WLCG-AuthZ-WG/common-jwt-profile

Poor specified of storage `$PATH` type

Closed this issue · 2 comments

On page 12, the document describes how scopes MAY provide a resource path in the form $AUTHZ:$PATH. On page 13, this behaviour is modified that storage scopes MUST be specified.

However, for storage, the nature of the $PATH is not specified. Is $PATH always a directory or is it legal for $PATH to identify something else, such as a file?

Here is a more concrete example to illustrate this question:

Assuming /foo is a directory that does not contain an element bar, does the scope storage.create:/foo/bar allow a client to upload a file bar within the /foo directory, is the client only authorised to create a directory bar?

This looks a duplicate of issue #21 which PR #48 proposes to resolve.

Duplicate of #21 .