Re: Permission Denied when using DL reasoning

[Samir Batla]

Oh, I'm using Startdog 1.1

On Wednesday, 12 December 2012 10:15:32 UTC-5, Samir Batla wrote:

Hi,

I am running the following query:

./stardog query -c "http://localhost:5822/myDB;reasoning=DL" -q "SELECT ?s WHERE { ?s a <http://xxx/SomeThing>}"

Executing Query:

SELECT ?s WHERE { ?s a <http://xxxSomeThing>}

and I get:

Permission denied

Aside from potentially having some issues with either TBox or ABox, I don't understand the "Permission Denied" issue. I don't get it when I use EL reasoning for instance. I have the same ontology in Protege, and I do get individuals for "SomeThing". I read the security documentation and may have missed something. I am using Stardog "out-of-the-box", I haven't created any users or changed any roles/permissions.

Thanks!

[Mike Grove]

On Wed, Dec 12, 2012 at 10:15 AM, Samir Batla <sab...@mac.com> wrote:

Hi,

I am running the following query:

./stardog query -c "http://localhost:5822/myDB;reasoning=DL" -q "SELECT ?s WHERE { ?s a <http://xxx/SomeThing>}"

Executing Query:

SELECT ?s WHERE { ?s a <http://xxxSomeThing>}

and I get:

Permission denied

This is a bug in the error handling in the HTTP server, there is an issue during query evaluation and the error code was getting mis-translated to a permission denied error.  This will be fixed in 1.1.1.  In the meantime, you can use the SNARL protocol which translates the error correctly.

The error message that was supposed to be shown is "The reasoning type was set to "DL", but the query contains ABox or Hybrid BGPs. See the docs for a discussion of data, schema, and hybrid SPARQL queries."

DL reasoning in Stardog is restricted to queries about the schema of your ontology; you cannot query the ABox using a query w/ DL reasoning as your query is doing.  This is explained in further detail in the docs [1].  This is why your query worked with EL, the schema-only restriction does not apply.

Cheers,

Mike

[1] http://stardog.com/docs/owl2/#trouble

 

Aside from potentially having some issues with either TBox or ABox, I don't understand the "Permission Denied" issue. I don't get it when I use EL reasoning for instance. I have the same ontology in Protege, and I do get individuals for "SomeThing". I read the security documentation and may have missed something. I am using Stardog "out-of-the-box", I haven't created any users or changed any roles/permissions.

Thanks!

--
-- --
You received this message because you are subscribed to the C&P "Stardog" group.
To post to this group, send email to sta...@clarkparsia.com
To unsubscribe from this group, send email to
stardog+u...@clarkparsia.com
For more options, visit this group at
http://groups.google.com/a/clarkparsia.com/group/stardog?hl=en
 
 

[Samir Batla]

Thanks Mike,

I will take a deeper read through BGP's.

I have inverse object property assertions and since EL does not support reasoning on those, I used DL. Using EL, I was not getting members of the class "SomeThing", when there are indeed (but only DL would show them). Earlier I stated that it worked - when actually, I got zero members - what I meant was that I did not get the error.

It's possible I have some modeling errors unrelated to this that could be causing the problem.

Thanks,

Batla

[Mike Grove]

On Wed, Dec 12, 2012 at 11:26 AM, Samir Batla <sab...@me.com> wrote:

Thanks Mike,

I will take a deeper read through BGP's.

I have inverse object property assertions and since EL does not support reasoning on those, I used DL. Using EL, I was not getting members of the class "SomeThing", when there are indeed (but only DL would show them). Earlier I stated that it worked - when actually, I got zero members - what I meant was that I did not get the error.

It's possible I have some modeling errors unrelated to this that could be causing the problem.

To be clear, it's possible you have issues in the modeling of your ontology, it is however the *query* that you sent that is the problem.  "?s a <http://xxx/SomeThing" is a query over the ABox which you cannot do with DL reasoning in Stardog.

Cheers,

Mike

[Brandon Ibach]

Have you tried using QL or RL reasoning?  Both of these profiles (and, I believe, Stardog's implementation of them) support inverse object properties.

