1

The Sakai FrameworkFive Models

(Marked Down from Six)

Mark J. Norton, Nolaria Consulting

2

Disclaimer!

• Current documentation on Sakai services is lacking. It is either missing, inadequate, and (in some cases) misleading.

• The information included here represents personal research into the Sakai code base as of Sakai 2.2.

• It is not intended to be the final, official word.

3

Sakai Architecture

Charon Portal

Tool

Application Service

FrameworkServices

This presentation will focus on how the framework services are group into various models

4

Service Models in Sakai

• While Sakai has many services that perform a variety of functions, five models emerge as being important to understanding how Sakai operates:– Entities– Users– Security

– Sites– Content Hosting

Let’s start with the Entity Model

5

The Entity Model

6

Overview

• Resources in Sakai

• Entity

• Edit

• Entity Producer

• Entity Manager

7

Resources in Sakai

• It would be useful to be able to work with resources at a very abstract, general level.

• The Entity model provides this capability with the Entity and Edit interfaces.

• It allows us to treat managed data objects in Sakai in a uniform way.

• This is done by using Entity as a base interface definition.

8

Examples of Sakai Entities

• The following APIs extend Entity:– Alias– Assignment– AssignmentContent– AuthZGroup– Calendar– CalendarEvent– ContentResource– ContentCollection

– Digest– Message– MessageChannel– Preferences– Site– Group– User

9

The Entity Model

• Entities (previously referred to as resources), provide a way to organize managed data objects in Sakai.– Entity and Edit APIs– Entity Producer– Entity Manager

• Read vs. Edit: mutability

Sakai 2.2 Package Idorg.sakaiproject.entity.api

10

The Entity

• Entities are intended to be a base API that is extended by other interfaces.

• It provides basic capabilities to be shared by all Sakai data objects:– Reference– URL– Id– Properties– XML Marshalling

11

Stuff that all Things Should Have

• Reference– A string reference for this thing that includes the entity

producer name. Used to create URLs.• URL

– Having a URL for all entities allow them to be externally addressable.

• Id– Having an Id for all entities allows them to be

efficiently accessed internally.• Properties

– Metadata about this thing. Interface extensions defined property names.

12

The Base Entity API

public interface Entity{

String getUrl();String getUrl(String rootProperty);String getReference();String getReference(String rootProperty);String getId();ResourceProperties getProperties();Element toXml(Document doc, Stack stack);

}

Note that this is a read only interface ….

13

The Edit API

public interface Edit extends Entity{public boolean isActiveEdit();public ResourcePropertiesEdit getPropertiesEdit();}

Edit extends Entity to provide editing capability. This is a hold-over from the way CHEF was originally designed, ie, separating editing and access. Some recent services combine these abilities.

14

The Entity Producer

• The entity producer is the basis for a service manager that creates entities.

• It provides a way to determine if archiving and importing is supported.

• Provides a way to get entities.

• Entity creation is deferred to the higher level service object!

15

Entity Producer APIpublic interface EntityProducer{boolean willArchiveMerge();String archive(String siteId, Document doc, Stack stack, String archivePath,

List attachments);String merge(String siteId, Element root, String archivePath, String fromSiteId,

Map attachmentNames, Map userIdTrans, Set userListAllowImport);boolean parseEntityReference(String reference, Reference ref);String getEntityDescription(Reference ref);ResourceProperties getEntityResourceProperties(Reference ref);String getEntityUrl(Reference ref);Collection getEntityAuthzGroups(Reference ref);HttpAccess getHttpAccess();}

This interface is simplified for Sakai 2.2 and removes some higher level dependencies, such as Site.

16

The Entity Manager

• The API for the Entity Manager.• Sakai provides an implementation of this

in EntityManagerComponent.• Allows an Entity Producer to be registered.• Provides ways to get a Reference object

given a reference string.• A cover is provided.

17

The Entity Manager API

public interface EntityManager{List getEntityProducers();void registerEntityProducer(EntityProducer manager, String referenceRoot);Reference newReference(String refString);Reference newReference(Reference copyMe);List newReferenceList();List newReferenceList(List copyMe);boolean checkReference(String ref);}

checkReference is new for Sakai 2.2 return true if this is a valid entity reference.

18

Resource Properties

• Properties are a way of associating additional information with an entity.

• This is commonly called metadata.

• Unlike the Entity class, Resource Properties are mutable.

• The Resource Properties interface has a lot of convenience methods to access common properties.

