test experiment
>>                    [ownerId] => Stuart Chalk
>>                    [namespace] => eureka
>>                    [format] => info:fedora/fedora-system:FOXML-1.1
>>                    [logMessage] => Change made using pHedora
>>                )
>>        )
>>    [auth] => Array
>>        (
>>            [method] => Basic
>>            [user] => fedoraAdmin
>>            [pass] => ********
>>        )
>>    [body] =>
>> )
>> 
>> In fedora.log I get
>> 
>> INFO 2011-07-07 07:00:38.339 [http-8080-2] (DefaultManagement) Completed
>> ingest(objectXML, format: info:fedora/fedora-system:FOXML-1.1, encoding:
>> UTF-8, pid	: eureka:exp10, logMessage: Change made using pHedora)
>> 
>> i.e. no mention of the ownerId.  Is it even being used?
>> 
>> Any thoughts appreciated...
>> 
>> Stuart Chalk, Ph.D.
>> Associate Professor of Chemistry
>> Department of Chemistry, University of North Florida
>> 1 UNF Drive, Jacksonville FL 32224
>> P: 904-620-1938
>> F: 904-620-3535
>> E: schalk@...
>> W: http://www.unf.edu/coas/chemistry/
>> 
>> 
>> ------------------------------------------------------------------------------
>> All of the data generated in your IT infrastructure is seriously valuable.
>> Why? It contains a definitive record of application performance, security
>> threats, fraudulent activity, and more. Splunk takes this data and makes
>> sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-d2d-c2
>> _______________________________________________
>> Fedora-commons-users mailing list
>> Fedora-commons-users@...
>> https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
>> 
> 
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security 
> threats, fraudulent activity, and more. Splunk takes this data and makes 
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Fedora-commons-users mailing list
> Fedora-commons-users@...
> https://lists.sourceforge.net/lists/listinfo/fedora-commons-users

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
Permalink | Reply | 0 comments |
headers
Stuart Chalk | 8 Jul 2011 11:38
Favicon

Re: [fcrepo-user] ownerId not working via REST API ingest

Yes, I have reported this as FCREPO-963.  Thanks for verifying as I thought I was going crazy :)

Stuart

On Jul 8, 2011, at 2:55 AM, Stephen Bayliss wrote:

