Hi Marcus, that helps a lot.
thank you. On Mon, Mar 23, 2020 at 8:40 PM Christie, Marcus Aaron <[email protected]> wrote: > Hi Isuru, > > On Mar 21, 2020, at 11:42 AM, Isuru Ranawaka <[email protected]> wrote: > > > I thought permissions(read, write) for Resources (experiments, experiment > > outputs, projects) are managed through Groups. That means Resources are > shared with Groups and based on Group membership users are granted to > Resources. Can you explain bit more about resource level authorization. > > > Yes, it is just that. Before with role based API access a user needed to > have a certain role to call some API methods. With resource level > authorization, any user can call the method but the user needs to have the > right permission for that resource. > > For example, we have API methods to get/create/delete credential store > tokens. In the old approach only users with role 'admin' could even call > those methods. Now all users can call those methods, but each method checks > that the user has the appropriate READ (for "get" methods) or WRITE (for > delete methods) permission for the given credential store token. (for > example: deleteSSHPubKey [1]) > > I hope that helps. > > Thanks, > > Marcus > > [1] > https://github.com/apache/airavata/blob/master/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/handler/AiravataServerHandler.java#L821 > > -- Senior Engineer WSO2 Lanka (pvt) Ltd Blog:- http://isurur.blogspot.com/ Phone:- +94714629880
