Device access control list

Defines who can access to the device per resource. The access control list is stored in the device in the /oic/sec/acl2 resource. The access control list is a list of access control entries. Each access control entry defines a subject and a set of permissions for the subject. The subject can be a connection type, a device, or a role. The permissions define what the subject can do with the resource. The permissions are defined in the permission property of the access control entry. The permissions are defined as a bit mask. The following table shows the permissions that can be defined in the permission property.

When resources where the subject has access you can use wildcards */+/- in the wildcard property of the access control resource entry.

For device configuration resources you need to specify href property in the access control resource entry.

The list of device configuration resources:

When device is in read for ownership transfer method (RFOTM) state, only device configuration resources and OCF public resources are accessible. ACL is applied only in normal device state. To allow access to the resources in RFOTM state you need to have enabled the feature in IoTivity lite via cmake -DOC_RESOURCE_ACCESS_IN_RFOTM_ENABLED=ON ... when building IoTivity lite and mark each resource via function oc_resource_set_access_in_RFOTM. The default value is OFF.

To update ACL device need to be in provisioning state. To change device state is described in here.

The update of ACL is done via POST method on the /oic/sec/acl2 resource with body:

{
  "aclist2": [
    {
      "permission": 31, // full access
      "resources": [
        {
          "wc": "*", // all resources
          "if": [ "*" ] // all interfaces
        }
      ],
      "subject": { // type of subject is defined by body content
        "uuid": "00000000-0000-0000-0000-000000000000" // device id
      }
    }
  ]
}

        {
  "aclist2": [
    {
      "permission": 31, // full access
      "resources": [
        {
          "wc": "*", // all resources
          "if": [ "*" ] // all interfaces
        }
      ],
      "subject": { // type of subject is defined by body content
        "uuid": "00000000-0000-0000-0000-000000000000" // device id
      }
    }
  ]
}
    

• https://docs.plgd.dev/docs/tutorials/how-to-onboard-device-to-hub/
• https://docs.plgd.dev/docs/tutorials/disaster-recovery-replica-set/
• https://docs.plgd.dev/docs/services/device-provisioning-service/onboarding-device/
• https://docs.plgd.dev/docs/services/device-provisioning-service/device-provisioning-service/
• https://docs.plgd.dev/docs/features/control-plane/control-plane/