Create wac-acp-diff-story.md #178

ericprud · 2021-02-22T10:27:35Z

A little store to bootstream WAC users to understand ACP

proposals/acp/wac-acp-diff-story.md

Co-authored-by: Ted Thibodeau Jr <[email protected]>

bblfish

Is describing WAC with Shex not over constraining WAC? Will not any WAC extension that is consistent with the semantics not break any of the rules presented here?
Shex it seems to me is good at describing the current very constrained situation, but not one where description logics are deployed.

bblfish · 2021-02-24T22:59:20Z

proposals/acp/wac-acp-diff-story.md

+
+<AclShape> {
+  # who
+  (  acl:agentClass @<GroupShape> OR [foaf:Agent] ;


According to Shex Value sets this statement says that ACL Shapes are constraining the acl:agentClass range to be a Group with member or the singleton foaf:Agent.
But that is overly restrictive interpretation of WAC:

In Issue 176 I point to the fact that WAC has a subclass of foaf:Agent that is acl:AuthenticatedAgent. This shows that WAC always intended to allow subclasses of foaf:Agent to be allowed in the range of acl:agentClass

Given that one can use subclasses of foaf:Agent as the range of acl:AgentClass one can also build descriptions of agents in many more ways, as show again in issue Limitations: Only Trust Certain issuers of Identity #176. This may not fit current deployments of WAC but those don't fit current deployments of ACP either.
There is nothing therefore stopping WAC to grow to allow these extensions.

The danger of using Shex here is that its argument works by over constraining WAC and then showing it cannot be extended in the way it clearly can.

This is overly restrictive. The acl ontology has

acl:agentClass a rdf:Property; :comment "A class of persons or social entities to being given the right"; :domain acl:Authorization; :label "agent class"; :range :Class .

which states that the range of agent can be any Class, eg the class of people over 18, or over 21, or married people, etc. The ShEX states that the only class can only be foaf:Agent.

bblfish · 2021-02-24T23:08:25Z

proposals/acp/wac-acp-diff-story.md

+
+  # to what resource
+  (   acl:accessTo IRI
+    | acl:accessToClass [foaf:Document] OR @<AclRegexShape>


I am not sure enough about the Shex shape language. But it seems to be saying that acl:accessToClass is either the class foaf:Document or a RegexShape. But that is not right

foaf:Document is a class but that is the least likely class one would use in an access control rule: It would be stating that some set of agents is allowed access to all documents. What is interesting is to place subclasses in that position.

I used regexes in rww-play, but I don't think the current WAC does this. (I may be mistaken). Still a regex can be used as a way among others define a set resources. Other ways are by describing sets of resources related to a date, to authorship, etc... So if you cut out the subclassing possibilities of RDF then you will come to conclusions about the limitations of WAC that are related to the constraint language used, not to wac as an RDF vocabulary.

Co-authored-by: Ted Thibodeau Jr <[email protected]>

bblfish · 2021-02-26T10:39:38Z

I have written up issue #184 showing how one can extend WAC with one relation, to get the same results as ACP gets above (without using regexes).

I think that would be even a clearer way to explain the difference between WAC and ACP, or the contribution of ACP to WAC, however one wants to look at this.

Co-authored-by: Ted Thibodeau Jr <[email protected]>

csarven · 2021-03-03T16:16:53Z

proposals/acp/wac-acp-diff-story.md

+# ACP Compared to Web Access Control
+
+Audience: those familiar with WAC or those who learn from comparisons
+


Indicate that this is for the purpose of discussion/exercise -- as other things are moving in parallel - and not to be taken as authoritative definitions of the mechanisms.

csarven · 2021-03-03T16:45:30Z

proposals/acp/wac-acp-diff-story.md

+This document is intended to reflect the following authoritative-ish definitions:
+- [W3C wiki](http://www.w3.org/wiki/WebAccessControl)
+- [solid/specification](http://github.com/solid/specification)
+- [sold/web-access-control](http://github.com/solid/solid-spec)


Suggested change

This document is intended to reflect the following authoritative-ish definitions:

- [W3C wiki](http://www.w3.org/wiki/WebAccessControl)

- [solid/specification](http://github.com/solid/specification)

- [sold/web-access-control](http://github.com/solid/solid-spec)

