# Usage: How to work with JAAS permissions in the CMS

Author: Daniel Spicar - clerezza.org

Date: January 29, 2009

## 1. Permission Classes and Syntax

The permission classes represent access to system resources. [1] Internally they are represented as classes. In this document we will not go into the details of how to program with them but rather how to use them in the CMS from an administrator's perspective.
Basically a permission has this following syntax

`(fully.qualified.class.name "/path/to/ressource" "actions")`

Example: `(java.io.FilePermission "/home/john/businessplan", "read")`

- fully qualified name is the name of a Java class, here: java.io.FilePermission
- /path/to/ressource is the file businessplan in the example.
- There is only a single action in the example. It is read.

It is easy to see that this permission would grant a user that has it the right to read the file businessplan located in the directory /home/john/.

In the ressource path wildcards and special symbols can be used. Their interpretation depends on the permission. For FilePermission the wildcards are:

- /some/directory/* - all files in /some/directory/
- /some/directory/- - all files in the file system under /some/directory/
- "<<ALL FILES>>" - all files in the file system

The available symbols for standard Java permissions and their interpretation can be found in the Java Security Architecture document. [1]

The actions that are possible depend on the permission. For FilePermission the possible actions are:

- read (read on a directory only grants the right to list the directory content)
- write
- delete
- execute

The available actions for standard Java permissions can be found in the Java Security Architecture document. [1]

## 2. TC permissions

Clerezza uses its own custom permission for access to TripleCollections. The permission class is org.apache.clerezza.rdf.core.access.security.TcPermission. As a ressource it expects an URI. The possible actions are:

- read
- readwrite

Example: `(org.apache.clerezza.rdf.core.access.security.TcPermission "urn:x-localinstance:/system.graph" "readwrite")`

## 3. References

[1] Java Security Architecture, Chapter 3, http://java.sun.com/javase/6/docs/technotes/guides/security/spec/security-spec.doc3.html