19

Base Resource Properties API

public interface ResourceProperties extends Serializable{public Iterator getPropertyNames();public String getProperty(String name);public List getPropertyList(String name);public String getPropertyFormatted(String name);public boolean isLiveProperty(String name);public boolean getBooleanProperty(String name) public long getLongProperty(String name)public Time getTimeProperty(String name)public User getUserProperty(String name)public String getTypeUrl();public Element toXml(Document doc, Stack stack);public void addProperty(String name, String value);public void addPropertyToList(String name, String value);public void addAll(ResourceProperties other);public void addAll(Properties props);public void clear();public void removeProperty(String name);public void set(ResourceProperties other);

}

Typed, generic property access.

More …

20

Property Convenience Methodspublic interface ResourceProperties extends Serializable{public String getNamePropCreator();public String getNamePropModifiedBy();public String getNamePropCreationDate();public String getNamePropDisplayName();public String getNamePropCopyrightChoice();public String getNamePropCopyrightAlert();public String getNamePropCopyright();public String getNamePropContentLength();public String getNamePropContentType();public String getNamePropModifiedDate();public String getNamePropIsCollection();public String getNamePropCollectionBodyQuota();public String getNamePropChatRoom();public String getNamePropTo();public String getNamePropDescription();public String getNamePropCalendarType();public String getNamePropCalendarLocation();public String getNamePropReplyStyle();}

21

References

• References provide the ability to create an immutable object that wraps an entity’s references and context including:– Container– URL, Reference String, Id– Realms– Types

22

Reference APIpublic interface Reference{void addSiteContextAuthzGroup(Collection rv);void addUserAuthzGroup(Collection rv, String id);void addUserTemplateAuthzGroup(Collection rv, String id);String getContainer();String getContext();String getDescription();Entity getEntity();String getId();ResourceProperties getProperties();Collection getRealms();String getReference();String getSubType();String getType();String getUrl();boolean isKnownType();boolean set(String type, String subType, String id, String container, String context);EntityProducer getEntityProducer();}

Note the connections to the Sakai Security Model. This allows collections of entities to be created and accessed as an AuthZ group.

23

Using Entities

• In general, all persisted data objects in Sakai should extend Entity.

• Create a unique container id.

• Service managers should extend EntityProvider.

• Register your provider with the EntityManager.

24

Future Work

• The entity model is being referred to as the “Sakai Entity Bus”.

• It is being carefully reviewed by Sakai architects to ensure that it is both simple and powerful.

• It will provide the bedrock needed for improvements to many Sakai services.

25

The User Model

26

Overview

• User and User Edit

• User Directory Service

• User Directory Provider

• User Metadata (Sakai Person)

• Authentication

• Preferences

27

The User Model

• Sakai provides a model of a user in the system.

• User objects are split into an immutable base object and extended to allow editing in the UserEdit object.

• Users are entities, which allows us to treat them as Sakai managed objects.

Sakai 2.2 Package Idorg.sakaiproject.user.api

28

New for Sakai 2.2

• Authentication is now part of the User module, in terms of grouping services.

• User Preferences is also considered part of the User Model.

• SakaiPerson may be part of this later and provide support for standards-based user metadata.

29

User Relationships

30

The User

• The User Interface (including UserEdit) provides access to:– Creation and modification times.– Email address– Display name– Sort name– First and last name– User type

31

The User APIpublic interface User extends Entity, Comparable{public User getCreatedBy();public User getModifiedBy();public Time getCreatedTime();public Time getModifiedTime();

public String getEmail();public String getDisplayName();public String getSortName();public String getFirstName();public String getLastName();public boolean checkPassword(String pw);public String getType();}

Note the use of other interfaces that are extended.

32

The UserEdit APIpublic interface UserEdit extends User, Edit{public void setId(String id);public void setEmail(String email);public void setFirstName(String name);public void setLastName(String name);public void setPassword(String pw);public void setType(String type);}

Element Description

Identifier The user id.

Email User’s email adr.

First Name User’s given name.

Last Name User’s family name.

Password User password.

Type User type (SU, etc.)

33

The UserDirectoryService

• The main service for finding users is called the UserDirectory service.

• The default implementation is against a directory service, such as LDAP (hence the name).

• This service is responsible for managing and persisting Users in Sakai.

34

UserDirectoryService

• The User Directory Service provides ways to:– Find a particular user given an id.– Get collections of users.– Get special users (like anonymous)– Authenticate a user (or re-authenticate).

