[UC] Overview/Log of Resource Access (Behaviour)

[termontwouter]

As a Resource Owner/Controller,
I want to have an overview of who accessed which resource at which time,
So that I have an idea of the access activities and can change my policies accordingly if necessary.

Preconditions:

• A Resource Owner/Controller can manage policies over some resources on an LWS-compatible resource server.
• Resource Users interact with the RO/RC's Authorization Server and Resource Servers to access resources.
• The Authorization Service has granted a certain access request (and the Resource User has accessed the resource).

Trigger:

The Resource Owner/Controller wants to check who had/has access to and/or accessed their resources (recently).

Actors:

• [Primary] The Resource Owner/Controller (~ Data Holder/Supplier): an agent who has partial/delegated (controller) or ultimate (owner) control over policies concerning certain resources.

• [Technical] The Resource Server (~ Data Provider): the LWS-compatible system that technically provides the resources.

• [Technical] The Authorization Service: the access management system used by the RO/RC to protect their resources on the RS.

Distinction:

To ensure that their policies are correct, and no unintended RUs have gained access to their resources, RO/RCs should be able to check who had/has access to their data. This can be interesting both on the level of access requests (granted/denied), as on the level of concrete resource access.

Scenario:

1. The RO/RC goes to their Authorization Service, and selects the 'Recent access' overview page.
2. The Authorization Server lists all RUs that have been granted access (recently).

Alternative case(s):

• For concrete access, this functionality should be implemented on the Resource Server side, rather than on by the Authorization Service.

• Apart from just recent access, a log of the entire access history could be available for auditing purposes.

Error scenario:

• Listing every granted/denied access request, and especially every concrete resource access, might become extremely verbose in an ever more automated, data-centered world (e.g., with IoT devices continuously reading/writing to the LWS).

• An entire log might take too much space. An archiving function should help with that.

Acceptance Criteria:

• RO/RCs can get an overview of who (recently) had/has access to and/or accessed their resources.