Security - eXist: A NoSQL Database and Application Development Platform - page 156

Figure 8-17. Change Owner dialog
Access Control Lists
Access control lists (ACLs) are an advanced permissions model that builds upon the
basic Unix-style user and group permissions model that eXist uses. Each resource or
collection in eXist may have an ACL in addition to its standard Unix-style permis‐
sions of owner, group, and mode.
ACLs are a very new feature in eXist, and familiarity with ACLs is certainly not a pre‐
requisite to being able to understand and make use of eXist. ACLs are available to
complement the basic permissions model when it does not provide quite enough for
you. The main advantage of ACLs, when used correctly, is greater flexibility in con‐
trolling access to resources. The ACLs in eXist were inspired by those in the Network
File System v4 (NFSv4) and Zettabyte File System (ZFS), and while they are much
simpler than those in their progenitors, should you choose to use them you must
clearly understand the evaluation order of ACLs when combined with eXist's Unix-
style permissions.
Consider the following scenario: you have a group of 100 users who need to have
access to two different collections: CollectionA and CollectionB . Using the Unix-style
permissions, you would simply create a new security group, GroupA , add all 100 users
to the group, and give that group access to (using an appropriate mode) both Collec‐
tionA and CollectionB and their subresources.
Now suppose that later you are asked to restrict CollectionA so that all but 10 mem‐
bers of the group can access it. This means that you now have to create a second
group, GroupB , containing only 90 of the 100 users and change the permissions on
CollectionA and its subresources. You now have two groups, GroupA and GroupB ,
where GroupB is applied to CollectionA and GroupA is applied to CollectionB . Ninety
users are in both GroupA and GroupB , and GroupA also has an extra 10 users in it. This
quickly becomes a bit of a mess to manage, and so far you have only been asked to
make a single change to the security of the system!
Rather than duplicating 90 of the 100 users from GroupA into GroupB , you could sim‐
ply have used ACLs. Creating a group of the 10 users for whom you want to remove