Module Documentation: eml-access
Back to EML Contents
The EML Access Module describes the level of access that is to be granted or denied to a resource for a particular user or group of users. A single eml-access document may be used to express access control for many resources, or for a given resource (e.g., a dataset or document). The relationship between a resource and it's access control document is defined in the eml-resource module. The EML Access Module represents a list of resources to be controlled in the context of a particular authentication system. That is, the authentication system determines the set of principals (users + groups) that can be used, and the membership of users in groups. The rules set in this module will determine the level of access to a resource for the defined users and groups.

Element Definitions:

access
Content of this field: Description of this field:
Type: AccessType
Attributes: Required?: Default Value:

Description:
The access element contains a list of rules that define the level of access for a given resource, be it a dataset or another metadata document. Because the access element is declared to be of complex type 'AccessType', an instance must contain the elements defined for accessType.
Example:
See the description of individual elements defined in AccessType to review each component element's rules.
allow
Content of this field: Description of this field:
Type: AccessRule
Attributes: Required?: Default Value:

Description:
The allow element indicates that a particular user or group is able to execute the defined permission.
Example:
allow
deny
Content of this field: Description of this field:
Type: AccessRule
Attributes: Required?: Default Value:

Description:
The deny element indicates that a particular user or group is not able to execute the defined permission.
Example:
deny
references
Content of this field: Description of this field:
Type: xs:string
Attributes: Required?: Default Value:
principal
Content of this field: Description of this field:
Type: xs:string
Attributes: Required?: Default Value:

Description:
The principal element defines the user or group to which the access control rule applies. The users and groups must be defined in the authentication system described in the authSystem element.
Example:
berkley
permission
Content of this field: Description of this field:
Elements: Required?: How many:
Attributes: Required?: Default Value:

Description:
The permission that is being granted or denied to a particular user or group for a given resource. The list of permissions come from a predetermined list (applicable to an LDAP authentication system): (allow/deny viewing of the resource), 'write' (allow/deny modification of the resource), 'changePermission' (ability to modify access restrictions) and 'all' (allow read/write, and the changePermission). This element also allows other permissions that may be applicable to some other authentication system.
Example:
read

Attribute Definitions:

id

Type: xs:string

Use: optional

system

Type: xs:string

Use: optional

scope

Type: res:ScopeType

Use: optional

order

Use: optional


Description:
The order attribute defines which rule should be applied first to obtain the desired access control. The acceptable values are defined in a list of 'allowFirst' and 'denyFirst'.
Example:
allowFirst
authSystem

Type: xs:string

Use: required


Description:
The authentication system determines the set of principals (users + groups) that can be used in the access control list, and the membership of users in groups. This element is intended to provide a reference to the authentication system that is used to verify the user or group. This reference is typically in the form of a URI, which includes the connection protocol, Internet host, and path to the authentication mechanism.
Example:
ldap://directory.nceas.ucsb.edu:389/o=nceas,c=us

Complex Type Definitions:

AccessType
Content of this field: Description of this field:
Elements: Required?: How many:
A choice of (
A choice of (
allowOptionalMultiple Times
OR
denyOptionalMultiple Times
)
referencesOptionalMultiple Times
)
Attributes: Required?: Default Value:
idoptional
systemoptional
scopeoptional
orderoptional
authSystemrequired

Description:
The access element contains a list of rules that define the level of access for a given resource, either a dataset or another metadata document. The access element must contain the elements defined in the AccessType type.
Example:
AccessRule
Content of this field: Description of this field:
Elements: Required?: How many:
A sequence of (
principalOptionalMultiple Times
permissionOptionalMultiple Times
)
Attributes: Required?: Default Value:

Description:
The AccessRule type defines a list of users that are derived from a particular authentication system (such as an LDAP directory), whether the user or group is allowed or denied access, the extent of their access (write access, or only read access).
Example:

Simple Type Definitions:

Derived from: xs:string (by xs:restriction)

Allowed values:

  • allowFirst
  • denyFirst

Derived from: xs:string (by xs:restriction)

Allowed values:

  • read
  • write
  • changePermission
  • all

Derived from: xs:string (by xs:restriction)

Allowed values:

    Web Contact: jones@nceas.ucsb.edu