This document is intended to reflect the following authoritative-ish definitions/clarifications e.g.:

- [W3C wiki](http://www.w3.org/wiki/WebAccessControl)

- [solid/specification](http://github.com/solid/specification)

- [solid/solid-spec](http://github.com/solid/solid-spec)

- [solid/web-access-control-spec](http://github.com/solid/web-access-control-spec)

This document is intended to reflect the following authoritative-ish definitions/clarifications e.g.:

the following fights with e.g. (readable as, for example)

I suggest either --
This document is intended to reflect the following authoritative-ish definitions/clarifications:
-- or --
This document is intended to reflect a number of authoritative-ish definitions/clarifications, including the following:

bblfish

The over restrictive nature of the ShEx is provably false by consulting the ontology.

bblfish · 2021-03-04T09:52:15Z

proposals/acp/wac-acp-diff-story.md

+
+<AclShape> {
+  # who
+  (  acl:agentClass @<GroupShape> OR [foaf:Agent] ;


This is overly restrictive. The acl ontology has

acl:agentClass a rdf:Property; :comment "A class of persons or social entities to being given the right"; :domain acl:Authorization; :label "agent class"; :range :Class .

which states that the range of agent can be any Class, eg the class of people over 18, or over 21, or married people, etc. The ShEX states that the only class can only be foaf:Agent.

csarven · 2021-03-04T10:25:47Z

proposals/acp/wac-acp-diff-story.md

+  )+ ;
+
+  # can do what
+  acl:mode [acl:Read acl:Write acl:Append acl:Control] + ;


The value set for acl:mode is overly restrictive as per ACL Ontology:

acl:mode a rdf:Property; :comment "A mode of access such as read or write."; :domain acl:Authorization; :label "access mode"; :range :Class .

The rule may reflect deployments however ACL permits any class eg. :Create, :Delete.

note: the acl Ontology would be a lot clearer if it restricted the range of acl:mode to the subclasses of acl:Access. See issue #187

bblfish · 2021-03-05T11:17:23Z

I like this story, as it helps understand what the differences are with how WAC is currently deployed. But if these documents are not just going to be one way conversations, but a way to help grow our common understanding, it should refer to #184 which shows how WAC could do the same. From there we can move on to the next feature of ACP, to see what it brings to the table.

bblfish · 2021-03-05T13:58:55Z

Note: the non-normative ShEx for WAC would actually work with the :authorization proposal in Issue #184 if one applies it to the ACR graph plus authorization linked graphs and the acl:accessControl relation after applying the required simple reasoning, which would add the required acl:accessTo relations.

proposals/acp/wac-acp-diff-story.md

Co-authored-by: elf Pavlik <[email protected]>

proposals/wac-acp-diff-story.md

ericprud · 2021-03-31T16:06:22Z

Per the data interop meeting today, i migrated this to a new file and added a couple properties to WAC's ShEx

Co-authored-by: Ted Thibodeau Jr <[email protected]>

proposals/wac-acp-diff-story.md

Create wac-acp-diff-story.md

9d19b51

A little store to bootstream WAC users to understand ACP

elf-pavlik approved these changes Feb 24, 2021

View reviewed changes

TallTed reviewed Feb 24, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

TallTed reviewed Feb 24, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

TallTed reviewed Feb 24, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

TallTed reviewed Feb 24, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

TallTed reviewed Feb 24, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

TallTed reviewed Feb 24, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

TallTed reviewed Feb 24, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

bblfish and others added 3 commits February 25, 2021 00:00

Update proposals/acp/wac-acp-diff-story.md

2c7b4df

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Update proposals/acp/wac-acp-diff-story.md

69cac5d

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Update proposals/acp/wac-acp-diff-story.md

65ade4d

Co-authored-by: Ted Thibodeau Jr <[email protected]>

bblfish reviewed Feb 24, 2021

View reviewed changes

bblfish and others added 3 commits February 25, 2021 00:11

Update proposals/acp/wac-acp-diff-story.md

4a2bf27

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Update proposals/acp/wac-acp-diff-story.md

a86e3c2

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Update proposals/acp/wac-acp-diff-story.md

3e1bdcc

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Update proposals/acp/wac-acp-diff-story.md

