Metacat User Authentication and Access Control |
Back | Home | Next |
Authentication
Metacat has a public interface for porting authentication schemes to Metacat. The two schemes that are currently implemented are:
Access control in Metacat.
Metacat allows a user to set permissions on individual documents by using a special XML file called an Access file. In this file, the user can specify a docid (or a list of docids) and the permissions that should be assigned to the docid. A sample Access file looks like the following.
<?xml version="1.0"?> <!DOCTYPE acl PUBLIC "-//NCEAS//eml-access//EN" "http://dev.nceas.ucsb.edu/bojilova/dtd/eml-access.dtd"> <acl authSystem="null"> <resource order="allowFirst" public="yes"> <resourceIdentifier>metacat://dev.nceas.ucsb.edu/metacat?docid=nceas.18</resourceIdentifier> <resourceIdentifier>metacat://dev.nceas.ucsb.edu/metacat?docid=nceas.17</resourceIdentifier> <resourceIdentifier>metacat://dev.nceas.ucsb.edu/metacat?docid=nceas.22</resourceIdentifier> <allow> <principal>jones</principal> <principal>higgins</principal> <principal>berkley</principal> <principal>bojilova</principal> <permission>read</permission> <duration>10/9/2000 10/9/2001</duration> <ticketCount>100</ticketCount> </allow> <allow> <principal>bojilova</principal> <permission>write</permission> <ticketCount>10</ticketCount> </allow> <allow> <principal>reviewers</principal> <permission>read</permission> <ticketCount>5</ticketCount> </allow> <allow> <principal>blankman</principal> <permission>all</permission> </allow> <deny> <principal>eddins</principal> <permission>all</permission> </deny> </resource> </acl>
This file is read into Metacat like any other XML file. Like Packages the doctype is checked against the accessdoctype parameter in the Metacat Properties file. If the doctype matches, special postprocessing is performed on the document and the persmissions described in the file are applied to the specified document.
Each access file can have multiple <resource> tags. The attributes for <resource> are 'order' and 'public'. Order referrs to which permission type to process first, allow or deny. The allowed values are "allowFirst" and "denyFirst". The default is "allowFirst". Public refers to whether the public (anonymous) user should have read access to the resource(s). The default is "yes".
The <resourceIdentifier> tag specifies the document(s) to which these access rules apply. The content should be a metacat:// URL.
Next are the permissions themselves. An allow tag gives permissions to the specified user(s) (<principal>) and a deny tag take the permissions away from the user(s). A principal should be a registered user or group. A timed duration can be set on the permission after which the user(s) will no longer have the specified permission. A ticket count can also be set. This gives the user the number of accesses specified. After the user has accessed the document that number of times, the permissions are revoked.