<?xml version="1.0" encoding="UTF-8"?>
<!--<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" "docbookx.dtd">--><!-- $Id: xacml.xml 18216 2013-02-05 17:36:41Z dizzzz $ --><book><bookinfo><productname>eXist-db – Open Source Native XML Database</productname><title>XACML Access Control in eXist</title><date>September 2009</date><author><firstname>Mark</firstname><surname>Harrah</surname><affiliation><address format="linespecific"><email>harrah@umd.edu</email></address></affiliation></author></bookinfo><chapter><title>Access Control in eXist</title><para>
			eXist uses the OASIS standard
			<ulink url="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml">
				eXtensible Access Control Markup Language (XACML)
			</ulink>
			for XQuery access control.  XACML
			<ulink url="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml#XACML11">
				1.1
			</ulink>
			and
			<ulink url="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml#XACML10">
				1.0
			</ulink>
			are currently supported.
		</para><note id="deprecated"><title>Deprecation</title><para>The XACML functionality is marked as deprecated and should
                not be used for new projects. Please use the new 
                <ulink url="security.xml#ACLs">ACL</ulink> functionality that has been 
                introduced in eXist-db v2.0.
                </para></note><para>
			This documentation is divided into four parts. The first part of this
			documentation, <ulink url="xacml-features.xml">Capabilities</ulink>,
			is intended to be a thorough overview of what in eXist is
			controlled using XACML.  This part does not require prior knowledge of
			XACML and should provide the database administrator with enough information
			to decide whether to enable and use eXist's XACML subsystem.
		</para><para>
			The second part, <ulink url="xacml-intro.xml">Introduction to XACML</ulink>, is a
			brief introduction to XACML.  The targeted level of detail is the level
			necessary to use eXist's policy editor to manage policies (policies
			are how access is restricted in XACML).  It also provides some background
			information on the XACML implementation library used by eXist.
		</para><para>The third part, <ulink url="xacml-usage.xml">Using XACML in eXist</ulink>
			includes a short description of how to configure the XACML subsystem in eXist.
			This covers enabling XACML, the location of policies, and the default behavior
			of the XACML subsystem.  This part then describes how to create, edit, and remove
			policies in eXist using the graphical editor.
		</para><para>
			The last part of the documentation,
			<ulink url="xacml-dev.xml">XACML Developer's Guide</ulink>,
			is targeted towards eXist developers and describes how to implement a Policy
			Enforcement Point (PEP) in eXist, among other topics.
		</para><para>
			A basic description of the operation of access control using XACML in eXist is
			the that database administrator writes policies (either manually or with the
			graphical editor) that determine who can access what resources and when and how
			those resources can be accessed.  When an XQuery is executed (or some other
			controlled resource is accessed), eXist asks Sun's XACML Implementation if that
			action is permitted according to the provided policies.  If access is denied, a
			PermissionDeniedException is thrown.  If it is granted, program execution
			continues normally.
		</para></chapter></book>