user-access.xml.template

<!--
  ~ /////////////////////////////////////////////////////////////////////////////
  ~ // This file is part of the "Hyrax Data Server" project.
  ~ //
  ~ //
  ~ // Copyright (c) 2018 OPeNDAP, Inc.
  ~ // Author: Nathan David Potter  <ndp@opendap.org>
  ~ //
  ~ // This library is free software; you can redistribute it and/or
  ~ // modify it under the terms of the GNU Lesser General Public
  ~ // License as published by the Free Software Foundation; either
  ~ // version 2.1 of the License, or (at your option) any later version.
  ~ //
  ~ // This library is distributed in the hope that it will be useful,
  ~ // but WITHOUT ANY WARRANTY; without even the implied warranty of
  ~ // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  ~ // Lesser General Public License for more details.
  ~ //
  ~ // You should have received a copy of the GNU Lesser General Public
  ~ // License along with this library; if not, write to the Free Software
  ~ // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
  ~ //
  ~ // You can contact OPeNDAP, Inc. at PO Box 112, Saunderstown, RI. 02874-0112.
  ~ /////////////////////////////////////////////////////////////////////////////
  -->

<UserAuthenticationAndAccess>
    <!--
        If your particular authentication scheme utilizes a logout or login location
        you can have Hyrax display links to those locations as part of the generated
        web pages by uncommenting the "AuthenticationControls" element and editing
        the logout and/or login locations to match your service instance.
    -->
    <EnableAuthenticationControls>
        <LoginBanner>Welcome To Hyrax!</LoginBanner>
        <!-- login>login</login -->
        <!-- logout>logout</logout -->
    </EnableAuthenticationControls>

    <!-- EnableGuestProfile / -->
    <!-- EveryOneMustHaveId / -->

    <IdProvider class="opendap.auth.UrsIdP">
        <authContext>urs</authContext>
        <isDefault />
        <UrsClientId>${CLIENT_ID}</UrsClientId>
        <UrsClientAuthCode>${ENCODED_AUTH}</UrsClientAuthCode>
        <UrsUrl>https://uat.urs.earthdata.nasa.gov</UrsUrl>
    </IdProvider>


    <!-- You can use a local in-memory PDP -->
    <PolicyDecisionPoint class="opendap.auth.SimplePDP">
        <Policy class="opendap.auth.RegexPolicy">
            <role>.*</role>
            <resource>^.*((\/docs\/.*)|(\/)|(\.(css|png|jpg|ico|gif|xsl|jsp|svg))|(\/contents\.html)|(\/catalog\.html)|(\/catalog\.xml)|(logout)|(login)|(\/version))$</resource>
            <queryString>.*$</queryString>
            <allowedAction>HEAD</allowedAction>
            <allowedAction>GET</allowedAction>
        </Policy>
        <Policy class="opendap.auth.RegexPolicy">
            <role>guest</role>
            <resource>.*\.(dds|html|das|ddx)$</resource>
            <queryString>.*$</queryString>
            <allowedAction>HEAD</allowedAction>
            <allowedAction>GET</allowedAction>
        </Policy>
        <Policy class="opendap.auth.RegexPolicy">≠
            <role>users</role>
            <resource>.*$</resource>
            <queryString>.*$</queryString>
            <allowedAction>HEAD</allowedAction>
            <allowedAction>GET</allowedAction>
            <allowedAction>POST</allowedAction>
        </Policy>
        <Memberships>
            <group id="guest_user" >
                <user id="GUEST" authContext="guest" />
            </group>

            <group id="urs_users" >
                <user idPattern="^(?!\s*$).+" authContext="urs" />
            </group>


            <role id="users">
                <group id="urs_users" />
            </role>

            <role id="guest">
                <group id="guest_user" />
            </role>

        </Memberships>

    </PolicyDecisionPoint>

    <!-- This local in-memory PDP definition allows everyone access to everything -->
    <!-- PolicyDecisionPoint class="opendap.auth.SimplePDP">
        <Policy class="opendap.auth.RegexPolicy">
            <role>.*$</role>
            <resource>.*$</resource>
            <queryString>.*$</queryString>
            <allowedAction>GET</allowedAction>
            <allowedAction>POST</allowedAction>
        </Policy>
        <Memberships>
        </Memberships>
    </PolicyDecisionPoint -->

    <!-- You also can use a RemotePDP -->
    <!-- PolicyDecisionPoint class="opendap.auth.RemotePDP">
        <PDPServiceEndpoint>http://localhost:8080/pdp</PDPServiceEndpoint>
    </PolicyDecisionPoint -->

</UserAuthenticationAndAccess>