| Wiki Markup |
|---|
This document is a work in progress \[Feb 2009\]. |
Required Features for first release
Ideal Timeline: (Beta) Release by OpenRepositories '09 (May 18‑21)
Overview
Create a useful AuthN/AuthZ implementation for Fedora that can be bundled with Fedora and included in the installer. It must lend itself to integration with any Fedora client application.
...
Use DRAMA Code as starting point.
Vocabulary (Policy Templates)
Provide pre-vetted set of policy templates for:
...
... should spend some time thinking about combining collection-level policies when objects belong to multiple collections.
Authentication (AuthN)
- Support surrogate authentication and document how to do it
- Support LDAP and Tomcat-Users
- Implement authentication in a modular way so that participating organizations can write their own adapters (ie. Drupal integration)
- Use servlet filters to enforce access controls on all inbound requests
Policy Manager / Authorization (AuthZ)
- Enforce policies at Datastream, Object and Collection level. (Rely on either RELS-EXT or Fedora's bundled RIsearch for evaluating collection memberships.)
- Support use of Fedora Objects' POLICY datastream
General
- Keep the implementation stable & current
- Bundle solution with Fedora and include it in the installer
- Audit the Implementation for potential security flaws
- Support community innovation & allow people to completely replace the whole thing if they wish
- Ensure that there are points that allow for future development
Desirable Features (not required for first release)
- Support Shibboleth
- Support OpenID & OpenAuth
- Support Single Sign-on (SSO) - must be pluggable/overridable
- Allow for Custom AuthN
- User Interface and REST API for editing policies on Objects, Datastreams, and Collections
- Simple, intuitive, well documented vocabulary for controlling Read, Create, Edit, Delete, and "Change Permissions" for Collections, Objects, and Datastreams
- User interface & REST API for editing policies on Collections, Objects, and Datastreams
- Allow repository managers to find out what policies apply to a given Object, Datastream, or Collection
Work Packages
In order to satisfy the Requirements for an initial release, the following work must be done.
...