> I've replicated this, it does look like a bug.
> 
> In the REST API code, the ownerId query parameter for new, empty objects is
> ignored and instead the value of the user making the request is used.
> 
> Instead it should only use the value of the user making the request if the
> value is not supplied as a query string parameter.
> 
> Stuart - would you like to raise a JIRA issue for this?
> 
> It should be a relatively trivial code change - see:
> 
> https://github.com/fcrepo/fcrepo/blob/master/fcrepo-server/src/main/java/org
> /fcrepo/server/rest/FedoraObjectResource.java#L284
> 
> (line 284)
> 
> Steve
> 
> 
> 
>> -----Original Message-----
>> From: Benjamin Armintor [mailto:armintor@...] 
>> Sent: 07 July 2011 17:18
>> To: Support and info exchange list for Fedora users.
>> Subject: Re: [fcrepo-user] ownerId not working via REST API ingest
>> 
>> 
>> Stuart-
>>  Does the resulting object have no ownerId at all, or is 
>> fedoraAdmin listed as the ownerId?
>> 
>> - Ben
>> 
>> On 7/7/11, Stuart Chalk <schalk@...> wrote:
>>> I cannot get the ingest method of the ingest method of the 
>> REST API to 
>>> accept a value in get variable. I send the following rest 
>> request via 
>>> PHP
>>> 
>>> Array
>>> (
>>>    [method] => POST
>>>    [uri] => Array
>>>        (
>>>            [host] => localhost
>>>            [port] => 8080
>>>            [path] => /fedora/objects/eureka:exp10
>>>            [query] => Array
>>>                (
>>>                    [label] => Test experiment
>>>                    [ownerId] => Stuart Chalk
>>>                    [namespace] => eureka
>>>                    [format] => info:fedora/fedora-system:FOXML-1.1
>>>                    [logMessage] => Change made using pHedora
>>>                )
>>>        )
>>>    [auth] => Array
>>>        (
>>>            [method] => Basic
>>>            [user] => fedoraAdmin
>>>            [pass] => ********
>>>        )
>>>    [body] =>
>>> )
>>> 
>>> In fedora.log I get
>>> 
>>> INFO 2011-07-07 07:00:38.339 [http-8080-2] (DefaultManagement) 
>>> Completed ingest(objectXML, format: 
>> info:fedora/fedora-system:FOXML-1.1, encoding:
>>> UTF-8, pid	: eureka:exp10, logMessage: Change made using pHedora)
>>> 
>>> i.e. no mention of the ownerId.  Is it even being used?
>>> 
>>> Any thoughts appreciated...
>>> 
>>> Stuart Chalk, Ph.D.
>>> Associate Professor of Chemistry
>>> Department of Chemistry, University of North Florida
>>> 1 UNF Drive, Jacksonville FL 32224
>>> P: 904-620-1938
>>> F: 904-620-3535
>>> E: schalk@...
>>> W: http://www.unf.edu/coas/chemistry/
>>> 
>>> 
>>> 
>> ----------------------------------------------------------------------
>>> --------
>>> All of the data generated in your IT infrastructure is 
>> seriously valuable.
>>> Why? It contains a definitive record of application 
>> performance, security
>>> threats, fraudulent activity, and more. Splunk takes this 
>> data and makes
>>> sense of it. IT sense. And common sense.
>>> http://p.sf.net/sfu/splunk-d2d-c2
>>> _______________________________________________
>>> Fedora-commons-users mailing list
>>> Fedora-commons-users@...
>>> https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
>>> 
>> 
>> --------------------------------------------------------------
>> ----------------
>> All of the data generated in your IT infrastructure is 
>> seriously valuable. Why? It contains a definitive record of 
>> application performance, security 
>> threats, fraudulent activity, and more. Splunk takes this 
>> data and makes 
>> sense of it. IT sense. And common sense. 
>> http://p.sf.net/sfu/splunk-d2d-c2 
>> _______________________________________________
>> Fedora-commons-users mailing list 
>> Fedora-commons-users@...
>> https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
>> 
> 
> 
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security 
> threats, fraudulent activity, and more. Splunk takes this data and makes 
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Fedora-commons-users mailing list
> Fedora-commons-users@...
> https://lists.sourceforge.net/lists/listinfo/fedora-commons-users

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
Permalink | Reply | 0 comments |
headers
Ludovic Deravet | 8 Jul 2011 17:08
Picon

[fcrepo-user] Instability under heavy load

Dear all,


We are experiencing a serious issue with Fedora when ingesting thousands of packages into the repository. Indeed, the development of our project is almost finished and our customer is trying to perform massive load of objects into Fedora before going into production.

However an instability problem that manifest itself through java heap out of memory errors appears when the customer wants to ingest about 10.000 of METS envelopes. 

Internally, our application is transforming all METS envelopes into FOXML files that are then sent to the Fedora's REST's API. And documents are defined as content managed datastreams.

To give some figures about these envelopes:
  • A METS envelope defines in average 80 digital objects
  • 10% of the envelopes reference documents where their total size is lower than 1MB
  • 65% of the envelopes reference documents where their total size is between 1MB and 5MB
  • 20% of the envelopes reference documents where their total size is between 5MB and 10MB
  • 5% of the envelopes reference documents where their total size is bigger than 10MB
Fedora is installed on a production-like hardware:
  • Sun Oracle Enterprise M5000 - 2 clusters of 4 CPUs 2.53GHZ SPARC64 USVII (so 32 cores in total) 
  • JVM is configured with 2GB of memory (-Xmx2048m)
  • JVM is in server mode on Solaris 10 (64bits)
  • Fedora-commons 3.4.2 with default configuration options activated
In a production-like environment, our application is in fact launching 10 threads where each thread is processing one METS envelope at a time. We realize that this is kind of stressful for Fedora but the customer is expecting us to ingest all their METS envelopes in a reasonable short period of time.

