Here’s our own use case: We want all events to be public (not protected), so the wider community or general public can see which events are (or have been) happening. But some events will contain materials that cannot be made public (e.g. containing information shared under the TLP other than “clear”) but only made available to the participants of a given event.
AFAIU we should use ACLs for that but we don’t have/want any local user accounts (only via IDP) and some events are open to the general public, meaning some participants will not have an IDP to authenticate at (i.e., they cannot log in). Those events consequently allow public registation and that all works fine until the question of protecting materials comes up.
(That seems to be the same use case Barbara mentions in the thread about protecting photos of participants.)
I had hoped that we could use event access keys to protect selected materials (cf. Restrict materials access - #4 by Jacky_Li or Access Key for Uploaded Materials · Issue #3101 · indico/indico · GitHub ) but that’s not possible.
The other thing I could think of — registration confirmation emails contain a tokenthat allow access to their registration without having to authenticate — also didn’t work for accessing protected materials, unfortunately.
Seems the only option we’re left with would be to protect (i.e., hide) the whole event (with an access key because, again, we can’t use IP ranges or require accounts for events widely open) instead of only protecting (selected) materials?