fiware - Can PEP proxy discriminate entities? -
can pep proxy (working idm keyrock) allow access entities of orion?
example scenario:
- there 2 types of entities on orion classified entity_type:
kitchen
,bathroom
- user
plumber
can modify/comsumebathroom
type entities. - user
cook
can create/comsumekitchen
type entities. - user
admin
can modify/create/comsume all entities.
as far know, neither reference implementation of pep proxy (wilma) or ti+d's version (steelskin) offer functionality (though suggested more once).
using standard ngsi operations (updatecontext , querycontext), hard implement in wilma (i think) , require modify orion's plugins in steelskin. piece missing have support fine grained security (in steelskin case) add entity information frn used security.
but if restrict convenience operations (that reflect ids , attributes in url), use security on rest resources restrict resources based on entity features (but imply work xacml , so). in case, both pep proxies used.
edit: here can find complete set of convenience operations, can find information can added url creation of security rules.
Comments
Post a Comment