35

UserDirectoryService APIpublic interface UserDirectoryService extends EntityProducer{public User getUser(String id)public List getUsers(Collection ids);public User getCurrentUser();public Collection findUsersByEmail(String email);public boolean allowUpdateUser(String id);public UserEdit editUser(String id)public void commitEdit(UserEdit user);public void cancelEdit(UserEdit user);public User getAnonymousUser();public List getUsers();public List getUsers(int first, int last);public int countUsers();public List searchUsers(String criteria, int first, int last);public int countSearchUsers(String criteria);public boolean allowAddUser(String id);public UserEdit addUser(String id)public User addUser(String id, …)public UserEdit mergeUser(Element el)public boolean allowRemoveUser(String id);public void removeUser(UserEdit user)public User authenticate(String id, String password);public void destroyAuthentication();public String userReference(String id);}

Note that any changes made to a User instance must be explicitly committed by calling this method.

36

The UserFactory

• The UserFactory can be used as an alternative to addUser().

• This has a single method (newUser()) that returns an empty UserEdit.

• Setters can be used to initialize it’s values and then persisted using commitEdit().

37

The User Provider

• Providers are a way to “look someplace else” for information.

• If a UserProviderService exists, it will be accessed to provide information about a user.

• Several implementations of the user provider exists, including one against LDAP.

38

UserDirectoryProvider

public interface UserDirectoryProvider{boolean authenticateUser(String id, UserEdit edit, String password);boolean updateUserAfterAuthentication();void destroyAuthentication();boolean userExists(String id);boolean getUser(UserEdit edit);void getUsers(Collection users);boolean findUserByEmail(UserEdit edit, String email);boolean authenticateWithProviderFirst(String id);boolean createUserRecord(String id);}

39

Sakai Person

• Sakai Person provides support for person metadata based on the EduPerson standard.

• This code currently lives in the common module and is being used by some tools at Indiana.

• It may be part of an expanded user model in the future.

40

Authentication

• How do we know who the current user is? We authenticate them.

• Evidence is provided, usually:– Username and Password

• But other credentials are possible:– Smartcard, dongle, other devices– Biometrics: fingerprints, retina scan– Certificates

41

Evidence

• Sakai uses a base class called Evidence that is extended to include specific kinds of evidence:– ExternalTrustedEvidence– IdPwEvidence

• An evidence object is passed to the authentication service to determine if the user is a valid Sakai user.

42

Authentication Service

• The authentication service has a single method that takes a piece of evidence and validates the user.

Authentication authenticate(Evidence e) throws AuthenticationException;

An AuthenticationException is thrown if this user doesn’t authenticate against evidence provided.

43

Preferences

• Sakai provides a preference service based on properties.

• The Preference Service allows preferences to be created against a particular user id and persisted.

44

The Preferences API

String getId();

ResourceProperties getProperties(String key);

Collection getKeys();

Element Description

Identifier The preference id.

Properties A property set.

Keys Property keys.

45

PreferencesEdit

ResourcePropertiesEdit getPropertiesEdit(String key);

Element Description

Editable Properties Properties that can be added to or updated.

46

The PreferencesService

Preferences getPreferences(String id);

boolean allowUpdate(String id);

PreferencesEdit add(String id);

PreferencesEdit edit(String id);

void commit(PreferencesEdit edit);

void cancel(PreferencesEdit edit);

void remove(PreferencesEdit edit);

47

The Security Model

48

Overview

• An Abstract Security Model• The Sakai Security Model• Secure Application Development• Integration and Provisioning• Security APIs• Implementation using AuthzGroups• AuthzGroup Service and Group Provider

49

Security Issues

• Hacking data

• Unauthorized access

• Accidental access

• Backdoors

• Spoofing

• Development related issues

50

Mission Statement

• Determine if a user is allowed to perform an operation on a specified object managed by Sakai.

• Allow authorizations to be collected by defining a role for a user in a group.

• Support group membership.

51

An Abstract Security Model

Person

Group

Role

Function Entity

Collection

The Authorization Triple

52

Authentication

• Authenticating a user is the first step in system security.

• Recall the evidence-based authentication manager presented earlier.

• Authentication can expire, forcing re-authentication even during an active session.

53

Authorization

• Once a user is logged into the system, further operations are dependent on:– What context they are in.– What role in a site or group they have.– What tool they are working with.– What tool function they want to perform.– What kind of object is being manipulated.

54

Dependent Services

• Authorization is dependent on other models and services:– Person– Group– Role– Tool– Function– Site– Resource or Entity

For the most part, authorization only cares about identifying each of these things. That means that each must have a unique identifier that can be used to access and reference it. This is why the entity bus is important!

