Sponger Resource Allocation and WebID? ACLS

What?

How to control user agent usage of sponger resources. In this case, HTTP connections to Linked Data transformation URLs.

Why?

More often than not, you would like to control access to your Sponger instance.

How?

Leverage the power of Vrtuoso's in-built WebID? based ACLs which enables you apply basic and sophisticated rules that control user agent access.

Sample INI setting


...
[HTTPServer]
ServerThreads = 100
MaxRestrictedThreads = 50 
...

This value sets an HTTP connection threshold for URLs consumed by user agents over http: . The remainder are exclusively accessible to user agents that present WebID? watermarked X.509 certificates.

Simple Example

Prerequisites

  1. Make sure the following packages are installed:
  2. Make sure Virtuoso HTTPS Listener is set up
  3. Make sure the cartridges package is configured to use the HTTPS Listener from above:
    1. Go to Conductor -> Security Admin -> Packages:



    2. Click "Configure" for the cartridges package
    3. Select HTTPS Listener and click "Set":



Steps

  1. Assume a demo user with WebID?: 

    http://id.myopenlink.net/dataspace/person/demo#this

  2. Generate X.509 certificate with WebID? watermarks for the WebID? from above ex.:
  3. Go to Conductor -> Linked Data Security -> Access Control:



  4. Go to Groups:



  5. Click "Add New":







  6. Fill out the presented form with the following values respectively:
    • Group URI: for ex. "urn:webid:acl:mygroup"
    • WebID?: for ex. the demo's user WebID? from above:



  7. Click "Add New" so to add the WebID? to the Group WebID?'s List:



  8. You can add as many as you want new WebIDs? following the steps from above.
  9. Finally click "Save"
  10. The WebID? Group should be created:



  11. Go to "WebID? ACLs" tab:



  12. Add WebID? ACL associated with the group created from above:
    1. Change Type to "Group";
    2. Enter for WebID/Group the name of the group, i.e.: "urn:webid:acl:mygroup"
    3. Change Realm to "Virtuoso Sponger". Note, the "Virtuoso Sponger" Realm name is obligatory to be entered exactly as "Virtuoso Sponger" to serve the needs of Virtuoso Sponger Resource Allocation with WebID? ACLS:



  13. Click "Register"
  14. The "WebID/Group" ACL should be created:



  15. Go to "Cartridges" tab and click "Add New":



  16. Should be presented the list of all supported Virtuoso Cartridges:



  17. Set for "WebID/Group URI pattern" the group created from above and select all cartridges:



  18. Click "Save":



  19. The Cartridges WebId/GroupID URI is configured:



  20. Next we are going to sponge a url, for ex.: http://google.com/
  21. Let's make sure there is no data locally in graph http://google.com/ : 

    SPARQL 
SELECT * 
  FROM <http://google.com/> 
 WHERE
  {
    ?s ?p ?o
  };
s                 p              o
VARCHAR           VARCHAR        VARCHAR
________________________________________________________


0 Rows. -- 0 msec.

  22. Attempt to sponge our example URL i.e. by accessing: 

    http://host:port/about/html/http://google.com/

  23. In this case there should be no retrieved data:



  24. Next perform sponge by accessing the following URL: 

    https://host:ssl-port/about/html/http://google.com/

  25. Should be asked for certificate, choose the one generated from above:



  26. In case of "This Connection is Untrusted" message is shown:
    1. Click "I Understand the Risks":



    2. Click "Add Exception"



    3. Click "Get Certificate" and then "Confirm Security Exception"



    4. Should be prompted for valid certificate. Select the generated from above:



  27. The retrieved remote data should be shown:



Related