Secured Repositories
The Oracle ATG Web Commerce secured repository system works in conjunction with the Oracle ATG Web Commerce Security System to provide fine-grained access control to repository item descriptors, individual repository items, and individual properties through Access Control List (ACL) settings.
Features:
• Control access to repository item descriptors: Control who can create, add, remove, and query items defined by an item descriptor; similar to controlling access to a whole database table.
• Control access to individual repository items: Control who can read, write, destroy, and query a repository item.; similar to controlling access to a single database row.
• Control access to properties of all repository items in a repository item descriptor: Control who can read or write a property in any repository item defined by an item descriptor; similar to controlling access to a database table column.
• Control access to properties of an individual repository item: Control who can read or write a particular property in a repository item; similar to controlling the field of a database table row.
• Limit query results: Control who can receive repository items that are returned by a repository query.
• Set ownership of a repository item: At creation time, the current user is assigned as the owner of the new repository item. The owner can query a repository item and modify its ACL; otherwise this is simply an association of an identity to an Item.
• Automatically generate ACLs for new repository items: When a repository item is created, it is assigned an ACL that is constructed out of an ACL fragment and a template for the creator/owner (creator) and each group the owner belongs to.
Creating a Secured Repository
1. Modify the Underlying Repository:
Add properties to the repository definition as follows
<item-descriptor name=”my”……………. >
….
<property name="item_owner" column-names="item_owner" data-type="string"/>
<property name="item_acl" column-names="item_acl" data-type="string"/>
<property name="secured_property_acl" column-names="secured_property_acl" data-type="string"/>
</item- descriptor>
2. Configure the Secured Repository Adapter Component:
File name: SecuredMyRepository.properties
# SecuredMyRepository.properties
$class=atg.adapter.secure.GenericSecuredMutableRepository
$scope=global
name=My repository for the secured repository implementation
repositoryName=SecuredMyRepository
# the repository that we're wrapping
repository=MyRepository
# The template file that configures the repository
configurationFile=secured-My-repository.xml
# The security configuration component used by the repository
securityConfiguration=/atg/dynamo/security/SecuredRepositorySecurityConfiguration
# Various Dynamo services we need
XMLToolsFactory=/atg/dynamo/service/xml/XMLToolsFactory
transactionManager=/atg/dynamo/transaction/TransactionManager
3. Register the Secured Repository Adapter Component:
/atg/registry/ContentRepositories
initialRepositories+=/MyRepository,/SecuredMyRepository
4. Create the Secured Repository Definition File:
<!-- secured-my-repository.xml -->
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE secured-repository-template
PUBLIC "-//Art Technology Group, Inc.//DTD Dynamo Security//EN"
"http://www.atg.com/dtds/security/secured_repository_template_1.1.dtd">
<secured-repository-template>
<item-descriptor name="my">
<!-- The ACL that applies to the item view/descriptor -->
<descriptor-acl value="Admin$role$administrators-group:
read,write,create,delete;Admin$role$everyone-group:read"/>
<!-- The property where the ownership is stored -->
<owner-property name="item_owner"/>
<!-- The property where ACL is stored in -->
<acl-property name="item_acl"/>
<!-- An ACL fragment that is assigned to all new items -->
<creation-base-acl value="Admin$role$administrators-group:
read,write,list,destroy,read_owner,write_owner,read_acl,write_acl;
Admin$role$everyone-group:read,list"/>
<!-- Access rights assigned to the owner when an item is created -->
<creation-owner-acl-template value="$:read,write,list,destroy"/>
<!-- Access rights assigned to all owner groups when an item is created.
WARNING: This feature can be dangerous. -->
<creation-group-acl-template value="$:read,list"/>
<property name="secured_property">
<!-- The ACL that applies to this property across all repository items -->
<descriptor-acl value="Admin$role$administrators-group:
read,write;Admin$role$everyone-group:read"/>
<!-- The name of the item property where this property's ACL is stored. -->
<acl-property name="secured_property_acl"/>
<!-- An ACL fragment assigned to this property when an item is created. -->
<creation-base-acl value="Admin$role$administrators-group:read,write"/>
<!-- Access rights assigned to the owner when an item is created -->
<creation-owner-acl-template value="$:read,write"/>
<!-- Access rights assigned to all owner groups when an item is created.
WARNING: This feature can be dangerous. -->
<creation-group-acl-template value="$:read,write"/>
</property>
</item-descriptor>
</secured-repository-template>
5. Modify the SQL for the Repository Data Store:
Add following columns to table.
item_owner varchar,
item_acl varchar,
secured_property_acl varchar
6. Rebuild your EAR.
7. Modify the Repository Mapping in Admin/Console to map SecuredMyRepository to both MyRepository_staging and MyRepository_production.
