Module Documentation:
eml-access
| Back to EML Contents |
The eml-access module describes the level of access that is to be granted or denied to a resource or a subset of a resource for a particular user or group of users. A single eml-access document may be used to express access control for many resources, or for a given resource (e.g., a dataset or citation ). The eml-access module represents a list of resources to be controlled in the context of a particular authentication system. That is, the authentication system determines the set of principals (users + groups) that can be used, and the membership of users in groups. The rules set in this module will determine the level of access to a resource for the defined users and groups. In EML, there are two mechanisms for including access control information via the eml-access module. 1) Each top-level resource module (eml-dataset, eml-literature, eml-software, and eml-protocol) include an optional <access> element directly inline in the document. This is used to define access control at the resource level scope. 2) Finer grained access control may be applied to a subset of a resource via the <addtionalMetadata> element in the eml module. An access control document may be defined, or referenced, from this location, and the <describes> element is used to point to the subset of the resource that is to be controlled via its "id" attribute. Applications that process EML documents must implement the access control rules from both mechanisms. Note that, although access control may be bound to any element with an "id" attribute, the processing involved may be very costly. For instance, it would not be recommended to apply access control to a column of a data file (eml-attribute), since every read/write operation on that column may not proceed until access is verified.
The eml-access module, like other modules, may be "referenced" via the <references> tag. This allows an access control document to be described once, and then used as a reference in other locations within the EML document via it's ID.
Recommended Usage: | all data where controlling user access to the dataset is an issue |
Stand-alone: | yes |
Imports: | eml-documentation, eml-resource |
Imported By: | |
View an image of the schema: | eml-access image |
Element Definitions: |
|||||||||||||||||||||||||||||||||||||||||||
access | This element has no default value. | ||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
The access element contains a list of rules that define the level of access for a given resource, be it a dataset or another metadata document. Because the access element is declared to be of complex type 'AccessType', an instance must contain the elements defined for accessType. |
||||||||||||||||||||||||||||||||||||||||||
allow | This element has no default value. | ||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
The allow element indicates that a particular user or group is able to execute the defined permission. |
||||||||||||||||||||||||||||||||||||||||||
deny | This element has no default value. | ||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
The deny element indicates that a particular user or group is not able to execute the defined permission. |
||||||||||||||||||||||||||||||||||||||||||
references | This element has no default value. | ||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||
principal | This element has no default value. | ||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
The principal element defines the user or group to which the access control rule applies. The users and groups must be defined in the authentication system described in the authSystem element. |
||||||||||||||||||||||||||||||||||||||||||
permission | This element has no default value. | ||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
The permission that is being granted or denied to a particular user or group for a given resource. The list of permissions come from a predetermined list (applicable to an LDAP authentication system): (allow/deny viewing of the resource), 'write' (allow/deny modification of the resource), 'changePermission' (ability to modify access restrictions) and 'all' (allow read/write, and the changePermission). This element also allows other permissions that may be applicable to some other authentication system. |
||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||
Attribute Definitions: |
|||||||||||||||||||||||||||||||||||||||||||
id | |||||||||||||||||||||||||||||||||||||||||||
Type: res:IDType Use: optional |
|||||||||||||||||||||||||||||||||||||||||||
system | |||||||||||||||||||||||||||||||||||||||||||
Type: res:SystemType Use: optional |
|||||||||||||||||||||||||||||||||||||||||||
scope | |||||||||||||||||||||||||||||||||||||||||||
Type: res:ScopeType Use: optional Default value: document |
|||||||||||||||||||||||||||||||||||||||||||
order | |||||||||||||||||||||||||||||||||||||||||||
Use: optional Default value: allowFirst |
|||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||
Derived from: xs:string (by xs:restriction) Allowed values:
|
The order attribute defines which rule should be applied first to obtain the desired access control. The acceptable values are defined in a list of 'allowFirst' and 'denyFirst'. |
||||||||||||||||||||||||||||||||||||||||||
authSystem | |||||||||||||||||||||||||||||||||||||||||||
Type: xs:string Use: required |
The authentication system determines the set of principals (users + groups) that can be used in the access control list, and the membership of users in groups. This element is intended to provide a reference to the authentication system that is used to verify the user or group. This reference is typically in the form of a URI, which includes the connection protocol, Internet host, and path to the authentication mechanism. |
||||||||||||||||||||||||||||||||||||||||||
Complex Type Definitions: |
|||||||||||||||||||||||||||||||||||||||||||
AccessType | |||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
The access element contains a list of rules that define the level of access for a given resource, either a dataset or another metadata document. The access element must contain the elements defined in the AccessType type. |
||||||||||||||||||||||||||||||||||||||||||
AccessRule | |||||||||||||||||||||||||||||||||||||||||||
Content of this field: | Description of this field: | ||||||||||||||||||||||||||||||||||||||||||
|
The AccessRule type defines a list of users that are derived from a particular authentication system (such as an LDAP directory), whether the user or group is allowed or denied access, the extent of their access (write access, or only read access). |
||||||||||||||||||||||||||||||||||||||||||
Simple Type Definitions: |
Web Contact: jones@nceas.ucsb.edu