When you register with Apstrata, an account will be created for you. With each account creation, there is a default user Schema named "apsdb_user" that gets created. The purpose of this Schema is to give the owner the possibility of defining custom user profiles. Hence, an owner can add new fields, define permissions, and define validation rules for each field. When saving users, custom user attributes can be set and validated automatically based on the rules defined for each one. The fields already defined in the default user Schema are required and should not be removed. This user schema is not meant to be used for saving non-user documents.
A User entity is persisted as a Document in the apstrata account user directory Store, based on the Schema named "apsdb_user".
A User can belong to zero or more Groups defining his read and write permissions.
A user can be suspended by calling SaveUser and setting the system field "isSuspended" to true. A suspended user still exists in the system but is treated as if he was deleted. Any request made to Apstrata with this user will return an exception saying that the signature is invalid. The user can be reactivated by calling SaveUser and setting the field "isSuspended" back to false. By default, the ACL of this field are set in a way that only the owner of the account can suspend or un-suspend a user but you are free to change those ACLs by updating your user schema.
Note that owners will always have the permission to call the GetUser and SaveUser APIs, but Users can only read or update their own profile Documents. In other words, the permissions defined in the Schema ACLs can only be used to restrict Users from accessing their own profile Document or other Users profile Documents.
For more details about schema definition, please refer to Document Schema Definition.
Default User Schema (apsdb_user)
<!--
This is the default user schema. Feel free to modify it to your liking.
This schema follows all rules and restrictions as all other schemas, as do the documents (users) created out of it.
However, it imposes the following restrictions of its own:
1. The six default fields (groups, name, login, password, locale and isSuspended) are required.
2. This schema cannot be deleted.
Additionally, since this schema is used for user management, the following ACLs are set by default upon creation of each new user document:
- document.readACL = login, creator
- document.writeACL = login, creator
- deleteACL = nobody
- required.readACL = nobody
- required.writeACL = nobody
- requiredVisibles.readACL = login, creator
- requiredVisibles.writeACL = nobody
- requiredEditables.readACL = login, creator
- requiredEditables.writeACL = login, creator
You can specify your own ACLs upon user creation by passing them as parameters to the SaveUser API as described in the documentation.
-->
<schema>
<aclGroups>
<aclGroup name="required">
<read>nobody</read>
<write>nobody</write>
<fields>
<field>isSuspended</field>
</fields>
</aclGroup>
<aclGroup name="requiredVisibles">
<read>creator</read>
<write>nobody</write>
<fields>
<field>login</field>
<field>groups</field>
</fields>
</aclGroup>
<aclGroup name="requiredEditables">
<read>creator</read>
<write>creator</write>
<fields>
<field>name</field>
<field>password</field>
<field>locale</field>
</fields>
</aclGroup>
<defaultAcl>
<read>creator</read>
<write>creator</write>
</defaultAcl>
<schemaAcl>
<read>creator</read>
<write>creator</write>
<delete>nobody</delete>
</schemaAcl>
</aclGroups>
<fields>
<field name="login" type="string"/>
<field name="name" type="string"/>
<field name="groups" type="string"/>
<field name="password" type="string" />
<field name="locale" type="string" />
<field name="isSuspended" type="string" />
</fields>
</schema>