Shi3ld is a context-aware authorization framework for protecting SPARQL endpoints. It assumes the de nition of access policies using RDF and SPARQL, and the speci cation of named graphs to identify the protected resources. These assumptions lead to the incapability for users who are not familiar with such languages and technologies to use the authorization framework. In this paper, we present a graphical user interface to support dataset administrators to de ne access policies and the target elements protected by such policies.
The Shi3ld policy management GUI2 is designed to support the interaction with two kinds of dataset administrators: non-experts, which are assumed not to know the SPARQL query language and RDF, and experts, which are able to edit access policies source code. In particular, the following functionalities are proposed: { Policies visualization and modi cation: the application shows the list of policies stored in the triple store through a grid view. Each policy is an expandable row that, if selected, shows the main features of the policy like the policy target (i.e. the named graphs protected by the policy), the privilege granted by the policy (Create, Update, Read, Delete), and the access conditions (SPARQL 1.1 ASK queries) which specify the requirements that need to be satis ed to access the target resource. Users can edit all these elements, e.g., they associate the policy to another named graph, add or remove privileges, or modify the de ned access conditions. Two di erent views are proposed to the user: i) a graphical view where operations are performed without the need to write policies using SPARQL and RDF to support non-expert administrators, and ii) a textual editor which allows to directly write policies using SPARQL and RDF for expert administrators. { Policies creation: the creation of a new context-aware policy is managed by a wizard. In particular, the wizard proposes the following views: i) the de nition of the policy name (which is then \translated" into an rdfs:label), the target named graph (it is possible to select one of the already de ned named graphs included in the triple store, or to de ne a new one as we will detail later), and the privilege(s) to associate to the policy; ii) the view concerning the User dimension, that consists in a text box where the administrator inserts the features that must be satis ed by the user accessing the target resource, e.g., foaf:knows :ACME boss. The text box provides autocompletion and it suggests a list of properties showing the associated vocabulary (to date, we use the foaf3 and relationship4 vocabularies, but other vocabularies can be added); iii) the view concerning the Environment dimension, that consists in two parts: the rst one de nes temporal conditions, and the second one deals with geographical conditions. Temporal conditions are expressed with a time picker, to select the desired time interval in which the access is granted. The de nition of the geographical condition is done with a map interface5, enriched with a movable marker and a resizable radius; iv) the view concerning the Device dimension, similar to the User view, that suggests the access properties related to the device used to access the target 2 Video available at http://wimmics.inria.fr/projects/shi3ld/ 3 http://xmlns.com/foaf/spec/ 4 http://purl.org/vocab/relationship/ 5 http://developers.google.com/maps/ resource (we use the Delivery Context vocabulary6 but further vocabularies can be added). At the end of the wizard, the access policy is automatically generated and stored in the triple store. { Named graphs creation: the administrator is assisted in the de nition of a new named graph. Shi3ld access policies must be associated to named graphs, and this leads to a number of di cult tasks for non-expert users, since it involves the use of non-trivial SPARQL features. We thus provide a GUI to mask such complexity, by letting administrators de ne a new named graph starting from the set of triples they want to associate to such newly de ned named graph. The application asks for the label of the named graph to be created and it presents the template of a SELECT query, to be completed with the desired triple pattern. A preview of the selected triples is shown, thus letting the administrator check which triples will be added to the named graph. If results are satisfying, the new named graph is created and it can be used as the access policy target.
The Shi3ld Policy Manager is a web application developed in JavaScript
and backed by a Fuseki SPARQL 1.1 triple store7. The server-side relies on the
Node.js platform8, and the front-end is built over jQuery, the Twitter Bootstrap
framework9, and Backbone.js10 as structure. The SPARQL editor is provided by
Flint11.
6 http://www.w3.org/TR/dcontology/
7 http://jena.apache.org/documentation/serving_data/
8 http://nodejs.org/
9 http://twitter.github.io/bootstrap/
10 http://backbonejs.org/
11 http://openuplabs.tso.co.uk/demos/sparqleditor
We have presented a user interface to
declare context-aware policies for the
Shi3ld authorization framework. There
are several issues to be considered as
future research. First, since Shi3ld has
been recently extended to manage also
HTTP access to resources [
Moreover, we envision a \deep" properties validation, (i.e. checking that a certain URI actually corresponds to a foaf pro le). Finally, we will add a sandbox to test the access policies e ectiveness on the protected triples. 12 http://lov.okfn.org/dataset/lov/