Access Requests and Grants

Inrupt’s Enterprise Solid Server (ESS) provides support for Access Request and Grants. With Access Requests and Grants:

• An agent can request access to Resources hosted on a Pod. This Access Request includes the specific access mode (e.g., read, write, append) being requested, the Resources to access, the Purpose for which the data will be used, and other optional fields.

• The owner of the requested Resources (i.e., individuals with Control access to the requested Resources) can review the Access Request and either approve the Access Request, resulting in an Access Grant, or deny the Access Request, resulting in an Access Denial.

• If the requesting agent has an Access Grant, the requesting agent can exchange the Access Grant for an access token in order to access the Resources.

Enable Use of Access Grants

ESS uses Access Control Policy (ACP) to define policies that determine access to Pod resources. To be able to use Access Grants for a Resource, the Resource must have a policy that enables the use of Access Grants.

The policy only enables the use of Access Grants on the Resource for the access modes specified in the policy. To determine the access for an agent who is using an Access Grant, ESS uses the intersection of:

• The allowed access specified by the resource’s ACP, and

• The granted access specified in the Access Grant for that Resource.

For example:

• A Resource has a policy that enables the use of Access Grants for Read access.

• A requesting agent has received an Access Grant for that resource that allows Read and Write access.

Then:

• The requesting agent can use the Access Grant to Read the resource only.

• The requesting agent cannot use the Access Grant to Write the resource, even though the Access Grant specifies both Read and Write access.

ESS enables the use of Access Grants by default. Specifically, when ESS creates a new Pod, ESS creates default policies that enable the use of Access Grants for that Pod.

inrupt-client-accessgrant

To handle Access Requests and Grants, Inrupt’s Java Client Library provides the inrupt-client-accessgrant module. See Installation.

The inrupt-client-accessgrant provides:

AccessGrantClient	AccessGrantClient can interact with the ESS Access Grant Service; specifically, AccessGrantClient can be used to create/verify/query/fetch Access Requests and Grants.
AccessGrantSession	AccessGrantSession allows for the use of Access Grants to interact with Resources; specifically, using an AccessGrantSession, SolidClient/SolidSyncClient can access Resources using the Access Grants.