UWS joblist implementation issues

[Patrick Dowler]

On 2011-03-03 02:28:46 Paul Harrison wrote:
> My thoughts on this (though probably not expressed clearly enough in the
> spec) were that the intersection of security and UWS was intended to
> result in the user seeing the list of jobs that they were permitted to see
> - this might result in a null list, so I think that I am with Norman on
> this, that a 403 is a little unexpected in this case (though a client
> should be able to deal with it).  In Pat's service where the user has
> authenticated themselves, then it would be easy to list only the jobs that
> belong to the user.

I have thought about this option and it would be useful for users that 
authenticate. The oddness would then come from anonymous users:

POST /path/joblist
303 /path/joblist/123
GET /path/joblist/123
200 <uws:job>....</uws:job>
GET /path/joblist
200 <uws:jobs/>

That is, the user would create a job, could access the job, but the job list 
would still look empty: odd. Or it could contain all the anonymous jobs, which 
has the two other problems:

- could be very large
- would violate what I consider a reasonable expectation of privacy

In general, I agree that a properly (carefully) written UWS client should be 
checking response codes and looking for expected Location header fields and not 
blindly following the redirects. I'm more worried about the naive uws 
interactions scripted by those with less http-savvy because it should work for 
them and be usable... and we are encouraging astronomers to access web 
services directly: heh, it's better than the screen-scraping they used to do 
:-)

Anyway, I agree that this might be something to discuss in naples, possibly in 
the general topic of authentication and authorization.

-- 

Patrick Dowler
Tel/Tél: (250) 363-0044
Canadian Astronomy Data Centre
National Research Council Canada
5071 West Saanich Road
Victoria, BC V9E 2M7

Centre canadien de donnees astronomiques
Conseil national de recherches Canada
5071, chemin West Saanich
Victoria (C.-B.) V9E 2M7