Hi Isuru, > On Mar 21, 2020, at 11:42 AM, Isuru Ranawaka <[email protected]> wrote:
>> I thought permissions(read, write) for Resources (experiments, experiment > outputs, projects) are managed through Groups. That means Resources are > shared with Groups and based on Group membership users are granted to > Resources. Can you explain bit more about resource level authorization. Yes, it is just that. Before with role based API access a user needed to have a certain role to call some API methods. With resource level authorization, any user can call the method but the user needs to have the right permission for that resource. For example, we have API methods to get/create/delete credential store tokens. In the old approach only users with role 'admin' could even call those methods. Now all users can call those methods, but each method checks that the user has the appropriate READ (for "get" methods) or WRITE (for delete methods) permission for the given credential store token. (for example: deleteSSHPubKey [1]) I hope that helps. Thanks, Marcus [1] https://github.com/apache/airavata/blob/master/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/handler/AiravataServerHandler.java#L821 <https://github.com/apache/airavata/blob/master/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/handler/AiravataServerHandler.java#L821>
smime.p7s
Description: S/MIME cryptographic signature
