source: examples/python_tests/access_ctxt_rt2/README @ da045c2

#####################################################################
# This example shows the use of multiple contexts in one session. 
# This is based on access_rt2. It demonstrates using an oset (object set)
# to control access to files based on the attributes of the principals.
# The script creates three principals Alpha, Bob and Joe and sets out 
# the access policy.
# 
# files are named by URNs and are not principals.
# 
# A principal's access rights are controlled by the Alpha principal.  If a 
# principal has the role role::acess(string:'Read', urn:filename) that 
# principal can Read filename.  
# The policy names 2 teams, proj1 and proj2.  A principal is on proj1 if it
# has the role team(string:'proj1') defined by Alpha (written
# [keyid:Alpha].role:team(string:'proj1')).  Each project has an associated set
# of files, defined by object sets.  A file is in proj1's documents if it is in
# the oset of documents('proj1') defined by Alpha, written
# [keyid:Alpha].oset:documents(string:'proj1'))
# 
# The example below lays out the policy that members of a given project can
# Read the documents of that project in Credential 1 and adds file://fileA to
# the document set for proj1 in Credential 2 - note that no principal is
# required for fileA.  It adds file://fileB to the proj2 in Credential 3 and
# file://fileC to proj2 in Credential 4 and to proj1 in Credential 5 (shared
# by both projects).
# Credentials 6 & 7 add Bob to proj1 and Joe to proj2.
#
# The attached query.py file runs queries in multiple contexts.
# 3 kinds of contexts are made. context#A includes Credential 1-7.
# context#B is partial dup of context#A with Credential from 1,(no 2),3-7.
# context#C includes Credential 1-3,(no 4),5-7.  Various queries are made againt each context.
# First it confirms that Bob can Read fileA from context#A and context#C but not
# context#B, then it confirms that Joe cannot read fileA from any of contexts.
# Finally it confirms that Joe can read fileC from context#A and context#B but not
# context#C.

# access_ctxt_rt2

# Credential 1
#[keyid:alpha].role:access([string:'Read'],
#                    [urn:?F[keyid:alpha].oset:documents([string:?P])])
#                                     <- [keyid:alpha].role:team([string:?P]) 

# Credential 2
#[keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA'] 
# Credential 3
#[keyid:alpha].oset:documents([string:'proj2'])<-[urn:'file//fileB'] 
# Credential 4
#[keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileC'] 
# Credential 5
#[keyid:alpha].oset:documents([string:'proj2'])<-[urn:'file//fileC'] 

# Credential 6
# [keyid:alpha].role:team([string:'proj1'])<-[keyid:Bob]
# Credential 7
# [keyid:alpha].role:team([string:'proj2'])<-[keyid:Joe]