Module Documentation: eml-access
Back to EML Contents
The EML Access Module describes the level of access that is to be granted or denied to a resource for a particular user or group of users. A single eml-access document may be used express access control for many resources, or for a given resource (e.g., a dataset or document). The relationship between a resource and it's access control document is defined in the eml-resource module. The EML Access Module represents a list of resources to be controlled in the context of a particular authentication system. That is, the authentication system determines the set of principals (users + groups) that can be used, and the membership of users in groups. The rules set in this module will determine the level of access to a resource for the defined users and groups.

Element Definitions:

acl
  Tooltip: Access control list  
  Summary: The rules defined in this element will determine the level of access to a resource for the defined users and groups.  
  Description: The acl element contains a list of rules that define the level of access for a given resource, be it a dataset or another metadata document. the acl element must contain the elements defined in the ACL type.  
  Example: Because the acl element is a container for other elements, look at the contents of its sub-elements for examples of what to enter.  
identifier
  Tooltip: Unique identifier  
  Summary: The unique identifier of this metadata file or object.  
  Description: The identifier field provides a unique identifier for this metadata documentation. It will most likely be part of a sequence of numbers or letters that are meaningful in a larger context, such as a metadata catalog. That larger system can be identified in the "system" attribute. Multiple identifiers can be listed corresponding to different catalog systems.  
  Example: <identifier system="metacat">nceas.3.2</identifier>  
allow
  Tooltip: Allow permission  
  Summary: The permission that grants access to a permission type.  
  Description: The allow element indicates that a particular user or group is able to execute the defined permission.  
  Example: allow  
deny
  Tooltip: Deny permission  
  Summary: The permission that denies access to a permission type.  
  Description: The deny element indicates that a particular user or group is not able to execute the defined permission.  
  Example: deny  
principal
  Tooltip: User or group  
  Summary: The user or group (principal) for which the access control applies.  
  Description: The principal element defines the user or group to which the access control list applies. The users and groups must be defined in the authentication system described in the authSystem element.  
  Example: berkley  
permission
  Tooltip: Type of permission  
  Summary: The type of permission being granted or denied for the resource.  
  Description: The permission that is being granted or denied to a particular user or group for a given resource. The list of permissions come from a predetermined list, and include 'read' (allow/deny viewing of the resource), 'write' (allow/deny modification of the resource), and 'all' (allow read/write, and the ability to modify access restrictions as well.)  
  Example: read  
duration
  Tooltip: Access duration  
  Summary: The duration of time that the permission applies.  
  Description: Access to a resource for a particular user or group may be restricted to a limited time frame. This sets the duration of the paticular permission. The period of time is represented as the number of Years, Months, Days, Hours, Minutes, and Seconds that the permission applies to the resource.  
  Example: P1Y4M6DT10H9M22S (a period of 1 Year, 4 months, 6 Days, 10 Hours, 9 Minutes, and 22 Seconds)  
ticketCount
  Tooltip: Number of accesses  
  Summary: The number of times a user or group may access the resource.  
  Description: Access to a resource for a particular user or group may be restricted based on the number of times the resource is accessed.  
  Example: 4  

Attribute Definitions:

system
  Tooltip: Catalog system  
  Summary: The catalog system in which this identifier is used.  
  Description: This element gives the name of the catalog system in which this identifier is used. It is useful to determine the scope of the identifier, and to determine the semantics of the various subparts of the identifier. Unresolved issue: can or should this be a URI/URL pointing to the catalog system, or just the name?  
  Example: <identifier system="metacat">nceas.3.2</identifier>  
order
  Tooltip: Permission order  
  Summary: The order in which the permission rules should be applied.  
  Description: The order attribute defines which rule should be applied first to obtain the desired access control. The acceptable values are pre-defined in a list of 'allowFirst' and 'denyFirst'.  
  Example: allowFirst  
authSystem
  Tooltip: Authentication system  
  Summary: The authentication system that is used to verify the user or group to whom the ACL allows or denies access.  
  Description: The authentication system determines the set of principals (users + groups) that can be used in the access control list, and the membership of users in groups. This element is intended to provide a reference to the authentication system in order to verify the user or group. This reference is typically in the form of a URI, which includes the connection protocol, internet host, and path to the authentication mechanism.  
  Example: ldap://directory.nceas.ucsb.edu:389/o=NCEAS,c=US  

Web Contact: jones@nceas.ucsb.edu