55

Performance and Scalability

• A good authorization system will perform well even in a large environment:– Thousands of users– Millions of objects

• We could just store triples.

• Eventually, though, the sheer number of combinations catches up with you.

56

Group-based Authorization

• By grouping people and objects, we can control access to entities or collections by a user’s role in a group.

• The trick is to do this in a manner that also scales well, is easy to use, and simple to understand.

57

Creating Secure Applications

• Defining and Registering Functions

• The Application Service

• Testing Authorization in the App Service

• Handling Security Violations

Let’s have a look at how we would go about creating applications that are secure. We’ll need to consider four things:

58

Well-Formed Sakai Applications

Tool Code

ApplicationService Impl

Application Service API

Tool code handles events and generates the user interface using a presentation technology like JSF.

Data managed by the service is abstracted into an application service with a well-defined interface. This includes allows() methods.

Framework Services

The implementation is responsible for authorizing the current user for a function on a particular entity. This is done in the group associated with the current context.

59

Registering Functions

• Functions are the operations that should be secured

• Sakai recommends that you register your security functions in your application service.

• This can be done in the tool registration file or by calling the FunctionManager:

public static final String OBJECT_UPDATE “myapp.object.update”;FunctionManager.registerFunction(MyAppService.OBJECT_UPDATE);

60

Function Manager API

void registerFunction(String function);

List getRegisteredFunctions();

List getRegisteredFunctions(String prefix);

• The Function Manager allows functions to be registered with Sakai.

• Lists of functions can be retrieved with an optional prefix. If convention is followed, it allows functions to be associated with an application.

61

Checking Permissions

• Each application service should create a set of “allow” methods that test the current user for permission to perform a specified operation.

• This is done in the context of a tool placement in a particular site.

• Always done against a collection of objects in a site.

public boolean allowObjectUpdate ();

62

The Sakai Security APIs

• Security Service– The security service allows authorization

questions to be resolved without worrying about groups and roles.

• Security Advisor– An advisor mechanism is provided to allow

policies to be defined that could potentially override underlying defaults.

Sakai 2.2 Package Idorg.sakaiproject.authz.api

63

Lock Terminology

• The Security Service uses a Key/Unlock terminology that is left over from the days when resources were actually locked (via a database).

• The mechanism has changed, but the terms remain.– Unlock = test is allowed– Key = grant permission

64

Security Service APIpublic interface SecurityService{public boolean unlock(String lock, String reference);public boolean unlock(User user, String lock, String reference);public List unlockUsers(String lock, String reference);public boolean isSuperUser();public void addKey(String userOrGroup, String lockOrRole,

String resourceOrGroup, boolean allow);public void removeKey(String userOrGroup, String lockOrRole,

String resourceOrGroup, boolean allow);

void pushAdvisor(SecurityAdvisor advisor);SecurityAdvisor popAdvisor();boolean hasAdvisors();void clearAdvisors();}

65

SecurityAdvisor API

public interface SecurityAdvisor{SecurityAdvice isAllowed(String userId, String function, String reference);}

Security advisors allow policies to be defined that are queried before the defaults established by authzGroups. Because these are stacked, an order can be established.

66

SecurityAdvice Constants

public class SecurityAdvice{SecurityAdvice ALLOWED = new SecurityAdvice("allowed");SecurityAdvice NOT_ALLOWED = new SecurityAdvice("not allowed");SecurityAdvice PASS = new SecurityAdvice("pass");}

These are defined as an inner class in SecurityAdvisor.

67

Sakai Security Implementation

• Sakai Security is implemented using AuthzGroups.

• These allow users to be grouped together within a specific context with well defined group roles.

• AuthZGroups were previously called Realms.

68

Authorization Groups

• A user may be a member of a particular authorization group.

• All users in an AuthZGroup are required to have a role.

• Each group has a set of permissions.

• The ability to perform a particular function may be specified by a role or membership of a user in a group.

69

Group Relationships

70

AuthZGroup

• AuthZGroup provides basic capabilities:– Membership– Roles– Provider Support

• Membership can be accessed either as a list of Users or Member objects.