-Brandon :)

On Wed, Dec 12, 2012 at 11:26 AM, Samir Batla <sab...@me.com> wrote:

[Samir Batla]

It seems that I certainly need EL.

I'm now using snarl protocol and no longer getting the permission denied error. But, i am getting a message when running this query:

--------

./stardog query -c "snarl://localhost:5820/myDB;reasoning=EL" -q "SELECT ?s WHERE { ?s a <http://xxx/IntersectionOfTwoClasses>}"

Executing Query:

SELECT ?s WHERE { ?s a <http://xxx/IntersectionOfTwoClasses>}

See server logs for details.

--------

The only log I see is stardog.log off of the home directory. And it does not contain any messages pertaining to this query. Just the last load.

Here is my ontology:

    <owl:Class rdf:about="&xxx;IntersectionOfTwoClasses"> [ should have members a, b, c, e; but I get the message above]

        <owl:equivalentClass>

            <owl:Class>

                <owl:intersectionOf rdf:parseType="Collection">

                    <rdf:Description rdf:about="&xxx;Class1"/>

                    <rdf:Description rdf:about="&xxx;Class2"/>

                </owl:intersectionOf>

            </owl:Class>

        </owl:equivalentClass>

    </owl:Class>

    <owl:Class rdf:about="&xxx;Class1"> [has members a, b, c, e; query works]

        <owl:equivalentClass>

            <owl:Class>

                <owl:intersectionOf rdf:parseType="Collection">

                    <rdf:Description rdf:about="&xxx;Class"/>

                    <owl:Restriction>

                        <owl:onProperty rdf:resource="&xxx;thingPurchasedBy"/>

                        <owl:someValuesFrom rdf:resource="&foaf;Person"/>

                    </owl:Restriction>

                </owl:intersectionOf>

            </owl:Class>

        </owl:equivalentClass>

    </owl:Class>

query: SELECT ?s WHERE { ?s a <http://xxx/Class1>}

returns individuals: a, b, c, e

-----------

    <owl:Class rdf:about="&xxx;Class2">

        <owl:equivalentClass>

            <owl:Class>

                <owl:intersectionOf rdf:parseType="Collection">

                    <rdf:Description rdf:about="&xxx;Class"/>

                    <owl:Restriction>

                        <owl:onProperty rdf:resource="&xxx;thingType"/>

                        <owl:hasValue rdf:datatype="&xsd;integer">1</owl:hasValue>

                    </owl:Restriction>

                </owl:intersectionOf>

            </owl:Class>

        </owl:equivalentClass>

    </owl:Class>

query: SELECT ?s WHERE { ?s a <http://xxx/Class2>}

returns individuals: a, b, c, d, e

Maybe I'm missing something...Protege shows the desired outcome; not sure what I'm missing.

Thanks,

Batla

[Mike Grove]

On Wed, Dec 12, 2012 at 1:09 PM, Samir Batla <sab...@me.com> wrote:

It seems that I certainly need EL.

I'm now using snarl protocol and no longer getting the permission denied error. But, i am getting a message when running this query:

--------

./stardog query -c "snarl://localhost:5820/myDB;reasoning=EL" -q "SELECT ?s WHERE { ?s a <http://xxx/IntersectionOfTwoClasses>}"

Executing Query:

SELECT ?s WHERE { ?s a <http://xxx/IntersectionOfTwoClasses>}

See server logs for details.

fwiw, what ends up in the log is minimal out of the box, you can configure logging to see more details than just the basics.

It's hard to theorize what could be going on with incomplete snippets of your ontology.  If you can please send the ontology, the data, and the actual query that causes the error so we can reproduce, I'd be happy to look into this.

Cheers,

Mike

[Samir Batla]

I hate it when this happens.

All of a sudden the query is working. I put the .properties file in the home directory and added audit logging. I stopped/started the server; but because I have the community version, I got the message to disable logging. I commented it out and started the server.

For kicks I ran the same query over again (see below)...on the same ontology and instances and got the answer I was looking for - using EL.

The restart is the only explanation I can come up with. Something to keep in mind? Thoughts?

Whew!