<?xml version="1.0"?>
<!--<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" "docbookx.dtd">-->

<book xmlns:ci="http://apache.org/cocoon/include/1.0">

	<bookinfo>
		<graphic fileref="logo.jpg"/>
		<productname>Open Source Native XML Database</productname>
		<title>XACML Access Control in eXist</title>
		<author>
			<firstname>Mark</firstname>
			<surname>Harrah</surname>
			<affiliation>
				<address format="linespecific">
					<email>harrah@umd.edu</email>
				</address>
			</affiliation>
		</author>
	</bookinfo>

	<ci:include src="sidebar.xml"/>

	<chapter>
		<title>Access Control in eXist</title>
		<para>
			eXist uses the OASIS standard
			<ulink href="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml">
				eXtensible Access Control Markup Language (XACML)
			</ulink>
			for XQuery access control.  XACML
			<ulink href="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml#XACML11">
				1.1
			</ulink>
			and
			<ulink href="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml#XACML10">
				1.0
			</ulink>
			are currently supported.
		</para>
		<para>
			This documentation is divided into four parts. The first part of this
			documentation, <ulink href="xacml-features.xml">Capabilities</ulink>,
			is intended to be a thorough overview of what in eXist is
			controlled using XACML.  This part does not require prior knowledge of
			XACML and should provide the database administrator with enough information
			to decide whether to enable and use eXist's XACML subsystem.
		</para>
		<para>
			The second part, <ulink href="xacml-intro.xml">Introduction to XACML</ulink>, is a
			brief introduction to XACML.  The targeted level of detail is the level
			necessary to use eXist's policy editor to manage policies (policies
			are how access is restricted in XACML).  It also provides some background
			information on the XACML implementation library used by eXist.
		</para>
		<para>The third part, <ulink href="xacml-usage.xml">Using XACML in eXist</ulink>
			includes a short description of how to configure the XACML subsystem in eXist.
			This covers enabling XACML, the location of policies, and the default behavior
			of the XACML subsystem.  This part then describes how to create, edit, and remove
			policies in eXist using the graphical editor.
		</para>
		<para>
			The last part of the documentation,
			<ulink href="xacml-dev.xml">XACML Developer's Guide</ulink>,
			is targeted towards eXist developers and describes how to implement a Policy
			Enforcement Point (PEP) in eXist, among other topics.
		</para>
		<para>
			A basic description of the operation of access control using XACML in eXist is
			the that database administrator writes policies (either manually or with the
			graphical editor) that determine who can access what resources and when and how
			those resources can be accessed.  When an XQuery is executed (or some other
			controlled resource is accessed), eXist asks Sun's XACML Implementation if that
			action is permitted according to the provided policies.  If access is denied, a
			PermissionDeniedException is thrown.  If it is granted, program execution
			continues normally.
		</para>
	</chapter>
</book>