71

AuthZGroup Membership API

public interface AuthzGroup extends Edit, Comparable, Serializable{void addMember(String userId, String roleId, boolean active, boolean provided);public Member getMember(String userId);public Set getMembers();public Set getUsers();public Set getUsersHasRole(String role);public Set getUsersIsAllowed(String function);void removeMember(String userId);void removeMembers();

} More …

72

AuthZGroup Role APIpublic interface AuthzGroup extends Edit, Comparable, Serializable{…Role addRole(String id) throws IdUsedException;Role addRole(String id, Role other) throws IdUsedException;public Role getRole(String id);public Set getRoles();public Set getRolesIsAllowed(String function);public Role getUserRole(String userId);boolean hasRole(String userId, String role);void removeRole(String role);void removeRoles();void setMaintainRole(String role);public String getMaintainRole();

} More …

73

AuthZGroup Misc. API

public interface AuthzGroup extends Edit, Comparable, Serializable{Time getCreatedTime();String getDescription();User getModifiedBy();Time getModifiedTime();

public String getProviderGroupId();void setProviderGroupId(String id);

boolean isAllowed(String userId, String function);public boolean isEmpty();boolean keepIntersection(AuthzGroup other);}

74

Role

• Besides having a name and description, roles enable a set of functions to be allowed or disallowed.

• Roles only have meaning with respect to authorization (AuthZGroups).

• They are used purely as a way to group permissions in an authzGroup.

75

Role API

public interface Role extends Comparable, Serializable{String getId();String getDescription();boolean isAllowed(String function);Set getAllowedFunctions();void setDescription(String description);void allowFunction(String lock);void allowFunctions(Collection functions);void disallowFunction(String lock);void disallowFunctions(Collection functions);void disallowAll();boolean allowsNoFunctions();}

Largely focused on what functions are defined for this role.

76

Member

• Member is a relationship object between a User and an AuthZGroup.

• It includes a role.

• Supports the concept of active and inactive members.

77

Member API

public interface Member extends Comparable, Serializable{String getUserId();Role getRole();boolean isProvided();boolean isActive();void setActive(boolean active);}

Element Description

User Identifier The user id.

Role Role for this member.

Provided Is this provided info?

Active Is this member active?

78

AuthZGroupService

• The AuthZGroup Service provides full support for managing AuthZGroups including creation.

• Provisions are made for joining and un-joining groups.

• Answers access questions between a user and a group or set of groups.

79

AuthZGroupService APIpublic interface AuthzGroupService extends EntityProducer{List getAuthzGroups(String criteria, PagingPosition page);int countAuthzGroups(String criteria);AuthzGroup getAuthzGroup(String id)boolean allowUpdate(String id);void save(AuthzGroup azGroup)boolean allowAdd(String id);AuthzGroup addAuthzGroup(String id)AuthzGroup addAuthzGroup(String id, AuthzGroup other, String maintainUserId)boolean allowRemove(String id);void removeAuthzGroup(AuthzGroup azGroup)void removeAuthzGroup(String id)String authzGroupReference(String id);AuthzGroup newAuthzGroup(String id, AuthzGroup other, String maintainUserId)… More …

80

AuthZGroupService API (cont)public interface AuthzGroupService extends EntityProducer{ …void joinGroup(String authzGroupId, String role)void unjoinGroup(String authzGroupId)boolean allowJoinGroup(String id);boolean allowUnjoinGroup(String id);

boolean isAllowed(String userId, String function, String azGroupId);boolean isAllowed(String userId, String function, Collection azGroups);Set getUsersIsAllowed(String function, Collection azGroups);Set getAuthzGroupsIsAllowed(String userId, String ftn, Collection azGroups);Set getAllowedFunctions(String role, Collection azGroups);

String getUserRole(String userId, String azGroupId);Map getUsersRole(Collection userIds, String azGroupId);

void refreshUser(String userId);}

Note that authorization is replicated here, but specified against groups.

81

Security or AuthzGroup Service?

• Given the power of the AuthzGroup Service, should that be used instead of the Security Service?– In general, the Security Service should be used for

applications, since it provides higher level policies to be defined and queried.

– Some framework services are implemented against the authzGroup Service because they need tighter integration.

82

GroupProvider

• The group provider allows groups and roles to be defined by “another source” of information.

• Providers are somewhat limited at this time and do not allow authorization to be moved out of Sakai.

• Permissions are cached by Sakai.

83

GroupProvider API

public interface GroupProvider{String getRole(String id, String user);Map getUserRolesForGroup(String id);Map getGroupRolesForUser(String userId);String[] unpackId(String id);}

Usually, roles need to be mapped to Sakai roles.

Support for compound user id’s.

