Use Case: Access Control in Islandora

[kstapelfeldt]

Title (Goal)	Granular Access Control
Primary Actor	Collections Manager
Scope	The scope of the project. Example: architecture, access
Story	As a site administrator/collection manager I wish to map Islandora-specific and Drupal content permissions at the media, metadata, individual node, node type, and collection level so that I can granularly restrict content (for example, video files in a node are available, but the consent forms of subjects of a video are unavailable to those without a given role).

I wish to have these permissions respected to the file level (so that people cannot access direct URLs) and I wish to have these permissions respected in all searches.

I also seek mechanisms to assign these permissions in a time-based way that will automatically expire and/or be based on IP addresses (embargo).

I also seek the ability to apply and modify these permissions by default to objects in a given collection or throughout my repository. This will give me the level of control I require over access to objects in my repository.|

[kstapelfeldt]

See also:

#273
#385
#412
#413
#414
#606
#825

[amyrb]

Is there a use case for connecting to/enabling Fedora permissions? Since the Fedora layer is no longer required, this clearly wouldn't be a default, but would it potentially be a good option for users who keep the Fedora layer?

[DonRichards]

@amyrb It's been discussed that "Permissions by Terms" has scaling issues and "Groups" has an "all or nothing problem" meaning embargoes aren't practical due to the nature of how "Groups" takes over.

So it would be a solid +1 for Fedora if WebAC was used as the ACL method, assuming it blocks access at the fs level and checking the permissions is possible.

What I think would be needed to integrate Fedora's WebAC access control

• WebAC admin config page for global settings
• The integration with Solr to check user permission access
• The integration for Islandora to check user permission access
• Allow for explicit and/or inherited permissions from collection/parent
  • Settings to modify WebAC permissions at the collection, parent, and object level.
• 🤯 Bonus would be a timer to set restricted permissions until a specified Level 0 EDTF date ([dateI][“T”][time][“Z”]). Basically making embargoes possible.

Just a thought 🤷