Module Documentation: eml-access
The EML Access Module describes the level of access that is to be granted or denied to particular users or groups. A single eml-access document may be used express access control mor many resources, or for a given resource (e.g a dataset or document). The relationship between a resource and it's access control document is defined in the eml-package module. The EML Access Module represents a list of resources to be controlled in the context of a particular authentication system. That is, the authentication system determines the set of principals (users + groups) that can be used, and the membership of users in groups. The rules set in this module will determine the level of access to a resource for the defined users and groups.

Element Definitions:

acl
Content of this field: Description of this field:
Elements: Required?: How many:
A sequence of (
identifierRequiredMultiple Times
allowOptionalMultiple Times
denyOptionalMultiple Times
)
Attributes: Required?: Default Value:
orderrequired
authSystemrequired

Tooltip:
Access control list
Summary:
The rules defined in this element will determine the level of access to a resource for the defined users and groups.
Description:
The acl element contains a list of rules that define the level of access for a given resource, be it a dataset or another metadata document. the acl element must contain the elements defined in the ACL type.
Example:
Because the acl element is a container for other elements, look at the contents of its sub-elements for examples of what to enter.
Lineage:
The acl element is derived from eml-access.dtd, version 1.3
identifier
Content of this field: Description of this field:
Type: xs:string
Attributes: Required?: Default Value:
systemoptional

Tooltip:
Unique identifier
Summary:
The unique identifier of this metadata file or object.
Description:
The identifier field provides a unique identifier for this metadata documentation. It will most likely be part of a sequence of numbers or letters that are meaningful in a larger context, such as a metadata catalog. That larger system can be identified in the "system" attribute. Multiple identifiers can be listed corresponding to different catalog systems.
Example:
<identifier system="metacat">nceas.3.2</identifier>
Lineage:
The 'identifier' field is derived from the eml-dataset meta_file_id filed in EML 1.4.
allow
Content of this field: Description of this field:
Type: AccessRule
Attributes: Required?: Default Value:

Tooltip:
Allow permission
Summary:
The permission that grants access to a permission type.
Description:
The allow element indicates that a particular user or group is able to execute the defined permission.
Example:
allow
Lineage:
The deny element was introduced into EML 2.0 Proposed.
deny
Content of this field: Description of this field:
Type: AccessRule
Attributes: Required?: Default Value:

Tooltip:
Deny permission
Summary:
The permission that denies access to a permission type.
Description:
The deny element indicates that a particular user or group is not able to execute the defined permission.
Example:
deny
Lineage:
The deny element was introduced into EML 2.0 Proposed.
principal
Content of this field: Description of this field:
Type: xs:string
Attributes: Required?: Default Value:

Tooltip:
User or group
Summary:
The user or group (principal) for which the access control applies.
Description:
The principal element defines the user or group to which the access control list applies. The users and groups must be defined in the authentication system described in the authSystem element.
Example:
berkley
Lineage:
The principal element was introduced into EML 2.0 Proposed.
permission
Content of this field: Description of this field:
Elements: Required?: How many:
Attributes: Required?: Default Value:

Tooltip:
Type of permission
Summary:
The type of permission being granted or denied for the resource.
Description:
The permission that is being granted or denied to a particular user or group for a given resource. The list of permissions come from a predetermined list, and include 'read' (allow/deny viewing of the resource), 'write' (allow/deny modification of the resource), and 'all' (allow read/write, and the ability to modify access restrictions as well.)
Example:
read
Lineage:
The duration element was introduced into EML 2.0 Proposed.
duration
Content of this field: Description of this field:
Type: rs:TemporalCoverage
Attributes: Required?: Default Value:

Tooltip:
Access duration
Summary:
The duration of time that the permission applies.
Description:
Access to a resource for a particular user or group may be restricted to a limited time frame. This sets the duration of the paticular permission. The period of time is represented as the number of Years, Months, Days, Hours, Minutes, and Seconds that the permission applies to the resource.
Example:
P1Y4M6DT10H9M22S (a period of 1 Year, 4 months, 6 Days, 10 Hours, 9 Minutes, and 22 Seconds)
Lineage:
The duration element was introduced into EML 2.0 Proposed, and is based on the ISO 8601 time standard.
ticketCount
Content of this field: Description of this field:
Type: xs:positiveInteger
Attributes: Required?: Default Value:

Tooltip:
Number of accesses
Summary:
The number of times a user or group may access the resource.
Description:
Access to a resource for a particular user or group may be restricted based on the number of times the resource is accessed.
Example:
4
Lineage:
The ticketCount element was introduced into EML 2.0 Proposed.

Attribute Definitions:

system

Type: xs:string

Use: optional


Tooltip:
Catalog system
Summary:
The catalog system in which this identifier is used.
Description:
This element gives the name of the catalog system in which this identifier is used. It is useful to determine the scope of the identifier, and to determine the semantics of the various subparts of the identifier. Unresolved issue: can or should this be a URI/URL pointing to the catalog system, or just the name?
Example:
<identifier system="metacat">nceas.3.2</identifier>
Lineage:
New to EML 2.0.
order

Use: required


Tooltip:
Permission order
Summary:
The order in which the permission rules should be applied.
Description:
The order attribute defines which rule should be applied first to obtain the desired access control. The acceptable values are pre-defined in a list of 'allowFirst' and 'denyFirst'.
Example:
allowFirst
Lineage:
The order element was introduced into EML 2.0 Proposed.
authSystem

Type: xs:string

Use: required


Tooltip:
Authentication system
Summary:
The authentication system that is used to verify the user or group to whom the ACL allows or denies access.
Description:
The authentication system determines the set of principals (users + groups) that can be used in the access control list, and the membership of users in groups. This element is intended to provide a reference to the authentication system in order to verify the user or group. This reference is typically in the form of a URI, which includes the connection protocol, internet host, and path to the authentication mechanism.
Example:
ldap://directory.nceas.ucsb.edu:389/o=NCEAS,c=US
Lineage:
The authSystem element was introduced into EML 2.0 Proposed.

Complex Type Definitions:

AccessRule
Content of this field: Description of this field:
Elements: Required?: How many:
A sequence of (
principalRequiredMultiple Times
permissionRequiredMultiple Times
durationOptionalOnce
ticketCountOptionalOnce
)
Attributes: Required?: Default Value:

Tooltip:
Access Rule
Summary:
Access Rules define the extent to which a user may access a resource.
Description:
The AccessRule type defines a list of users that are derived from a particular authentication system (such as an LDAP directory), whether the user or group is allowed or denied access, the extent of their access (write access, or only read access), and the duration or number of times that they may access the resource.
Example:

Lineage:
The AccessRule type was introduced into EML 2.0 Proposed

Simple Type Definitions:

Derived from: xs:string (by xs:restriction)

Allowed values:

  • allowFirst
  • denyFirst

Derived from: xs:string (by xs:restriction)

Allowed values:

  • read
  • write
  • all

Web Contact: jones@nceas.ucsb.edu