84

The Content Model

85

Overview

• Content Resource

• Content Collection

• Content Hosting Service

• Locking

• Group Awareness

86

The Content Hosting Model

• Content Hosting provides a way to manage content in Sakai.

• Collections contain Resources.

• Resources may have attachment.

• Resources may have properties.

• Locks can be made against resources.

87

Content Hosting Model

Sakai 2.2 Package Idorg.sakaiproject.content.api

88

ContentResource APIpublic interface ContentResource extends Entity{public int getContentLength();public String getContentType();public byte[] getContent() throws ServerOverloadException;public InputStream streamContent() throws ServerOverloadException;}

Element Description

Content Length Length in bytes.

Content Type MIME Type

Content as an array Array of bytes.

Content as a stream An InputStream.

89

ContentResourceEdit API

public interface ContentResourceEdit extends ContentResource, Edit{public void setContentLength(int length);public void setContentType(String type);public void setContent(byte[] content);}

90

ContentCollection API

public interface ContentCollection extends Entity{public List getMembers();public List getMemberResources();public long getBodySizeK();}

Element Description

Members List of reference strings.

Member Resources List of Content Resources.

Body Size Aggregate size in 1024 units.

91

ContentCollectionEdit API

public interface ContentCollectionEdit extends ContentCollection, Edit{} // No API methods defined.

92

The Content Hosting Service

• Most of the functionality is represented in the Content Hosting Service.

• Methods are provided to work with:– Resources– Collections– Attachments– Properties– Locks

It also provides support for a special collection referred to as a drop box. This collection provides additional security access functions and a drop box name.

93

ContentHostingService API

public interface ContentHostingService extends EntityProducer{public boolean allowAddCollection(String id);public ContentCollection addCollection(String id, ResourceProperties properties)public ContentCollectionEdit addCollection(String id)public boolean allowGetCollection(String id);public void checkCollection(String id)public ContentCollection getCollection(String id)public int getCollectionSize(String id)public List getAllResources(String id);public boolean allowUpdateCollection(String id);public ContentCollectionEdit editCollection(String id)public boolean allowRemoveCollection(String id);public void removeCollection(String id)public void removeCollection(ContentCollectionEdit edit)public void commitCollection(ContentCollectionEdit edit);public void cancelCollection(ContentCollectionEdit edit);public String getContainingCollectionId(String id);public int getDepth(String resourceId, String baseCollectionId);public boolean isRootCollection(String id);public Map getCollectionMap();public void eliminateDuplicates(Collection resourceIds);

Collection Methods

More …

94

ContentHostingService APIpublic boolean allowAddResource(String id);public ContentResource addResource(String id, String type, byte[] content, ResourceProperties properties, int priority)public ContentResource addResource(String name, String collectionId, int limit, String type, byte[] content, ResourceProperties properties, int priority)public ContentResourceEdit addResource(String id)public boolean allowUpdateResource(String id);public ContentResource updateResource(String id, String type, byte[] content)public ContentResourceEdit editResource(String id)public boolean allowGetResource(String id);public void checkResource(String id)public ContentResource getResource(String id)public boolean allowRemoveResource(String id);public void removeResource(String id)public void removeResource(ContentResourceEdit edit)public boolean allowRename(String id, String new_id);public String rename(String id, String new_id)public boolean allowCopy(String id, String new_id);public String copy(String id, String new_id)public String copyIntoFolder(String id, String folder_id)public String moveIntoFolder(String id, String folder_id)public void commitResource(ContentResourceEdit edit)public void commitResource(ContentResourceEdit edit, int priority)public void cancelResource(ContentResourceEdit edit);public List findResources(String type, String primaryMimeType, String subMimeType);

Resource Methods

More …

95

ContentHostingService APIpublic boolean allowAddAttachmentResource();public boolean isAttachmentResource(String id);public ContentResource addAttachmentResource(String name, String type, byte[] content, ResourceProperties properties)public ContentResource addAttachmentResource(String name, String site, String tool, String type, byte[] content, ResourceProperties props)public ContentResourceEdit addAttachmentResource(String name)

public boolean allowGetProperties(String id);public ResourceProperties getProperties(String id)public boolean allowAddProperty(String id);public ResourceProperties addProperty(String id, String name, String value)public boolean allowRemoveProperty(String id);public ResourceProperties removeProperty(String id, String name)public ResourcePropertiesEdit newResourceProperties();

