[brainstorming]Licenses framework using authorization

[kosarko]

brainstorming:

Would it be possible to use the authorization framework as a basis for a licensing framework?

A license on an item (or more precisely on it's bitstreams) could by something like READ access for a group (and no anonymous access).

pros:

• seems this way it could be pushed more easily into upstream dspace
• group membership (signed licenses) could be coming from aai (or something like REMS from CSCfi?)

cons:

• can you do ask always type of licenses?
• potentially many policies (would it be more db rows than what we have in the utilities database?)
• how to ask for signature/confirmation (policies are used for embargoes, how are embargoes communicated?)

+/-:

• would it open the possibility of having different licenses per bitstream (not sure we'd like to have that). What and how would get into the metadata

[kosarko]

confirmed 'ask always' implemented as a per user policy valid for a short period? where would the confirmation happen?

can we borrow ideas from OAUTH? Is there a notion of time limited claim?