Data Access Control

Data Access Control (DAC) allows limiting the visibility of events and objects for local users as well as remote users on other customers systems. It is configured using an XML file, and may be uploaded and downloaded from the /admin/dataAccess REST endpoint. Note that a new uploaded DAC configuration will overwrite the existing configuration.

In the DAC-XML a user enters with a set of roles that are mapped to grants, which are configured with Deny and Allow.

Access is calculated from top to bottom.

The roles used in the RolePrincipals by GTNet starts with "ROLE_". Note that this prefix will be stripped when evaluating grants, so this prefix should be omitted in the Data Access Control files.

There are two magic gan values "local" and "remote" that will match local users and non-local users.

Example

<?xml version="1.0" encoding="UTF-8"?>
<DataAccess xmlns="http://www.tracetracker.com/dac"
  xmlns:ttdata="http://www.tracetracker.com/data"
  xmlns:gtnet="http://www.globaltraceability.net/schema/epcis">
 
 
  <!-- non gan-based ids must be resolved as incoming users will only be identified using gan-id -->
  <Grant user="*" gln="4060800105080" role="user">remote-user</Grant>
  <Grant user="*" org-mapping="SOME ORG">customer</Grant>
  <Grant user="*" role="user">portal-user</Grant>
 
  <!-- Access is calculated from top to bottom -->
  <!-- A couple of magic shorthands -->
  <!-- No access for anyone -->
  <Deny role="*"/>
 
  <!-- Allow everything to remote-administrator -->
  <Allow role="remote-administrator"/>
 
  <!-- Deny remote adminstrator events with a specific bizLocation field -->
  <Deny role="remote-administrator">
    <Event>
      <Field name="bizLocation">urn:epc:id:sgln:0614141.07346.1235</Field>
    </Event>
  </Deny>
 
  <!-- Allow customer to see all ObjectEvents with add-action -->
  <Allow role="customer">
    <Event type="ObjectEvent">
      <Field name="Action">ADD</Field>
    </Event>
  </Allow>
 
  <!-- Deny role customer access to the field bizLocation -->
  <Deny role="customer">
    <Field name="bizLocation"/>
  </Deny>
 
  <!-- Allow customer to see finished product-events -->
  <Allow role="customer">
    <Event>
      <Field name="gtnet#trdType">Finishedproduct</Field>
    </Event>
  </Allow>
 
  <!-- Deny access to extension temperature -->
  <Deny role="customer">
    <Field name="ttdata#temperature"/>
  </Deny>
 
  <!-- Allow access to all properties for role customer for objects of type Finishedproduct and class tradeunit that have been sent 
       to another node. -->
  <Object type="Finishedproduct" class="tradeunit" >
    <SentTo orgid="remote"/>
    <Allow role="customer">
      <Field name="ttdata#*"/>
    </Allow>
  </Object>
 
</DataAccess>

DAC Elements (http://schema.tracetracker.com/dac_1_0.xsd)

At certain places (marked in the tables), it's possible to use star (*) as a wildcard (glob pattern) or comma (,) to separate multiple items.

Grant
Attribute	Description	Default	Supports wildcards	Supports lists
gan	Comma separated list of GANs (Global Access Node)	*	Y	Y
gln	A Global Location Number		N	N
role	Comma separated list of roles.		Y	Y
user	Comma separated list of user names.	*	Y	Y
org	The users organization		Y	Y
org-mapping	Org-mapping alias		N	N

Grants accessing user role if he matches specified criteria.

Example:

<Grant gan="0800000033*,0800000024*" role="user">remote-administrator</Grant>

Explanation:

If user accesses from GAN starting with 0800000033 or 0800000024 and has LDAP role "user", give him DAC role "remote-administrator".

Deny / Allow
Attribute	Description	Default	Supports wildcards	Supports lists
role	which role does this allow/deny rule refers to		Y	Y
gln	which GLNs (Global Location Number) does the rule apply on		N	N
Element	Description
Event	Allows/denies access to this event
Field	Allows/denies access to this field. Note that if Field is nested in Event element, it means allow/deny access to any event that contains such field

Denies / allows access to the specified events or fields of events.

Object
Attribute	Description	Default	Supports wildcards	Supports list
type	TRD type		N	N
class	batch or tradeunit		N	N
Element	Description
SentTo	Selects only objects with defined SentTo
ReceivedFrom	Selects only objects with defined ReceivedFrom
Deny	Specifies Deny rules for selected object
Allow	Specifies Allow rules for selected object

Sets access for objects.

Event
Element	Description
EPC	not implemented yet
anyEPC	not implemented yet
Field	Selects events containing specified field
Attribute	Description	Supports wildcards	Supports list
type	Type of events the rule applies to, e.g. ObjectEvent, AggregationEvent	N	N

Used within Allow/Deny, it selects events to which such rule applies.

SentTo / ReceivedFrom

Attribute

Description

Supports wildcards

Supports lists

ganid

to which GAN ID does the rule apply

N

orgid

to which Organization ID does the rule apply

special values:

"remote", i.e. the EPC is sent between different OrgIDs

"local", i.e. the EPC is sent within a single OrgID

N

Field

Attribute

Description

Supports wildcards

Supports lists

name

name of the event field / object property which the rule applies to

it may contain namespace, e.g. ttdata#* (anything in ttdata namespace)

Y

Used within Allow/Deny, it selects fields to which such rule applies.

Used within Event (which is inside Allow/Deny), it selects events which contain such field.