Element Definitions:
|
access |
Content of this field:
|
Description of this field:
|
Type: AccessType |
Attributes:
|
Required?:
|
Default Value:
|
|
Description:
The access element contains a list of rules that define
the level of access for a given resource, be it a dataset or another
metadata document. Because the access element is declared to be of
complex type 'AccessType', an instance must contain the elements defined
for accessType.
Example:
See the description of individual elements defined in
AccessType to review each component element's rules.
|
allow |
Content of this field:
|
Description of this field:
|
Type: AccessRule |
Attributes:
|
Required?:
|
Default Value:
|
|
Description:
The allow element indicates that a particular
user or group is able to execute the defined
permission.
Example:
allow
|
deny |
Content of this field:
|
Description of this field:
|
Type: AccessRule |
Attributes:
|
Required?:
|
Default Value:
|
|
Description:
The deny element indicates that a particular
user or group is not able to execute the defined
permission.
Example:
deny
|
references |
Content of this field:
|
Description of this field:
|
Type: xs:string |
Attributes:
|
Required?:
|
Default Value:
|
|
principal |
Content of this field:
|
Description of this field:
|
Type: xs:string |
Attributes:
|
Required?:
|
Default Value:
|
|
Description:
The principal element defines the user or group to
which the access control rule applies. The users and groups must be
defined in the authentication system described in the authSystem
element.
Example:
berkley
|
permission |
Content of this field:
|
Description of this field:
|
Elements:
|
Required?:
|
How many:
|
Attributes:
|
Required?:
|
Default Value:
|
|
Description:
The permission that is being granted or denied to
a particular user or group for a given resource. The list of
permissions come from a predetermined list (applicable to an LDAP
authentication system): (allow/deny viewing of the resource), 'write'
(allow/deny modification of the resource), 'changePermission'
(ability to modify access restrictions) and 'all' (allow read/write,
and the changePermission). This element also allows other
permissions that may be applicable to some other authentication
system.
Example:
read
|
Attribute Definitions:
|
id |
Type: xs:string
Use: optional
|
system |
Type: xs:string
Use: optional
|
scope |
Type: res:ScopeType
Use: optional
|
order |
Use: optional
|
Description:
The order attribute defines which rule should be
applied first to obtain the desired access control. The acceptable
values are defined in a list of 'allowFirst' and
'denyFirst'.
Example:
allowFirst
|
authSystem |
Type: xs:string
Use: required
|
Description:
The authentication system determines the set of
principals (users + groups) that can be used in the access control
list, and the membership of users in groups. This element is intended
to provide a reference to the authentication system that is used to
verify the user or group. This reference is typically in the form
of a URI, which includes the connection protocol, Internet host, and
path to the authentication mechanism.
Example:
ldap://directory.nceas.ucsb.edu:389/o=nceas,c=us
|
Complex Type Definitions:
|
AccessType |
Content of this field:
|
Description of this field:
|
Elements:
|
Required?:
|
How many:
|
A choice of ( |
A choice of ( |
allow | Optional | Multiple Times |
OR
|
deny | Optional | Multiple Times |
) |
references | Optional | Multiple Times |
) |
Attributes:
|
Required?:
|
Default Value:
|
id | optional |
system | optional |
scope | optional |
order | optional |
authSystem | required |
|
Description:
The access element contains a list of rules that define
the level of access for a given resource, either a dataset or another
metadata document. The access element must contain the elements defined
in the AccessType type.
Example:
|
AccessRule |
Content of this field:
|
Description of this field:
|
Elements:
|
Required?:
|
How many:
|
A sequence of ( |
principal | Optional | Multiple Times |
permission | Optional | Multiple Times |
) |
Attributes:
|
Required?:
|
Default Value:
|
|
Description:
The AccessRule type defines a list of users that are
derived from a particular authentication system (such as an LDAP
directory), whether the user or group is allowed or denied access, the
extent of their access (write access, or only read
access).
Example:
|
Simple Type Definitions:
|
|
Derived from: xs:string
(by xs:restriction)
Allowed values:
|
|
|
|
Derived from: xs:string
(by xs:restriction)
Allowed values:
- read
- write
- changePermission
- all
|
|
Derived from: xs:string
(by xs:restriction)
Allowed values:
|