Permission model
Use a Permission model object to define the permissions certain Users or UserGroups have for resources under a given namespace. In your Permission model object, you can define the actions that the permission permits, such as READ, EDIT, DELETE, and SHARE.
Platform services and the Passport Service#
In the platform, each service manages the permissions for its own resource types but all permissions are stored in the Passport Service.
Figure: Services, permissions, and the Passport Service data model
Permission object model#
Each permission relates to the following possible platform objects:
- Principal
- Namespace provider
- IRN Resource description
- Permission user
The following model architecture demonstrates the possible objects related to a Permission.
Figure: Objects related to a permission
Creating a Permission object#
To create a permission on the platform, construct a Permission object based on the Permission model schema and post it to the Passport Service with one of the following options:
- JavaScript Platform API using the IafPassSvc API or the API for the relevant service
- REST API
See detailed description of each, below.
JavaScript Platform API using the IafPassSvc API or the API for the relevant service#
| Service | IafPassSvc | Service API |
|---|---|---|
| Passport Service | IafPassSvc.createPermissions() | IafPassSvc.createPermissions() |
| Item Service | createItemPermissions() | IafItemSvc.createPermissions() |
| File Service | createFilePermissions() | IafFileSvc.createPermissions() |
| Datasources Service | createDatasourcePermissions() | IafDataSource.createPermissions() |
| Object Model API Service | IafDataSource.createObjectModelPermissions() |
REST API#
| Service | Service API |
|---|---|
| Passport Service | Create or Update Permissions |
| File Service | Create or Update Permissions |
| Item Service | Create or Update Permissions |
| Object Model API Service | Create or Update Permissions |
Permission lookups#
You can look up permissions with the GET /passportsvc/api/v1/permissions REST API endpoint in the two following ways:
- By IRN: Gets the permissions with IRN patterns that cover the IRN you pass.
- By pattern: Get permissions that have IRNs that match a pattern you pass.
For more information, see Permission lookups.
Permission authorization#
The following diagram demonstrates the data flow for a NamedUserItem request with permission authentication:
| Number | Request/respose |
|---|---|
| 1 | API request GET /nameduseritems/:id to get a NamedUserItem from the Item Service |
| 2 | The Item Service requests the permissions from the Passport Service with GET /PERMISSIONS |
| 3 | The Passport Service responds with a Permission response to the Item Service. |
| 3.1 | The Item Service authorizes based on permissions |
| 4 | The API response that contains the requested NamedUserItem |