OSAccess is a centralized Entitlement Engine. This is not meant to be a replacement for OSUser. Where as OSUser provides for user authentication across different server platforms and then give you access control at deployment time, OSAccess provides portable single point of entry for authorization to an subset of data. Security engines like OSUser let you state that a user can see account information. The Entitlement Engine the OSAccess implements then lets you state that the user can only see his account. Further it says that the support services can see his account but not change it. Thus, OSUser provides a generalized level of security that is effective for securing the website itself. And OSAccess is for securing the data that is displayed by the website resources.

Lets look at an example:

A user comes into an online store. They want to see their current order status. We use OSUser to say that they need to login (Authentication) to get to the Order Status Page (Authorization). Now that we know that the can get to the page we need to know what kind of data we need to show. This is where OSAccess comes in. If this is the person that made the order we show the status. But if this is the shipping center we need to show not only the status but a form or a link to update the status. This is where we get Entitlement. The Shipping Clerk has a different level of entitlement (i.e., update rights) then the customer.

This API provides the access to the following functions:

• Fine-grained access levels for individual resources
• Protection at the User or Group level
• Protection at a large grain level for classes of resources