Collections considered ...
Peter Sefton of the AANRO project (and USQ) has
raised the question of whether Fez can support dynamic
collections and do away with the fixed community / collection model
completely.
The AANRO
project at USQ is evaluating repositories for use with a
project for Land and Water Australia.
In Fez, the communities and collection model is hardwired for the
use of the authorisation framework. The model is used so that an
authorisation profile can be applied to a large group of objects.
This is needed in Fez because our UQ eSpace repository
contains some objects which can't be published for copyright
reasons so are only available to certain groups at UQ.
One of the problems with the current authorisation system is that
rules can be applied on collections or communities or both and it
can be confusing as to which rules are being applied. Furthermore,
objects can belong to more than one collection. It would be good to
see a central place where all of the authorisation settings can be
seen.
If Fez were to go down the dynamic collections road, then the
dynamic collections would occur on common specific metata items
that define the collection. This is already implemented with the
browse by author and browse by date links. Dynamic collections
would extend these options to include configuring any metadata to
be used as the criteria for browsing.
However, without the communities and collections heirarchy, Fez
would need a new way to apply the authorisation rules to groups of
objects.
My proposal is to achieve this by implementing a central
authorisation rules table which would map FezACML rulesets to a set
of search criteria. The search criteria defines the set of objects
which will have the FezACML rules applied to them.
Using the concept of a rules table would allow Fez to break out of
the communities / collections mindset and centralise the
authorisation rules making them easier to mange.
- Login to post comments


Loading
Comments
I think you have a good idea here Matt, but would this work work with transitive searching? Eg keeping the current option to do hierarchical auth rulesets by RELS-EXT isMemberOf. Or would this be redundant with a grand auth table view of the repository. Perhaps you could sketch up a mock of what the interface would look like.
Take some inspiration from the Muradora policy setting tool - though I like your idea of setting the policies by search better in a way. Perhaps the auth groups could be like search keys themselves. Lots of possibilities here but the simplest will probably be the most elegant.
I know Chi from Muradora is fairly against auth based on searches (virtual collections), though this could be due to limitations of XACML and the XACML implementation.