Page History

The producer of Fedora content wants to be able to set access conditions that would allow for the following scenarios:

• Content can only be accessed by a specific IP address or list of addresses
• Data streams in the object can have different access conditions. i.e. TIF restricted to a single user, JPG open to the campus, PDF open to the world.
• Curator can set authorization in an external system which Fedora can access.
  
  • EZProxy
  • homegrown authorization systems
• Curator can adjust access conditions per object or for thousands/millions of objects at a time
• Curator can set restrictions on the application permitted to open an object. (focus on born digital for this)
  
  • example: Disk image created for a Mac SE, the curator indicates in the access condition the emulation environment required to open the file.
  • note 1: I'm not expecting Fedora to enforce the restriction, only to store it.
  • note 2: I know emulation information can be stored in PREMIS, but information about the required emulation settings is different from requiring a specific software title.
• Curators can set multiple access schemas to an object or data stream in an object. This means a curator could say that a set of IP addresses, an active directory group and a special group in our identity management software may access the materials.
• Curators can set an access restriction flag for an external patron registration system or other complex authorization system such as Aeon (Atlas Systems). In this case, we only need Fedora to know that the restriction exists. We would apply the code that reacts to this requirement in Hydra or some other system which would cause the patron to go off and register/login to some patron tracking system and when they meet the requirements, Hydra/Blacklight would release the objects that meet the requirement.

As for implementation, I can offer some examples of what we use now. We specify the file type/size, the authorization type and then any values associated. Some examples:

TIF - Active Directory Group - ManuscriptCurators

TIF - Aeon

JPG 600px - IP - list of IP values or ranges

PDF - external authentication

JPG 1200px - Yale only

JPG 150px - open access

TIF - NetID - yale\mf438 (or a list of NetIDs)

DSK - Active Directory Group - ManuscriptDirectors

DSK - Emulation - AppleWin v1.1.8

Basically our need is for very granular levels of permission to be stored with the object in Fedora. Right now it is stored as XML as a data stream, it would be beneficial to have it stored differently so that we could make mass changes to materials for entire collections.

Another note, we would only be storing a single JPG or possibly no JPG and only a JP2 and will derive the JPG on the fly. So the access condition setup may include conditions for resolutions of digital formats not contained in the data streams. The JPG examples above would indicate that a single JPG exists as a data stream and from that stream we will derive smaller images. But the access conditions are different for ranges of sizes. For Yale, we stick to these sizes, 150px or less (thumb), 151-600px (medium), 600+ (full resolution). For TIF images we use Full, Half page and Quarter page. Right now, all other sizes/resolutions are tied directly to the file type stored as a data stream. But being able to reference access for something that is dynamically generated would make this scale to future needs.