Changes between Version 8 and Version 9 of tap

Timestamp:

Mar 6, 2015 11:22:15 AM (7 years ago)

Author:

vegasm

Comment:

--

tap

@@ -42 +42 @@
 }}}
 
-
-=== Thredds and TAP deployment ===
-
-The last part of this tutorial is manage to start both applications successfully. Move both thredds.war and tap.war to $CATALINA_HOME/webapps. Start the Tomcat instance and the Derby network instance.
-If Thredds is not able to start due to a directory error, please create a folder called “thredds” in $CATALINA_HOME/content to solve that issue.
-
-== Thredds restricted dataset ==
-
-Thredds allows users to restrict dataset access in two different ways:
-
--       URL restriction using Tomcat: difficult to maintain. You need to restrict every dataset by URL and set the role in the web.xml
--       Dataset restriction using TDS Catalog: most commonly used by adding an attribute on a dataset or datasetScan element in the TDS catalog. Eg, restrictAccess=”roleName” 
-
-If you set the mentioned attribute in a Dataset, users need two roles to access it: restrictedDatasetUser and roleName. That means, every user who wants to access to a restricted dataset needs the restrictedDatasetUser role by default and also the role of the dataset. Here is where TAP does the job for you.
 
 == Initial TAP setup ==
@@ -88 +74 @@
 You can change the messages optionally in WEB-INF/classes/locale/messages.properties
 
+=== Thredds and TAP deployment ===
+
+The last part of this tutorial is manage to start both applications successfully. Move both thredds.war and tap.war to $CATALINA_HOME/webapps. Start the Tomcat instance and the Derby network instance.
+If Thredds is not able to start due to a directory error, please create a folder called “thredds” in $CATALINA_HOME/content to solve that issue.
+
 == First steps in TAP ==
 
@@ -170 +161 @@
 TAP Manager
 }}}
+
+== Thredds restricted dataset ==
+
+Thredds allows users to restrict dataset access in two different ways:
+
+-       URL restriction using Tomcat: difficult to maintain. You need to restrict every dataset by URL and set the role in the web.xml
+-       Dataset restriction using TDS Catalog: most commonly used by adding an attribute on a dataset or datasetScan element in the TDS catalog. Eg, restrictAccess=”roleName” 
+
+If you set the mentioned attribute in a Dataset, users need two roles to access it: restrictedDatasetUser and roleName. That means, every user who wants to access to a restricted dataset needs the restrictedDatasetUser role by default and also the role of the dataset. Here is where TAP does the job for you.
+
+=== Restrict dataset access ===
+
+As we mentioned, TAP manages users, roles, groups, policies and their relationships. It is a common scenario to have a dataset with policies that prevent you of doing an illegal use of the data. In the given example you will find the default Thredds catalog example. The first step is to protect the dataset:
+
+{{{
+<dataset name="Test Single Dataset" ID="testDataset"
+           serviceName="dap"  urlPath="test/testData.nc" dataType="Grid" restrictAccess="testDataset"/>
+}}}
+
+When a user tries to access this dataset, the Thredds authorizer expects to find the roles "testDataset" and "restrictedDatasetUser" in the user's granted authorities. 
+
+=== Allow access to a restricted dataset from TAP ===
+
+To allow access to the previous dataset, create the role in /tap/admin/roles "Add new record":
+
+{{{#!th 
+[[Image(image-20150306-105102.png, 50%)]]
+}}}
+
+Fill the form:
+
+-       Name: testDataset
+-       Description: a description of the dataset
+-       Restricted: True if you want to moderate its access. Users will wait until a confirmation from an Admin or manager
+-       Dataset: True in this case. If you want to create an internal role in TAP set to false.
+
+Create a policy in /tap/admin/policies "Add new record" :
+
+{{{#!th 
+[[Image(image-20150306-110334.png, 50%)]]
+}}}
+
+Fill the form
+
+- Name: TEST_DATASET_POLICY
+- Description: Description of the policy
+- Disable policy: ignore this in the creation. If you edit the policy and you want users accept again the agreement, set to true.
+- Agreement: You can paste html directly by clicking in the source button.
+
+Create a Group in /tap/admin/groups "Add new record":
+
+{{{#!th 
+[[Image(image-20150306-111019.png, 50%)]]
+}}}
+
+After creating the Policy, asociate it with the dataset (role) testDataset:
+
+{{{#!th 
+[[Image(image-20150306-112042.png, 50%)]]
+}}}
+
+Fill the form
+
+- Name: TEST_GROUP
+- Description: Description of the group
+- Is project: If the group represents a project like EUPORIAS, VALUE, CORDEX...
+- Coordinator: If you want to delegate the user acceptance. TAP will send an email to the coordinator containing two links: accept or reject the user group request.
+
+After creating the group, it is necessary to asociate the dataset(role) testDataset to the group:
+
+{{{#!th 
+[[Image(image-20150306-111606.png, 50%)]]
+}}}
+