We have performed many different tests in our development environment (of course quite less powerful than the production-like environment) and cannot reproduce the instability problem we are experiencing in production.

We have analyzed in our development environment how Fedora is managing the memory and everything seems normal. The Garbage is working fine even if we set the heap size to 255MB and try to ingest several MB of data.

I really doubt that this problem lies within Fedora itself. Instead, I think that the problem is more a configuration issue somewhere but right now we don't know which one exactly. Is there someone that could share their experience with such issue and help us try to find a solution to this problem?

Thank you in advance for any help.

Kind regards,
--
Ludovic
------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________
Fedora-commons-users mailing list
Fedora-commons-users@...
https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
Permalink | Reply | 7 comments |
headers
thio | 8 Jul 2011 17:24
Picon
Favicon

[fcrepo-user] What is wrong with my Policy?

Hi!

Recently i was asked to build Policies for Fedora Objects.

I have looked at the policy writing guide, and so far doing it like THAT works, but i find this style kind of convoluted.

Since i only need simple rules i thought i could as well use the "straightforward" way, which is closer to the datamodel i get.

To give you an example, a policy that shuts everyone out but admins:

-guide:
<Policy PolicyId="demo" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
  xmlns="urn:oasis:names:tc:xacml:1.0:policy" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <Target>
    <Subjects>
      <AnySubject/>
    </Subjects>
    <Resources>
      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">changeme:10061</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:resource:object:pid" DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </ResourceMatch>
      </Resource>
    </Resources>
    <Actions>
      <AnyAction/>
    </Actions>
  </Target>
  <Rule Effect="Deny" RuleId="1">
    <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
        <SubjectAttributeDesignator AttributeId="fedoraRole" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">administrator</AttributeValue>
        </Apply>
      </Apply>
    </Condition>
  </Rule>
  <Rule Effect="Permit" RuleId="3"/>
</Policy>

-mine:
<Policy PolicyId="changeme:10061:DenyAllDefaultPolicy"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
    <Target>
        <Subjects>
            <AnySubject />
        </Subjects>
        <Resources>
            <Resource>
                <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">changeme:10059
                    </AttributeValue>
                    <ResourceAttributeDesignator
                        AttributeId="urn:fedora:names:fedora:2.1:resource:object:pid"
                        DataType="http://www.w3.org/2001/XMLSchema#string" />
                </ResourceMatch>
            </Resource>
        </Resources>
        <Actions>
            <AnyAction />
        </Actions>
    </Target>
    <Rule RuleId="AdminRule" Effect="Permit">
        <Target>
            <Subjects>
                <Subject>
                    <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">administrator
                        </AttributeValue>
                        <SubjectAttributeDesignator
                            AttributeId="fedoraRole" DataType="http://www.w3.org/2001/XMLSchema#string" />
                    </SubjectMatch>
                </Subject>
            </Subjects>
            <Resources>
                <AnyResource />
            </Resources>
            <Actions>
                <AnyAction />
            </Actions>
        </Target>
    </Rule>
    <Rule RuleId="FinalRule" Effect="Deny">
    </Rule>
</Policy>

As far as i understood this SHOULD constitute the same behaviour, but my policy doesn't shut anyone out. And i have no idea why not.

greetings and thanks for any help,
Jessi
------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________
Fedora-commons-users mailing list
Fedora-commons-users@...
https://lists.sourceforge.net/lists/listinfo/fedora-commons-users
Permalink | Reply | 7 comments |
headers
Benjamin Armintor | 8 Jul 2011 17:53
Picon
Gravatar

Re: [fcrepo-user] What is wrong with my Policy?

