ESciDoc Admin Roles

Administrative roles in eSciDoc

To allow for more clear separation between various administrative privileges for some eSciDoc master and system resources, instead of originally envisioned Local administrator role, there will be several separate roles for management of each resource in the system. Below more precise definition of these roles.

UserAdministrator

A User Administrator is a role which allows for creation of new user accounts, but also granting/revoking some privileges to these user accounts. Any user with a user administrator role has the following privileges:

• create user account
• retrieve, modify, activate, deactivate user accounts (s)he created

This role is unlimited role.

OUAdministrator

   *
         o create/modify/... org units within a parent OU (given as a scope)
         o grant / revoke OUAdmin privs for OU with same scope 

Context Administrator

• create 2 new roles ContextOwner (?), ContextAdmin (?)

UserGroup Administrator

internal id: escidoc:role-user-group-administrator

A User-Group-Administrator is allowed to:

• create user-groups
• retrieve, update, delete, activate, deactivate user-groups (s)he created
• add and remove user-group-selectors to user-groups (s)he created.
• create, retrieve and revoke user-group-grants for user groups (s)he created

This role is a unlimited role. (Has no scope-definitions).

UserGroup Inspector

internal id: escidoc:role-user-group-inspector

A User-Group-Inspector is allowed to:

• retrieve user-groups he has respective grants for

User group inspector is a role that should be granted to users who are not members of a user-group, but would have the right to retrieve a particular user-group in order to e.g. grant some privileges for their objects.

This role is a limited role. It is restricted to a user-group.

Enhanced Scientific Documentation

Organizational Unit