Improve "Institutional" access function on all tenants

[jillpe]

Our consortium members would like us to spin off tenants for them to build institutional repositories, and they need the "institutional" access visibility restrictions to be more secure than the current function. Currently, "institutional" access only requires a user to be logged in. Anyone can create an account with any email address, and there is no account approval process by members of the institution. Our members require more strenuous access restrictions. Some features they've suggested or asked about include:

• Account creation requires an email address from the institution or institutions (such as @andrews.edu, @oakwood.edu, etc.)
• Account creation requires manual approval by someone at the institution
• Institutional visibility is only available through campus IP address AND/OR it is available by IP address on campus and via institutional email username off campus
• Institutional visibility restricts access to a work, meaning only one user can view at a time.
• A new visibility option is added that restricts access by institutional log in/IP address AND to one user at a time.

This is a medium-high priority, as we need institutional access to work for the new tenant we've been trying to launch for some time (https://car-dl.b2.adventistdigitallibrary.org/). At minimum, we need a more restrictive account creation process across all Adventist Digital Library tenants, because the current function allows anyone to create an account and thereby add works to the library. We cannot have dashboard and import/upload functions available to users without intermediary steps.

[KatharineV]

I heard that someone in the community has Controlled Digital Lending features in the works for Hyku. If we can bring in whatever they have (once it's available), it may be relevant to some of the goals we hope to achieve through the Institutional Access restriction. Definitely need to talk to you all about this more thoroughly, but I'm certain that we need CDL features at some point, and we were looking at implementing access controls as a first step.