Task Doms Auth system

Title

Doms Auth system

State

Not started

Time used

Time estimated

Description

The doms auth system is responsible for ensuring that no user can access files without sufficient credentials. Furthermore, parts or entire doms record should be blockable with the auth system.

The Auth system is based around Fedora as the Authorization provider. Object policies are expressed in Fedora in XACML. There is meant to be a number of Authentication providers.

The auth system is layered. Authentication happens on the outer layer, against whatever Authentication providers we link with. The trusted services on the outer layer establishes the users roles/attributes. These are then communicated to Fedora, which evaluates them against the authorization policy.

With this design, we can have a single Authorization provider, and thus one place to define policies, but integrate with numerous signon systems.

The following components need to be established.

1. Some service that converts user roles into credentials that Fedora can work with.
   • This could be done with a temporary LDAP server, or similar, or some magical stuff directly with Fedora. KFC has expressed views on this, so the design will not be completed without him
2. A system that transparently handles the credentials when requesting files from bitstorage
3. A system that transparently handles the credentials when displaying Doms objects in Summa

RolesForFedora

Bitstorage

Summa display

Sub tasks

Documentation

• Analysis Document

• Design Document

• System Set-up and Maintenance Document

Progress history