DMPRoadmap
unwanted behaviour at account creation
During account creation in DMPRoadmap, one can use any email address and choose to which organization one belongs. Afterwards, that person can view the DMPs that were only shared within the organization. That means that any random person that actually is not associated with the organization has access to DMPs meant to only be viewed within an organization and can view possibly sensitive information (email addresses, type of research being performed, who is associated to what research). For many institution there is research performed that are sensitive subjects for the public and researchers can be targeted when it is known that they are involved in such research. Having a platform in which anyone from the public can create an account and freely choose which organization they would like to belong to without any validation, seems very much unwanted behaviour and a security / privacy breach. The current workaround is to make every DMP private, but that defeats the purpose of sharing within an organization.
On some installations of DMProadmap there are already restrictions preventing users from manually changing their organisation to enhance security.
Additionally, here we are working to integrate the Research Organization Registry (RoR). (see Orion). This integration, expected to be completed by the end of July, will improve validation and ensure that an email address is associated only with the organisation it belongs to.
On some installations of DMProadmap there are already restrictions preventing users from manually changing their organisation to enhance security.
Shouldn't that be available on all installations?
are working to integrate the Research Organization Registry (RoR).
Will that then be available to everyone using DMPRoadmap? And what happens to everyone allready signed in and associated with an organization? How does this work in conjunction with 'sign in with institutional credentials'? Currently a new user first has to create a DMP account (any email address used) and afterwards can link the DMP account with the 'institutional sign in option'. Does this mean that anyone that used a general email address (outlook, gmail) and linked that account to institutional sign in, be removed from the organization?
@andreadavanzo I understood from above and our meeting that these features and the one from https://github.com/DMPRoadmap/roadmap/issues/3533 would be available end of July. Do you have a more specific time-frame when the updates will be present?
@Danny-dK some parts have been already deployed and other will be released this week