Attachment Methods

Property Methods

More …

96

ContentHostingService APIpublic String getUuid(String id);public String resolveUuid(String uuid);public String getUrl(String id);public String getReference(String id);String getSiteCollection(String siteId);String archiveResources(List resources, Document doc, Stack stack, String archivePath);public boolean isPubView(String id);public boolean isInheritingPubView(String id);public void setPubView(String id, boolean pubview);

Collection getLocks(String id);public void lockObject(String id, String lockId, String subject, boolean system);public void removeLock(String id, String lockId);public boolean isLocked(String id);public boolean containsLockedNode(String id);public void removeAllLocks(String id);

public void createDropboxCollection();public void createDropboxCollection(String siteId);public String getDropboxCollection();public String getDropboxCollection(String siteId);public boolean isDropboxMaintainer();public boolean isDropboxMaintainer(String siteId);public String getDropboxDisplayName();public String getDropboxDisplayName(String siteId);

Misc. Methods

Locking Methods

Dropbox Collection Methods

97

Content Hosting Implementation

• Content Hosting is implemented using two approaches currently:– File system (recommended)– Database

• Neither allow external administrative access, but do provide quota support.

• WebDAV support is included.

98

Group Awareness

• Group (Section) awareness is being added to the content hosting service for Sakai 2.2.

• Two objects are added:– GroupAwareEntity– GroupAwareEdit

99

GroupAwareEntity

Collection getGroups();

AccessMode getAccess();

Element Description

Groups List of authz group references.

Access mode Group or site.

100

GroupAwareEdit

void addGroup(Group group) throws PermissionException;

void removeGroup(Group group) throws PermissionException;

void setAccess(AccessMode access);

Element Description

Groups Groups can be added or removed.

Access mode Set access mode to site or group.

101

Resource Locking

• Content hosting includes a lock manager that allows long term locks to be applied to resources and collections.

• It consists of the following objects:– Lock– LockService

102

The Lock APIString getId();void setId(String id);boolean isActive();void setActive(boolean active);Date getDateAdded();void setDateAdded(Date dateAdded);Date getDateRemoved();void setDateRemoved(Date dateRemoved);String getQualifier();void setQualifier(String qualifier);String getReason();void setReason(String reason);String getAsset();void setAsset(String asset);boolean isSystem();void setSystem(boolean system);

The Lock identifier

Active flag.

Time added or removed.

Qualifiers, if any.

Reason for lock.

Asset being locked.

103

The Lock Service API

void lockObject(String assetId, String qualifier, String reason, boolean sys);

void removeLock(String assetId, String qualifierId);

Collection getLocks(String assetId);

boolean isLocked(String assetId);

void removeAllLocks(String qualifier);

104

Content Hosting vs. Repositories

• Content Hosting is not really intended to be an interface to a remote repository.

• Work around repositories is starting to emerge: Twin Peaks, Sakaibrary, etc.

• Repositories are optimized differently than Content Hosting, though content managed by CH could be including a repository service.

105

The Site Model

106

Overview

• Site

• Site Page

• Tool Configuration

• Group

• Site Service

107

The Site Model

• Sites are a way of breaking up a Sakai installation so that:– Users can have a private work space

(MyWorkSite).– Classes can have their own content.– Projects can facilitate work.– Etc.

Sakai 2.2 Package Idorg.sakaiproject.site.api

108

Site Model Diagram

109

The Site Object

• The Site object includes:– Information – Tools – Layouts for a Sakai Site– A list of pages

• Layout is done using pages.

110

Site API - Informationpublic interface Site extends Edit, Comparable, Serializable, AuthzGroup{String getTitle();String getShortDescription();String getDescription();String getIconUrl();String getIconUrlFull();String getInfoUrl();String getInfoUrlFull();void setTitle(String title);void setIconUrl(String url);void setInfoUrl(String url);void setShortDescription(String description);void setDescription(String description);String getType();boolean isType(Object type);void setType(String type);…

More …

111

Site API - Membership

public interface Site extends Edit, Comparable, Serializable, AuthzGroup{boolean isJoinable();String getJoinerRole();void setJoinable(boolean joinable);void setJoinerRole(String role);Collection getGroups();Collection getGroupsWithMember(String userId);Collection getGroupsWithMemberHasRole(String userId, String role);boolean hasGroups();Group addGroup();void removeGroup(Group group);… More …

112

Site API - Pages

public interface Site extends Edit, Comparable, Serializable, AuthzGroup{List getPages();List getOrderedPages();SitePage getPage(String id);SitePage addPage();void removePage(SitePage page);

ToolConfiguration getTool(String id);Collection getTools(String[] toolIds);…}

Support for pages.

