Overview

The Islandora XACML Editor provides a graphical user interface to edit XACML policies for objects in a repository or collection. It adds a new section in the Manage tab for each object and collection called Object Policy where permissions can be granted to Drupal users or roles for the following:

Dependencies

Drupal.org modules:

Installation

Install as usual, see this for further information.

Usage

Using the Object Policy tab to manage access restrictions with XACML

Configuration

Module Configuration

Configuration options for the Islandora XACML Editor and Islandora XACML API are available at admin/islandora/tools/xacml

Islandora XACML API

Islandora XACML API

Islandora XACML Editor

Islandora XACML editor

Fedora Configuration

If you want to grant access in Drupal for users without the "administrator" role to edit XACML policies, you will have to remove one of the default XACML policies applied globally at the Fedora Commons level which denies any interactions with the POLICY datastream to users without the "administrator" role.

This policy is located here: $FEDORA_HOME/data/fedora-xacml-policies/repository-policies/default/deny-policy-management-if-not-administrator.xml

See the Islandora Deployments GitHub repository for more examples of customized global XACML policies in Islandora's Fedora Commons.

Notes