permissions and ":authenticated-user"

[Jamie Jamison]

I'm trying to set up a sub-dataverse for library materials that are limited to users affiliated with UCLA.  Patrons would log in through shibboleth and be able to download material.

I found a role -  " Anyone with a dataverse account | :authenticated-users "

I thought this might force users to log in when they try to download. But this doesn't happen, anyone logged in or not can download. I can't tell if this has to do with shibboleth or I might be misunderstanding what ":authenticated-users" does.

I'd set this up as restricted but the librarian who would be admin doesn't want to deal with the requests.  His idea is they come in through shibboleth and download.

Thank you,

Jamie

[Sherry Lake]

Hi Jamie,

UVA has shibboleth-only log in, so only UVa folks can create accounts.

I have, on our test server, a sub-dataverse where "authenticated-users" can only download. Here's a screen shot of the sub-dataverse permissions (which populates through all datasets in that sub-directory - no other permissions set up for datasets):

A non-logged in user sees this for all files in any dataset in the sub-dataverse; there is no download button  (The text "File accessible to ...." we put in the file description):

Once logged on, via shibboleth, the download button appears:

--
You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To post to this group, send email to dataverse...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/cf2590d5-bfc3-472e-9a38-e2b71b11c45e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Durand, Gustavo]

Hi Jamie,

Just to be completely clear about these scenarios, you do have to restrict the file. Adding the File Dowloader role (as Sherry did) only works, if the file is restricted in the first place. But if it is, then the :authenticated-users role would allow anyone logged in to download.

In the future, when we have DataTags support, it would be a little different. You would just need to set the file as "green". Where blue is anyone can download, green is anyone who has authenticated can download.

Hope that helps.

Gustavo

On Tue, Jul 16, 2019 at 10:25 PM Sherry Lake <shla...@gmail.com> wrote:

Hi Jamie,

UVA has shibboleth-only log in, so only UVa folks can create accounts.

I have, on our test server, a sub-dataverse where "authenticated-users" can only download. Here's a screen shot of the sub-dataverse permissions (which populates through all datasets in that sub-directory - no other permissions set up for datasets):

A non-logged in user sees this for all files in any dataset in the sub-dataverse; there is no download button  (The text "File accessible to ...." we put in the file description):

Once logged on, via shibboleth, the download button appears:

On Tue, Jul 16, 2019 at 7:31 PM Jamie Jamison <jam...@g.ucla.edu> wrote:

--

You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To post to this group, send email to dataverse...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/cf2590d5-bfc3-472e-9a38-e2b71b11c45e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To post to this group, send email to dataverse...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/CADL9p-XF_U18Y0zEuvQtXii64Fs80DQS-7X6P75k1qxyxi5ZJg%40mail.gmail.com.

[Sherry Lake]

Yes, thanks Gustavo. The files are restricted. 

I forgot that important point. That’s what I get when replying without my notes & relying on memory. 

—

Sherry

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/CAF2sSefSZGVCqO2MHvZwisrrOQ4z6u%3DhHLOo6vr0dqpAQTyrCQ%40mail.gmail.com.

[Philip Durbin]

Hi Jamie and all,

When I hear you say this: "I'm trying to set up a sub-dataverse for library materials that are limited to users affiliated with UCLA.  Patrons would log in through shibboleth and be able to download material."

I'm strongly reminded of a blog post[1] about how only Harvard affiliates are allowed to download data from https://dataverse.harvard.edu/dataverse/HarvardSubscriptionData

In a similar fashion, only MIT affiliates can download restricted data from https://dataverse.harvard.edu/dataverse/mit

Harvard Dataverse makes use of the "Institution-Wide Shibboleth Groups" feature to achieve this: http://guides.dataverse.org/en/4.15.1/installation/shibboleth.html#institution-wide-shibboleth-groups

The idea is that Harvard Dataverse creates two of these groups, one for Harvard and one for MIT. (We might have more; I'm not sure.)

Then someone gives permission to this group (file downloader, I assume) on the dataverse in question.

As you say, this eliminates any effort going into maintaining lists of who should have access based on their affiliation. If they have MIT credentials, they get access to that restricted data. If they leave MIT, poof, that access is gone.

I hope this helps,

Phil

1. https://dataverse.org/blog/harvard%E2%80%99s-subscription-data-dataverse

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/CADL9p-Xsui%3DN2PP%2BJX%3Dkod%2B%3D3-OEtFvneS2s-jc7p%3DTO47F45w%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin

[Jamie Jamison]

Thank you Sherry, Gustavo and Phil,

Following your explanations the datavers on the test site is setup. 

Jamie