Usage scenario
1) Professor Schonfeld's ODE course roster is provisioned into the Learning Management System

An integration service at the campus automagically creates groups for each section of active courses and makes participants (students, lecturers, professor of record, TAs, auditors, etc.) members of those groups (Either Grouper or Kuali Rice KIM provide Policy Administration Points (PAP)s for defining and running the automagic course group creation and maintenance routines. The provisioning of group information is handled by what we are calling a Policy Provisioning Point (PPP)

2) Professor Schonfeld grants a week of extended access to course materials at the request of a bereaved student

Professor Schonfeld creates her course materials under the course heading, and the PAP automagically create privileges to all materials associated with the course. End dates default to the end of the term. The PPP then provisions that to the LMS.

When the student asks the prof to extend her access to the materials because of a death in her family, the prof uses the (Grouper or KIM) PAP to create a privilege to view appropriate course materials for another week and assigns that privilege to the student.

3) Student accesses course materials

At the time students attempt to access course materials by clicking on a link, logic in the LMS (the Policy Enforcemenet Point, PEP) sends the user's group memberships and privileges (delivered by the SSO login service and pulling information from the campus Person Hub (a Policy Information Point, PIP) to the PDP for an allow/deny decision. Note that the PDP may be code running in the LMS in the same module as the PEP.

In the case of the bereaved student, the PEP will ask the PDP and the PDP will find her specially created privilege during the granted extension period, and she will be allowed to review course materials as requested.

See Also

XACML Terminology and Data Flow Diagram

  • No labels