2a48bb1

Co-authored-by: Ted Thibodeau Jr <[email protected]>

csarven reviewed Mar 3, 2021

View reviewed changes

Eric Prud'hommeaux added 3 commits March 3, 2021 17:23

updated intention/scope

01fe4e9

work in progress

71689cb

+ TODO on acl:accessToClass

2023b0f

csarven reviewed Mar 3, 2021

View reviewed changes

bblfish requested changes Mar 4, 2021

View reviewed changes

csarven requested changes Mar 4, 2021

View reviewed changes

bblfish mentioned this pull request Mar 4, 2021

restrict acl:mode, accessToClass, agentClass range definition in ontology #187

Open

elf-pavlik reviewed Mar 31, 2021

View reviewed changes

proposals/acp/wac-acp-diff-story.md Outdated Show resolved Hide resolved

Update proposals/acp/wac-acp-diff-story.md

5260f5f

Co-authored-by: elf Pavlik <[email protected]>

Eric Prud'hommeaux added 2 commits March 31, 2021 17:18

~ updates per 2021-03-31 interop panel meeting

0890add

~ moved wac-acp-diff-story up a directory

419817d

TallTed reviewed Mar 31, 2021

View reviewed changes

proposals/wac-acp-diff-story.md Outdated Show resolved Hide resolved

Update proposals/wac-acp-diff-story.md

e021638

Co-authored-by: Ted Thibodeau Jr <[email protected]>

elf-pavlik reviewed Mar 31, 2021

View reviewed changes

proposals/wac-acp-diff-story.md Outdated Show resolved Hide resolved

Update proposals/wac-acp-diff-story.md

9b471dc

elf-pavlik merged commit 66691b8 into solid:main Apr 7, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create wac-acp-diff-story.md #178

Create wac-acp-diff-story.md #178

ericprud commented Feb 22, 2021

bblfish left a comment •

edited

Loading

bblfish Feb 24, 2021 •

edited

Loading

bblfish Mar 4, 2021 •

edited

Loading

bblfish Feb 24, 2021 •

edited

Loading

bblfish commented Feb 26, 2021 •

edited

Loading

csarven Mar 3, 2021

csarven Mar 3, 2021

TallTed Mar 3, 2021

bblfish left a comment

bblfish Mar 4, 2021 •

edited

Loading

csarven Mar 4, 2021 •

edited

Loading

bblfish Mar 4, 2021 •

edited

Loading

bblfish commented Mar 5, 2021

bblfish commented Mar 5, 2021 •

edited

Loading

ericprud commented Mar 31, 2021

		# ACP Compared to Web Access Control

		Audience: those familiar with WAC or those who learn from comparisons

Create wac-acp-diff-story.md #178

Create wac-acp-diff-story.md #178

Conversation

ericprud commented Feb 22, 2021

bblfish left a comment • edited Loading

Choose a reason for hiding this comment

bblfish Feb 24, 2021 • edited Loading

Choose a reason for hiding this comment

bblfish Mar 4, 2021 • edited Loading

Choose a reason for hiding this comment

bblfish Feb 24, 2021 • edited Loading

Choose a reason for hiding this comment

bblfish commented Feb 26, 2021 • edited Loading

csarven Mar 3, 2021

Choose a reason for hiding this comment

csarven Mar 3, 2021

Choose a reason for hiding this comment

TallTed Mar 3, 2021

Choose a reason for hiding this comment

bblfish left a comment

Choose a reason for hiding this comment

bblfish Mar 4, 2021 • edited Loading

Choose a reason for hiding this comment

csarven Mar 4, 2021 • edited Loading

Choose a reason for hiding this comment

bblfish Mar 4, 2021 • edited Loading

Choose a reason for hiding this comment

bblfish commented Mar 5, 2021

bblfish commented Mar 5, 2021 • edited Loading

ericprud commented Mar 31, 2021

bblfish left a comment •

edited

Loading

bblfish Feb 24, 2021 •

edited

Loading

bblfish Mar 4, 2021 •

edited

Loading

bblfish Feb 24, 2021 •

edited

Loading

bblfish commented Feb 26, 2021 •

edited

Loading

bblfish Mar 4, 2021 •

edited

Loading

csarven Mar 4, 2021 •

edited

Loading

bblfish Mar 4, 2021 •

edited

Loading

bblfish commented Mar 5, 2021 •

edited

Loading