Use case 1 - Fedora managing access conditions
Title (goal) | Fedora managing access conditions |
---|---|
Primary Actor | Librarian/archivist/curator |
Scope | |
Level | User goal |
Story | The producer of Fedora content wants to be able to set access conditions that would allow for the following scenarios:
As for implementation, I can offer some examples of what we use now. We specify the file type/size, the authorization type and then any values associated. Some examples: TIF - Active Directory Group - ManuscriptCurators TIF - Aeon JPG 600px - IP - list of IP values or ranges PDF - external authentication JPG 1200px - Yale only JPG 150px - open access TIF - NetID - yale\mf438 (or a list of NetIDs) DSK - Active Directory Group - ManuscriptDirectors DSK - Emulation - AppleWin v1.1.8 Basically our need is for very granular levels of permission to be stored with the object in Fedora. Right now it is stored as XML as a data stream, it would be beneficial to have it stored differently so that we could make mass changes to materials for entire collections. Another note, we would only be storing a single JPG or possibly no JPG and only a JP2 and will derive the JPG on the fly. So the access condition setup may include conditions for resolutions of digital formats not contained in the data streams. The JPG examples above would indicate that a single JPG exists as a data stream and from that stream we will derive smaller images. But the access conditions are different for ranges of sizes. For Yale, we stick to these sizes, 150px or less (thumb), 151-600px (medium), 600+ (full resolution). For TIF images we use Full, Half page and Quarter page. Right now, all other sizes/resolutions are tied directly to the file type stored as a data stream. But being able to reference access for something that is dynamically generated would make this scale to future needs. |
4 Comments
David Wilcox
For the final paragraph, on the fly derivatives will not be supported in Fedora 4.0.
Andrew Woods
Regarding item #2, yes, access controls can currently be assigned down to the datastream level.
It would be instructive to see if Michael Friscia could verify this is also true from Yale's perspective.
Michael Friscia
IP addresses have recently come into some scrutiny here at Yale as we move to private IP addresses. While I am confident that we will retain static IP addresses specifically for very secure content where we need to have a trusted connection between a computer and Fedora, I'm wondering if there are any thoughts to come up with some form of token/response method of providing content to a target computer without a static IP and to also securely encrypt the content during transfer. I'm kind of thinking out loud but thought it would be worth adding that as we start to move into storing data sets and other types of content that require significant layers of security on them into our repositories, it would be worth talking more about potential security layers to adopt.
I'll get the programmers to test the data stream level access controls to confirm this possibility.
Andrew Woods
Without getting into potential implementations (token/response), it may be worth describing what you would like to achieve (such as, authorize access to unauthenticated users from within the institutional network, etc).
For transfer encryption, is SSL not sufficient?
Honestly, there is a lot going on in this use case. If we want to be able to address Yale's needs, we will need to break these into smaller pieces and prioritize. Any help you can offer regarding prioritization of your individual pieces would be helpful.