...
- We need to be able to model a range of different populations. These include museum staff, researchers from other institutions, and public annotators (to track tagging activity). This in turn may place serious demands on the authentication and authorization services, since local institutional Auth/AZ systems may only support employees (e.g., integrated SSO and LDAP systems).
Will we need to have classes of Person that can be associated to different Auth/AZ systems? This kind of puts the AZ cart before the horse (defining some roles in the Person service), but it may be necessary. Or perhaps we will need to have some AZ support for Auth models. We basically need a federated Auth system that can work with unified Person and AZ services.
[PatrickS]: We will liley likley need to support hybrid authentication systems. The Person service may define the authentication model used to map to a Principle. In general, roles and policies are enforced using Princples, although they will often be defined (in a UI) using Person or Organization names.
...