Are the unexpected Permit results coming when a user is logged in, has
a fedoraRole, but it is not "administrator"? Or is it that no one is
logged in/the logged in user has no fedoraRole?

If the latter, the first thing I would try is adding
MustBePresent="false" to your subjectAttributeDesignator.  According
to the spec:
http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os.pdf

it effectively default to "true", and returns an Indeterminate result
in the event of a missing attribute.  Quoting from the rule evaluation
spec:
"If the target value is "No-match" or “Indeterminate” then the rule
value SHALL be “NotApplicable” or “Indeterminate”, respectively,
regardless of the value of the condition.  For these cases, therefore,
the condition need not be evaluated."

Since you have no condition, it may be applying that rule whenever the
fedoraRole attribute is missing.

On 7/8/11, thio <thio@...> wrote:
> Hi!
>
> Recently i was asked to build Policies for Fedora Objects.
>
> I have looked at the policy writing guide, and so far doing it like THAT
> works, but i find this style kind of convoluted.
>
> Since i only need simple rules i thought i could as well use the
> "straightforward" way, which is closer to the datamodel i get.
>
> To give you an example, a policy that shuts everyone out but admins:
>
> _*-guide:*_
> <Policy PolicyId="demo"
> RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
>    xmlns="urn:oasis:names:tc:xacml:1.0:policy"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
> <Target>
> <Subjects>
> <AnySubject/>
> </Subjects>
> <Resources>
> <Resource>
> <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
> <AttributeValue
> DataType="http://www.w3.org/2001/XMLSchema#string">changeme:10061</AttributeValue>
> <ResourceAttributeDesignator
> AttributeId="urn:fedora:names:fedora:2.1:resource:object:pid"
> DataType="http://www.w3.org/2001/XMLSchema#string"/>
> </ResourceMatch>
> </Resource>
> </Resources>
> <Actions>
> <AnyAction/>
> </Actions>
> </Target>
> <Rule Effect="Deny" RuleId="1">
> <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
> <Apply
> FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
> <SubjectAttributeDesignator AttributeId="fedoraRole"
> DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
> <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
> <AttributeValue
> DataType="http://www.w3.org/2001/XMLSchema#string">administrator</AttributeValue>
> </Apply>
> </Apply>
> </Condition>
> </Rule>
> <Rule Effect="Permit" RuleId="3"/>
> </Policy>
> _*
> -mine:*_
> <Policy PolicyId="changeme:10061:DenyAllDefaultPolicy"
>
> RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
> <Target>
> <Subjects>
> <AnySubject />
> </Subjects>
> <Resources>
> <Resource>
> <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
> <AttributeValue
> DataType="http://www.w3.org/2001/XMLSchema#string">changeme:10059
> </AttributeValue>
> <ResourceAttributeDesignator
>
> AttributeId="urn:fedora:names:fedora:2.1:resource:object:pid"
>
> DataType="http://www.w3.org/2001/XMLSchema#string" />
> </ResourceMatch>
> </Resource>
> </Resources>
> <Actions>
> <AnyAction />
> </Actions>
> </Target>
> <Rule RuleId="AdminRule" Effect="Permit">
> <Target>
> <Subjects>
> <Subject>
> <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
> <AttributeValue
> DataType="http://www.w3.org/2001/XMLSchema#string">administrator
> </AttributeValue>
> <SubjectAttributeDesignator
>                              AttributeId="fedoraRole"
> DataType="http://www.w3.org/2001/XMLSchema#string" />
> </SubjectMatch>
> </Subject>
> </Subjects>
> <Resources>
> <AnyResource />
> </Resources>
> <Actions>
> <AnyAction />
> </Actions>
> </Target>
> </Rule>
> <Rule RuleId="FinalRule" Effect="Deny">
> </Rule>
> </Policy>
>
> As far as i understood this SHOULD constitute the same behaviour, but my
> policy doesn't shut anyone out. And i have no idea why not.
>
> greetings and thanks for any help,
> Jessi
>

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
Permalink | Reply | 6 comments |

Gmane