Support for tools.

More …

113

Site API - Miscellaneouspublic interface Site extends Edit, Comparable, Serializable, AuthzGroup{ …User getCreatedBy();User getModifiedBy();Time getCreatedTime();Time getModifiedTime();

String getSkin();void loadAll();void setSkin(String skin);

boolean isPublished();boolean isPubView();Group getGroup(String id);void setPublished(boolean published);void regenerateIds();void setPubView(boolean pubView);}

Support for skinning.

Support for publishing.

114

Site Pages

• Each page can have a layout type (single or dual columns, etc.)

• A page can have one or more tool, each with it’s own ToolConfiguration.

• A page may be separately skinned.

• A page may be designed a pop-up, but this is not currently used.

115

SitePage APIpublic interface SitePage extends Edit, Serializable{public String getTitle();public void setTitle(String title);public String getSkin();public String getSiteId();public boolean isPopUp();public void setPopup(boolean popup);public int getLayout();public void setLayout(int layout);public String getLayoutTitle();public List getTools();public List getTools(int col);Collection getTools(String[] toolIds);public ToolConfiguration getTool(String id);public Site getContainingSite();public ToolConfiguration addTool();public ToolConfiguration addTool(Tool reg);public void removeTool(ToolConfiguration tool);public void moveUp();public void moveDown();}

Layout management

Tool management

Ordering of pages

116

Tool Configuration

• A Tool configuration provides:– Layout hints– A skin– Site Id– Layout order

• Since tools tend to take up screen real estate, only one or two tools tend to be configured onto a site page.

117

ToolConfiguration API

public interface ToolConfiguration extends Placement, Serializable{public String getLayoutHints();public void setLayoutHints(String hints);public int[] parseLayoutHints();public String getSkin();public String getPageId();public String getSiteId();public SitePage getContainingPage();public void moveUp();public void moveDown();public int getPageOrder();}

118

Site Service

• The Site Service provides:– Access to sites and collections of sites.– A site access security model.– Support for group membership.– Various references.– Convenience methods to directly access

things like tool configuration, etc.

119

SiteService API - Sites

public interface SiteService extends EntityProducer{Site getSite(String id) throws IdUnusedException;Site getSiteVisit(String id) Site addSite(String id, String type) Site addSite(String id, Site other)void removeSite(Site site) throws PermissionException;List getSites(SelectionType type, Object ofType, String criteria, Map propertyCriteria, SortType sort, PagingPosition page);int countSites(SelectionType type, Object ofType, String criteria, Map propertyCriteria);String merge(String toSiteId, Element e, String creatorId);void save(Site site) throws IdUnusedException, PermissionException;void saveSiteMembership(Site site) void saveGroupMembership(Site site)void saveSiteInfo(String id, String description, String infoUrl) More …

120

SiteService API - Securitypublic interface SiteService extends EntityProducer{void setSiteSecurity(String siteId, Set updateUsers,

Set visitUnpUsers, Set visitUsers);void setUserSecurity(String userId, Set updateSites,

Set visitUnpSites, Set visitSites);

boolean allowAccessSite(String id);boolean allowUpdateSite(String id);boolean allowUpdateSiteMembership(String id);boolean allowUpdateGroupMembership(String id);boolean allowAddSite(String id);boolean allowRemoveSite(String id);boolean allowViewRoster(String id);boolean allowUnjoinSite(String id);

boolean isUserSite(String site);boolean isSpecialSite(String site); More …

121

SiteService API - Miscelaneouspublic interface SiteService extends EntityProducer{String siteReference(String id);String sitePageReference(String siteId, String pageId);String siteToolReference(String siteId, String toolId);String siteGroupReference(String siteId, String groupId);

String getSiteUserId(String site);String getSiteSpecialId(String site);String getSpecialSiteId(String special);

String getSiteDisplay(String id);ToolConfiguration findTool(String id);SitePage findPage(String id);String getSiteSkin(String id);List getSiteTypes();

void join(String id)void unjoin(String id)}

122

Groups

• With the release of Sakai 2.1, a site could have more than one group associated with it.

• These are largely used for sections.

• Groups extend AuthzGroups and add a bit more descriptive information.

123

Group API

String getTitle();void setTitle(String title);

String getDescription();void setDescription(String description);

public Site getContainingSite();

This allows groups to have a title and description that is independent of AuthzGroup naming. This is useful when you want the group to appear as “Chemistry 101 – Lab 2”, rather than “sci-chem101-L002”

124

Questions?